simple_calendar 3.1.2 → 3.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1789f19b1f7e2ff7dfe9734bd1ef5a4ff45a76204c52f63155854fca76cc033
-  data.tar.gz: 7128d7d5d2f8a65d9377aafdd828edd8e30d8e7a2f56ca0f7ca7c95a81bb5928
+  metadata.gz: ff7274d9f8305cdc76ae38121b4722d5279eb9e548e0fcf15496952bf1bf96cd
+  data.tar.gz: 5fd6aa597857b392849405a1bb21ef1ef810857b58dfc1e53c096087c2f09374
 SHA512:
-  metadata.gz: acf827741610c4a259770cdf52da653156816c7bb75c31a1228b543ebcf5761b66c72b3594da14dd680c542947fd2b018629d0ccd089d7c685ef21704c30413a
-  data.tar.gz: 22f93c93d076483140e00c79ed33a8e194d3d1ad3624513fa7e9959be6107e5d1a7c5b9909464b98a1fbecfd3ec0a918293d51d12969aa9ff06f810992b6c051
+  metadata.gz: 2dfd685ac91b3df7126c3705d7e9bf40141dc8e094b416cb01ee68ddb3d50528493844601fabebe2b2996edacc1a12b04af1816dbbf87e624eb2c469dd1f76aa
+  data.tar.gz: a44fd4ac691982e753d79b51ae60ebc1a72a202cb62c89d950939bbe42dd499f48772d3e9ee22ace84ebed9c8cf90bb0165a1dbe62414f83c461f200e85f406f

data/lib/simple_calendar/calendar.rb

@@ -2,14 +2,15 @@ require "rails"
 
 module SimpleCalendar
   class Calendar
-    # Besides form noise, this drops keys url_for treats as URL options instead of query
-    # params. Passing them through from the request would let a crafted link change the
-    # host, protocol, route, etc. of the Previous / Today / Next links (open redirect,
-    # javascript: XSS, 500s).
-    PARAM_KEY_BLACKLIST = :authenticity_token, :commit, :utf8, :_method, :script_name,
-      :host, :protocol, :port, :subdomain, :domain, :tld_length, :trailing_slash, :anchor,
-      :params, :only_path, :original_script_name, :relative_url_root, :user, :password,
-      :use_route, :_recall
+    PARAM_KEY_BLACKLIST = :authenticity_token, :commit, :utf8, :_method, :script_name
+
+    # Keys url_for treats as URL options instead of query params. The built-in links don't
+    # need these dropped (see url_for_date), but custom calendars that copied the old
+    # `url_for(@params.merge(...))` override pass @params straight to url_for, so they're
+    # left out of @params to keep those links from being pointed at another host, etc.
+    URL_OPTION_KEYS = :host, :protocol, :port, :subdomain, :domain, :tld_length,
+      :trailing_slash, :anchor, :params, :only_path, :original_script_name,
+      :relative_url_root, :user, :password, :use_route, :_recall
 
     attr_accessor :view_context, :options
 
@@ -20,12 +21,15 @@ module SimpleCalendar
       @block = block
 
       # Next and previous view links should use the same params as the current view
-      @params = @view_context.respond_to?(:params) ? @view_context.params : {}
-      @params = @params.to_unsafe_h if @params.respond_to?(:to_unsafe_h)
-      @params = @params.with_indifferent_access.except(*PARAM_KEY_BLACKLIST)
+      @request_params = @view_context.respond_to?(:params) ? @view_context.params : {}
+      @request_params = @request_params.to_unsafe_h if @request_params.respond_to?(:to_unsafe_h)
+      @request_params = @request_params.with_indifferent_access.except(*PARAM_KEY_BLACKLIST)
+
+      # Params passed in by the developer are trusted, so they're allowed to be url_for options
+      @calendar_params = @options.fetch(:params, {}).to_h.symbolize_keys
 
-      # Add in any additional params the user passed in
-      @params.merge!(@options.fetch(:params, {}))
+      # Nothing in here uses @params anymore, but custom calendars still build their own links from it
+      @params = @request_params.except(*URL_OPTION_KEYS).merge(@calendar_params)
     end
 
     def render_in(view_context, &block)
@@ -72,15 +76,25 @@ module SimpleCalendar
     end
 
     def url_for_next_view
-      view_context.url_for(@params.merge(start_date_param => (date_range.last + 1.day).iso8601))
+      url_for_date(date_range.last + 1.day)
     end
 
     def url_for_previous_view
-      view_context.url_for(@params.merge(start_date_param => (date_range.first - date_range.count.days).iso8601))
+      url_for_date(date_range.first - date_range.count.days)
     end
 
     def url_for_today_view
-      view_context.url_for(@params.merge(start_date_param => Time.current.to_date.iso8601))
+      url_for_date(Time.current.to_date)
+    end
+
+    # Only routing params and params passed in by the developer are given to url_for as
+    # options. Everything else from the request goes under `params:`, which url_for always
+    # treats as query params, so no request param can be read as a URL option. Route
+    # segments named like a URL option (say `servers/:host`) are left to url_for, which
+    # fills them in from the current request as path segments.
+    def url_for_date(date)
+      url_options = path_parameters.except(*URL_OPTION_KEYS).merge(@calendar_params).merge(start_date_param => date.iso8601)
+      view_context.url_for(url_options.merge(params: @request_params.except(*path_parameters.keys, *url_options.keys)))
     end
 
     def date_range
@@ -146,6 +160,10 @@ module SimpleCalendar
 
     private
 
+    def path_parameters
+      view_context.try(:request)&.path_parameters || {}
+    end
+
     def start_date_from_params
       view_context.params[start_date_param].try(:to_date)
     rescue ArgumentError # Date::Error inherits from ArgumentError

data/lib/simple_calendar/month_calendar.rb

@@ -5,7 +5,7 @@ module SimpleCalendar
     end
 
     def url_for_previous_view
-      view_context.url_for(@params.merge(start_date_param => (date_range.first - 1.day).iso8601))
+      url_for_date(date_range.first - 1.day)
     end
   end
 end

data/lib/simple_calendar/version.rb

@@ -1,3 +1,3 @@
 module SimpleCalendar
-  VERSION = "3.1.2"
+  VERSION = "3.1.3"
 end

data/lib/simple_calendar/week_calendar.rb

@@ -21,7 +21,7 @@ module SimpleCalendar
     end
 
     def url_for_previous_view
-      view_context.url_for(@params.merge(start_date_param => (date_range.first - 1.day).iso8601))
+      url_for_date(date_range.first - 1.day)
     end
 
     private

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: simple_calendar
 version: !ruby/object:Gem::Version
-  version: 3.1.2
+  version: 3.1.3
 platform: ruby
 authors:
 - Chris Oliver
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-12 00:00:00.000000000 Z
+date: 2026-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails