spoom 1.8.10 → 1.8.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 616b67329b164de71785d14b0354c5b4567aa3d062c522f4bf1f8348b33eb5de
-  data.tar.gz: f89cde916059f3d5c21fb86a702bccc2817adbbf95da25a0201ea19c420e8c93
+  metadata.gz: 284bf38248b3fb6c057966d56d0bbcd01e3fa4142e6a619ffacb98eb159a6d7d
+  data.tar.gz: 44551f71e890cde0d0a71e77b8a4d627c7aafbddaa8e0e3a7106135c6962398a
 SHA512:
-  metadata.gz: d08700dba2f90d25267122d4fbfc5949cc8fd2e3a1480282e42784d95f6acdb99e731062e83ea55fde23a60a1db87e191fc6cfe37cc9a3300b8539a125fd5a9f
-  data.tar.gz: df7367580d6969dbb3a1bc609f5a4a3564ddf3a054d49cde6ef7d7cf68dac51c21d3dabd2c35dae1e82573ead6f7e4971d0098f2b90fb378d3b3dd6674f66582
+  metadata.gz: 60c251eaa56b3ad7ffac08afe381203869146040b144c7893013dcb098fc9150bad9a05b49bc303919946904b0757a6ddd285282a80bf64f607630d942b57d19
+  data.tar.gz: 462f445ffb6b740ef17486e52d3e3c65d000f482199206ea3ef6e39c7a9aa7183c9df8097b73967f89f3db5c88d3e751edba61c3fb691f2909a48930a0d78b5e

data/README.md

@@ -387,6 +387,20 @@ Remove a reported dead code candidate:
 spoom deadcode remove path/to/file.rb:42:18-47:23
 ```
 
+#### Custom plugins
+
+Teach `spoom deadcode` about your project's own DSLs by adding plugins to `.spoom/deadcode/plugins/*.rb`. Each file should define a subclass of `Spoom::Deadcode::Plugins::Base`:
+
+```ruby
+# .spoom/deadcode/plugins/my_plugin.rb
+class MyPlugin < Spoom::Deadcode::Plugins::Base
+  ignore_methods_named("my_dsl_method")
+end
+```
+
+> [!WARNING]
+> Custom plugins are loaded with `require`, so `spoom deadcode` executes any Ruby code in `.spoom/deadcode/plugins/` of the project being analyzed. Only run `spoom deadcode` on projects you trust, and inspect or remove `.spoom/deadcode/plugins/` before analyzing untrusted code (such as a pull request from an outside contributor).
+
 ## Ruby API
 
 ### Parsing Sorbet config

data/lib/spoom/cli/deadcode.rb

@@ -73,7 +73,18 @@ module Spoom
         end
 
         plugin_classes = Spoom::Deadcode.plugins_from_gemfile_lock(context)
-        plugin_classes.merge(Spoom::Deadcode.load_custom_plugins(context))
+
+        custom_plugin_files = context.glob("#{Spoom::Deadcode::DEFAULT_CUSTOM_PLUGINS_PATH}/*.rb")
+        unless custom_plugin_files.empty?
+          say_warning(
+            "Loading custom plugins from `#{Spoom::Deadcode::DEFAULT_CUSTOM_PLUGINS_PATH}`. " \
+              "This executes Ruby code from the analyzed project:",
+          )
+          custom_plugin_files.each do |file|
+            $stderr.puts "  #{gray(file)}"
+          end
+          plugin_classes.merge(Spoom::Deadcode.load_custom_plugins(context))
+        end
         if options[:show_plugins]
           $stderr.puts "\nLoaded #{blue(plugin_classes.size.to_s)} plugins\n"
           plugin_classes.each do |plugin|

data/lib/spoom/cli/srb/coverage.rb

@@ -153,6 +153,9 @@ module Spoom
           snapshots = files.sort.map do |file|
             json = File.read(file)
             Spoom::Coverage::Snapshot.from_json(json)
+          rescue Spoom::Coverage::Snapshot::Error => e
+            say_error("Invalid snapshot `#{file}`: #{e.message}")
+            exit(1)
           end.filter(&:commit_timestamp).sort_by!(&:commit_timestamp)
 
           palette = Spoom::Coverage::D3::ColorPalette.new(

data/lib/spoom/coverage/d3/base.rb

@@ -6,6 +6,9 @@ module Spoom
     module D3
       # @abstract
       class Base
+        # Characters that must not appear raw inside a `<script>` element, and their JSON string escapes
+        JS_LITERAL_ESCAPES = { "<" => '\u003c', ">" => '\u003e', "&" => '\u0026' }.freeze #: Hash[String, String]
+
         #: String
         attr_reader :id
 
@@ -43,6 +46,18 @@ module Spoom
         # @abstract
         #: -> String
         def script = raise NotImplementedError, "Abstract method called"
+
+        private
+
+        # Serialize `value` as a JavaScript literal that is safe to embed in a `<script>` tag
+        #
+        # `script_safe` escapes `/` so the data can't contain `</script>`. We also escape `<`, `>` and `&`
+        # so the data can't contain `<!--` or `<script`, which change how the HTML parser reads the rest
+        # of the `<script>` element.
