senren-ui 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0af2c6143260dc7e068bb79237a99b7e58d6ea0523c7863ab328ff7773d4148e
-  data.tar.gz: 31b1bd8c86eb92ba5caf578ed314ebd857aac247b6fb214007a145acfe7dc76f
+  metadata.gz: 6a7c6c06cf2fbc28902f954562926b0b5a75a5b22591074c2bd7bc94a398ebf0
+  data.tar.gz: 1c272c73f0008bca421d43a85ca55d217c10d563aa8ec0880083fad0c412dab0
 SHA512:
-  metadata.gz: 292220303c382a0b84f7e59cd4b1c0806f901f3fe4cb27a85d70eaddad304f501c1412e6df19d49bcf5546cf050cdf60937b9f2233d191f660bbb6f0e0f1f3c5
-  data.tar.gz: 88efe90a4fac627f9fc103d1c811738f63b03f7413f83040c5d4c7d893188f47587284d89fe249b2c902025f82fb9ba46a53f0dce7fa595eef8b4ba2644cff2d
+  metadata.gz: b200e044d76d070cfa3657f967603adff7236a1b224a20ee08ed3e5a9e9ff35492d57a28782257b470df1c2901112ec6a60874556e292f5fc075a7ee5f29abb9
+  data.tar.gz: edee24c78567f1199468eebe25c676f23044fb622122a0bdb1658cbb4398fd3e8ac9d664812d7ccd3b13a52c8cfbe9039e61aa5e49ecbeeb124f01da13df24f6

data/CHANGELOG.md

@@ -7,6 +7,21 @@ and adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 v0.x is a pre-stable line: minor bumps may break things; patch bumps are
 bug fixes only.
 
+## [0.4.2] — 2026-10-26
+
+### Security
+
+- Refuse `senren:install` destinations that resolve outside the host app,
+  including symlinked files, parent directories, and dangling links, before
+  creating or changing files.
+- Detect component source exposed through symlinked asset paths before a
+  deployed app boots or precompiles assets. Dedicated sidecar asset directories
+  remain supported.
+- Require Crass 1.0.8 and ViewComponent 4.14.0 or newer so consumer bundles
+  enforce the CSS sanitizer and render-state security fixes.
+- Update development tooling's `source-map-js` to 1.2.2 for CVE-2026-93749
+  and add JavaScript dependency audits to local and GitHub CI.
+
 ## [0.4.1] — 2026-10-08
 
 ### Fixed

data/lib/generators/senren/install/install_generator.rb

@@ -29,6 +29,25 @@ module Senren
       class_option :force_locales, type: :boolean, default: false,
                                    desc: 'Replace locale files that already exist with the shipped ones.'
 
+      # Thor's template/copy/gsub actions follow destination symlinks. Check
+      # every destination before the first directory is created, including
+      # files read before rewriting and links whose targets do not exist yet.
+      def validate_install_destinations
+        destinations = [
+          host_paths.senren_dir, host_paths.components_dir, host_paths.stimulus_dir,
+          host_paths.stylesheet_path, host_paths.stylesheet_path.dirname.join('senren_themes.css'),
+          host_paths.base_component_path, host_paths.conventions_file, host_paths.installed_components,
+          host_paths.registry_mirror, host_paths.skill_file, host_paths.agent_rules_file,
+          host_paths.codex_agents_md, host_paths.claude_md, host_paths.copilot_instructions,
+          host_paths.cursor_rule_file,
+          host_paths.root.join('app/javascript/controllers/index.js'), host_paths.root.join('config/importmap.rb')
+        ]
+        destinations.concat(options[:locales].map { |locale| host_paths.locale_file(locale) })
+        destinations.each do |path|
+          Senren::Rails::SafeWrite.assert_inside!(path, host_paths.root, 'senren:install')
+        end
+      end
+
       def create_senren_dir
         empty_directory '.senren'
       end

data/lib/senren/rails/asset_path_guard.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'pathname'
+
 module Senren
   module Rails
     # Refuses to let component source be served as a static asset.
@@ -58,23 +60,20 @@ module Senren
         components = components_dir(app)
         return [] unless components&.directory?
 
