senren-ui 0.1.5 → 0.1.6

data/templates/components/pagination/pagination_component.rb

@@ -18,7 +18,8 @@ module Senren
     def page_url(page)
       return '#' unless path
 
-      path.respond_to?(:call) ? path.call(page) : path.to_s.gsub(':page', page.to_s)
+      safe_page = page.to_i.clamp(1, total_pages)
+      safe_url(path.respond_to?(:call) ? path.call(safe_page) : path.to_s.gsub(':page', safe_page.to_s))
     end
   end
 end

data/templates/components/sidebar/sidebar_component.rb

@@ -24,12 +24,12 @@ module Senren
         if item.is_a?(Hash)
           {
             label: item[:label] || item['label'],
-            href: item[:href] || item['href'] || '#',
+            href: safe_url(item[:href] || item['href']),
             active: item[:active] || item['active']
           }
         else
           label, href = item
-          { label: label, href: href || '#', active: false }
+          { label: label, href: safe_url(href), active: false }
         end
       end
     end

data/templates/components/switch/switch_component.html.erb

@@ -1,4 +1,4 @@
-<label class="inline-flex items-center gap-3 cursor-pointer">
+<%= tag.label(**root_attrs("inline-flex items-center gap-3 cursor-pointer")) do %>
   <span class="relative inline-flex h-6 w-11 items-center rounded-full bg-[hsl(var(--senren-muted))] has-[:checked]:bg-[hsl(var(--senren-primary))] transition-colors">
     <input type="checkbox" role="switch" id="<%= id %>" name="<%= name %>" value="<%= value %>" <%= "checked" if checked %> class="peer sr-only">
     <span aria-hidden="true" class="absolute left-0.5 top-0.5 inline-block h-5 w-5 transform rounded-full bg-[hsl(var(--senren-background))] transition-transform peer-checked:translate-x-5"></span>
@@ -8,4 +8,4 @@
   <% else %>
     <%= content %>
   <% end %>
-</label>
+<% end %>

data/templates/components/top_nav/top_nav_component.rb

@@ -31,12 +31,12 @@ module Senren
         if item.is_a?(Hash)
           {
             label: item[:label] || item['label'],
-            href: item[:href] || item['href'] || '#',
+            href: safe_url(item[:href] || item['href']),
             active: item[:active] || item['active']
           }
         else
           label, href = item
-          { label: label, href: href || '#', active: false }
+          { label: label, href: safe_url(href), active: false }
         end
       end
     end

data/templates/controllers/rich_text_editor_lite_controller.js

@@ -1,5 +1,7 @@
 import { Controller } from "@hotwired/stimulus"
 
+const ALLOWED_LINK_PROTOCOLS = new Set(["http:", "https:", "mailto:", "tel:"])
+
 // senren--rich-text-editor-lite
 // Local UI: tiny contenteditable toolbar synced to a hidden textarea.
 export default class extends Controller {
@@ -280,8 +282,16 @@ export default class extends Controller {
   normalizeUrl(rawUrl) {
     const url = String(rawUrl || "").trim()
     if (url.length === 0) return null
-    if (/^(?:[a-z][a-z0-9+.-]*:|\/|#)/i.test(url)) return url
-    return `https://${url}`
+    if (url.startsWith("#")) return url
+    if (url.startsWith("/") && !url.startsWith("//")) return url
+
+    const candidate = /^[a-z][a-z0-9+.-]*:/i.test(url) ? url : `https://${url}`
+    try {
+      const parsed = new URL(candidate, window.location.origin)
+      return ALLOWED_LINK_PROTOCOLS.has(parsed.protocol) ? parsed.href : null
+    } catch (_) {
+      return null
+    }
   }
 
   activeRange() {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: senren-ui
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.6
 platform: ruby
 authors:
 - vutt
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: nokogiri
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.19.3
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.19.3
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -29,14 +43,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: 4.9.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: 4.9.0
 description: |
   Senren UI is a Rails-native UI component library inspired by the developer
   experience of shadcn/ui. It ships generators, a registry, and a centralized
@@ -53,7 +67,10 @@ files:
 - LICENSE
 - README.md
 - Rakefile
+- docs/components.md
+- docs/performance_testing.md
 - docs/visual_style.md
+- lib/commands/senren/add/add_command.rb
 - lib/generators/senren/component/component_generator.rb
 - lib/generators/senren/component/templates/component.html.erb.tt
 - lib/generators/senren/component/templates/component.rb.tt
@@ -68,6 +85,7 @@ files:
 - lib/senren/rails.rb
 - lib/senren/rails/agent_rules_writer.rb
 - lib/senren/rails/component_copier.rb
+- lib/senren/rails/component_installer.rb
 - lib/senren/rails/doctor.rb
 - lib/senren/rails/engine.rb
 - lib/senren/rails/host_paths.rb
@@ -245,7 +263,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.1.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="