+        #: (untyped value) -> String
+        def js_literal(value)
+          JSON.generate(value, script_safe: true).gsub(/[<>&]/, JS_LITERAL_ESCAPES)
+        end
       end
     end
   end

data/lib/spoom/coverage/d3/circle_map.rb

@@ -47,7 +47,7 @@ module Spoom
 
               function tooltipMap(d) {
                 moveTooltip(d)
-                  .html("<b>" + d.data.name + "</b>")
+                  .html("<b>" + escapeHtml(d.data.name) + "</b>")
               }
             JS
           end
@@ -57,7 +57,7 @@ module Spoom
         #: -> String
         def script
           <<~JS
-            var root = {children: #{@data.to_json}}
+            var root = {children: #{js_literal(@data)}}
             var dataHeight = treeHeight(root)
 
             var opacity = d3.scaleLinear()

data/lib/spoom/coverage/d3/pie.rb

@@ -38,8 +38,8 @@ module Spoom
             <<~JS
               function tooltipPie(d, title, kind, sum) {
                 moveTooltip(d)
-                  .html("<b>" + title + "</b><br><br>"
-                    + "<b>" + d.data.value + "</b> " + kind + "<br>"
+                  .html("<b>" + escapeHtml(title) + "</b><br><br>"
+                    + "<b>" + escapeHtml(d.data.value) + "</b> " + kind + "<br>"
                     + "<b>" + toPercent(d.data.value, sum) + "</b>%")
               }
             JS
@@ -52,11 +52,11 @@ module Spoom
           <<~JS
             #{tooltip}
 
-            var json_#{id} = #{@data.to_json};
+            var json_#{id} = #{js_literal(@data)};
             var pie_#{id} = d3.pie().value((d) => d.value);
             var data_#{id} = pie_#{id}(d3.entries(json_#{id}));
             var sum_#{id} = d3.sum(data_#{id}, (d) => d.data.value);
-            var title_#{id} = #{@title.to_json};
+            var title_#{id} = #{js_literal(@title)};
 
             function draw_#{id}() {
               var pieSize_#{id} = document.getElementById("#{id}").clientWidth - 10;

data/lib/spoom/coverage/d3/timeline.rb

@@ -81,10 +81,10 @@ module Spoom
 
               function tooltipTimeline(d, kind) {
                 moveTooltip(d)
-                  .html("commit <b>" + d.data.commit + "</b><br>"
+                  .html("commit <b>" + escapeHtml(d.data.commit) + "</b><br>"
                     + d3.timeFormat("%y/%m/%d")(parseDate(d.data.timestamp)) + "<br><br>"
-                    + "<b>typed: " + d.key + "</b><br><br>"
-                    + "<b>" + (d.data.values[d.key] ? d.data.values[d.key] : 0) + "</b> " + kind +"<br>"
+                    + "<b>typed: " + escapeHtml(d.key) + "</b><br><br>"
+                    + "<b>" + escapeHtml(d.data.values[d.key] ? d.data.values[d.key] : 0) + "</b> " + kind +"<br>"
                     + "<b>" + toPercent(d.data.values[d.key] ? d.data.values[d.key] : 0, d.data.total) + "%")
               }
             JS
@@ -97,7 +97,7 @@ module Spoom
           <<~HTML
             #{tooltip}
 
-            var data_#{id} = #{@data.to_json};
+            var data_#{id} = #{js_literal(@data)};
 
             function draw_#{id}() {
               var width_#{id} = document.getElementById("#{id}").clientWidth;
@@ -245,10 +245,10 @@ module Spoom
             <<~JS
               function tooltip_#{id}(d) {
                 moveTooltip(d)
-                  .html("commit <b>" + d.commit + "</b><br>"
+                  .html("commit <b>" + escapeHtml(d.commit) + "</b><br>"
                     + d3.timeFormat("%y/%m/%d")(parseDate(d.timestamp)) + "<br><br>"
-                    + "static: v<b>" + d.static + "</b><br>"
-                    + "runtime: v<b>" + d.runtime + "</b><br><br>"