-        asset_paths(app).select { |path| publishes_source?(path, components) }
+        sources = component_sources(components)
+        return [] if sources.empty?
+
+        asset_paths(app).select { |path| publishes_source?(path, sources) }
       end
 
-      # Whether serving this asset path would serve component source.
-      #
-      # `source_files?` used to be asked once about app/components as a whole,
-      # which is the wrong question for a descendant path: with that shape,
-      # app/components/assets holding nothing but CSS looked identical to
-      # app/components/senren holding every component. Only the overlapping
-      # subtree can publish anything, and that subtree is the deeper of the two
-      # paths.
-      def publishes_source?(asset_path, components)
+      # Propshaft follows directory and file symlinks when collecting assets.
+      # Compare their real targets, including links nested below an asset path,
+      # so an alias cannot publish source past the production boot guard.
+      def publishes_source?(asset_path, sources)
         asset = Pathname.new(asset_path.to_s).expand_path
-        components = components.expand_path
-        return false unless overlap?(asset, components)
+        return false unless asset.directory?
 
-        source_files?(asset.to_s.length >= components.to_s.length ? asset : components)
+        each_file(asset).any? { |_, target| sources.key?(target) }
       end
 
       def components_dir(app)
@@ -83,8 +82,30 @@ module Senren
         nil
       end
 
-      def source_files?(dir)
-        SOURCE_EXTENSIONS.any? { |ext| Dir.glob(dir.join("**/*#{ext}")).any? }
+      def component_sources(components)
+        each_file(components).with_object({}) do |(path, target), sources|
+          sources[target] = true if [path.extname, target.extname].any? { |ext| SOURCE_EXTENSIONS.include?(ext) }
+        end
+      end
+
+      # Track real directory identities so aliases and cycles are visited once.
+      # Keep the original filename as well: widget.rb may point to a differently
+      # named file outside app/components, which is still component source.
+      def each_file(path, visited = {}, &block)
+        return enum_for(__method__, path, visited) unless block
+
+        target = path.realpath
+        if target.directory?
+          return if visited[target]
+
+          visited[target] = true
+          target.children.each { |child| each_file(child, visited, &block) }
+        else
+          block.call(path, target)
+        end
+      rescue Errno::ENOENT, Errno::ENOTDIR, Errno::ELOOP
+        # Broken links cannot publish content; visited directories stop cycles.
+        nil
       end
 
       def asset_paths(app)
@@ -93,24 +114,6 @@ module Senren
         []
       end
 
-      # Two paths overlap when one contains the other, in EITHER direction, and
-      # the test has to be separator-aware:
-      #
-      #   app/components         is an ancestor  -> publishes everything
-      #   app/components/senren  is a descendant -> publishes the components
-      #   app/comp               shares a prefix -> publishes nothing
-      #
-      # The first version tested only the ancestor direction with a bare
-      # start_with?, so it missed the descendant case — which is what a
-      # developer writes after reading this module's own remediation text — and
-      # it blocked production boots over an unrelated app/comp directory.
-      def overlap?(one, other)
-        a = "#{one}#{File::SEPARATOR}"
-        b = "#{other}#{File::SEPARATOR}"
-
-        a.start_with?(b) || b.start_with?(a)
-      end
-
       def message_for(offenders)
         <<~MESSAGE.strip
           app/components is on the asset load path (#{offenders.join(', ')}).

data/lib/senren/rails/version.rb

@@ -2,6 +2,6 @@
 
 module Senren
   module Rails
-    VERSION = '0.4.1'
+    VERSION = '0.4.2'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: senren-ui
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - vutt
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: crass
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.8
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.8
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -29,14 +43,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.9.0
+        version: 4.14.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.9.0
+        version: 4.14.0
 description: |
   Senren UI is a Rails-native UI component library inspired by the developer
   experience of shadcn/ui. It ships generators, a registry, and a centralized