+                    + "static: v<b>" + escapeHtml(d.static) + "</b><br>"
+                    + "runtime: v<b>" + escapeHtml(d.runtime) + "</b><br><br>"
                     + "versions from<br>Gemfile.lock")
               }
             JS
@@ -294,9 +294,9 @@ module Spoom
             <<~JS
               function tooltip_#{id}(d) {
                 moveTooltip(d)
-                  .html("commit <b>" + d.commit + "</b><br>"
+                  .html("commit <b>" + escapeHtml(d.commit) + "</b><br>"
                     + d3.timeFormat("%y/%m/%d")(parseDate(d.timestamp)) + "<br><br>"
-                    + "<b>" + d.runtime + "</b>s<br><br>"
+                    + "<b>" + escapeHtml(d.runtime) + "</b>s<br><br>"
                     + "(sorbet user + system time)")
               }
             JS
@@ -330,8 +330,8 @@ module Spoom
             <<~JS
               #{tooltip}
 
-              var data_#{id} = #{@data.to_json};
-              var keys_#{id} = #{T.unsafe(@keys).to_json};
+              var data_#{id} = #{js_literal(@data)};
+              var keys_#{id} = #{js_literal(@keys)};
 
               var stack_#{id} = d3.stack()
                 .keys(keys_#{id})
@@ -515,11 +515,11 @@ module Spoom
             <<~JS
               function tooltip_#{id}(d) {
                 moveTooltip(d)
-                  .html("commit <b>" + d.data.commit + "</b><br>"
+                  .html("commit <b>" + escapeHtml(d.data.commit) + "</b><br>"
                     + d3.timeFormat("%y/%m/%d")(parseDate(d.data.timestamp)) + "<br><br>"
-                    + "Files: <b>" + d.data.values.files + "</b><br>"
-                    + "RBIs: <b>" + d.data.values.rbis + "</b><br><br>"
-                    + "Total: <b>" + d.data.total + "</b>")
+                    + "Files: <b>" + escapeHtml(d.data.values.files) + "</b><br>"
+                    + "RBIs: <b>" + escapeHtml(d.data.values.rbis) + "</b><br><br>"
+                    + "Total: <b>" + escapeHtml(d.data.total) + "</b>")
               }
             JS
           end
@@ -530,8 +530,8 @@ module Spoom
             <<~JS
               #{tooltip}
 
-              var data_#{id} = #{@data.to_json};
-              var keys_#{id} = #{T.unsafe(@keys).to_json};
+              var data_#{id} = #{js_literal(@data)};
+              var keys_#{id} = #{js_literal(@keys)};
 
               var stack_#{id} = d3.stack()
                 .keys(keys_#{id})

data/lib/spoom/coverage/d3.rb

@@ -76,6 +76,15 @@ module Spoom
               return "#{palette.false_color}";
             }
 
+            function escapeHtml(value) {
+              return String(value)
+                .replace(/&/g, "&")
+                .replace(/</g, "&lt;")
+                .replace(/>/g, "&gt;")
+                .replace(/"/g, "&quot;")
+                .replace(/'/g, "&#39;");
+            }
+
             function toPercent(value, sum) {
               return value ? Math.round(value * 100 / sum) : 0;
             }

data/lib/spoom/coverage/report.rb

@@ -60,7 +60,7 @@ module Spoom
 
       #: -> String
       def header_html
-        "<h1 class='display-3'>#{title}</h1>"
+        "<h1 class='display-3'>#{ERB::Util.html_escape(title)}</h1>"
       end
 
       #: -> String
@@ -219,7 +219,7 @@ module Spoom
           <<~ERB
             <div class="text-center" style="margin-top: 30px">
               Typchecked by Sorbet since <b>#{@sorbet_intro_date&.strftime("%F")}</b>
-              (commit <b>#{@sorbet_intro_commit}</b>).
+              (commit <b>#{ERB::Util.html_escape(@sorbet_intro_commit)}</b>).
             </div>
           ERB
         end
@@ -263,8 +263,8 @@ module Spoom
         last = T.must(@snapshots.last)
         <<~ERB
           <h1 class="display-3">
-            #{@project_name}
-            <span class="badge badge-pill badge-dark" style="font-size: 20%;">#{last.commit_sha}</span>
+            #{ERB::Util.html_escape(@project_name)}
+            <span class="badge badge-pill badge-dark" style="font-size: 20%;">#{ERB::Util.html_escape(last.commit_sha)}</span>
           </h1>
         ERB
       end

data/lib/spoom/coverage/snapshot.rb

@@ -4,6 +4,8 @@
 module Spoom
   module Coverage
     class Snapshot
+      class Error < Spoom::Error; end
+
       #: Integer
       attr_accessor :timestamp
 
@@ -173,30 +175,32 @@ module Spoom
         #: (Hash[String, untyped] obj) -> Snapshot
         def from_obj(obj)
           snapshot = Snapshot.new
-          snapshot.timestamp = obj.fetch("timestamp", 0)
-          snapshot.version_static = obj.fetch("version_static", nil)
-          snapshot.version_runtime = obj.fetch("version_runtime", nil)
-          snapshot.duration = obj.fetch("duration", 0)
-          snapshot.commit_sha = obj.fetch("commit_sha", nil)
-          snapshot.commit_timestamp = obj.fetch("commit_timestamp", nil)
-          snapshot.files = obj.fetch("files", 0)
-          snapshot.rbi_files = obj.fetch("rbi_files", 0)
-          snapshot.modules = obj.fetch("modules", 0)
-          snapshot.classes = obj.fetch("classes", 0)
-          snapshot.singleton_classes = obj.fetch("singleton_classes", 0)
-          snapshot.methods_with_sig = obj.fetch("methods_with_sig", 0)
-          snapshot.methods_without_sig = obj.fetch("methods_without_sig", 0)
-          snapshot.calls_typed = obj.fetch("calls_typed", 0)
-          snapshot.calls_untyped = obj.fetch("calls_untyped", 0)
-          snapshot.methods_with_sig_excluding_rbis = obj.fetch("methods_with_sig_excluding_rbis", 0)
-          snapshot.methods_without_sig_excluding_rbis = obj.fetch("methods_without_sig_excluding_rbis", 0)
+          snapshot.timestamp = integer_field(obj, "timestamp")
+          snapshot.version_static = obj.fetch("version_static", nil)&.to_s
+          snapshot.version_runtime = obj.fetch("version_runtime", nil)&.to_s
+          snapshot.duration = integer_field(obj, "duration")
+          snapshot.commit_sha = obj.fetch("commit_sha", nil)&.to_s
+          unless obj.fetch("commit_timestamp", nil).nil?
+            snapshot.commit_timestamp = integer_field(obj, "commit_timestamp")
+          end
+          snapshot.files = integer_field(obj, "files")
+          snapshot.rbi_files = integer_field(obj, "rbi_files")
+          snapshot.modules = integer_field(obj, "modules")
+          snapshot.classes = integer_field(obj, "classes")
+          snapshot.singleton_classes = integer_field(obj, "singleton_classes")
+          snapshot.methods_with_sig = integer_field(obj, "methods_with_sig")
+          snapshot.methods_without_sig = integer_field(obj, "methods_without_sig")
+          snapshot.calls_typed = integer_field(obj, "calls_typed")
+          snapshot.calls_untyped = integer_field(obj, "calls_untyped")
+          snapshot.methods_with_sig_excluding_rbis = integer_field(obj, "methods_with_sig_excluding_rbis")
+          snapshot.methods_without_sig_excluding_rbis = integer_field(obj, "methods_without_sig_excluding_rbis")
 
           sigils = obj.fetch("sigils", {})
           if sigils
             Snapshot::STRICTNESSES.each do |strictness|
               next unless sigils.key?(strictness)
 
-              snapshot.sigils[strictness] = sigils[strictness]
+              snapshot.sigils[strictness] = integer_field(sigils, strictness)
             end
           end
 
@@ -205,12 +209,29 @@ module Spoom
             Snapshot::STRICTNESSES.each do |strictness|
               next unless sigils_excluding_rbis.key?(strictness)
 
-              snapshot.sigils_excluding_rbis[strictness] = sigils_excluding_rbis[strictness]
+              snapshot.sigils_excluding_rbis[strictness] = integer_field(sigils_excluding_rbis, strictness)
             end
           end
 
           snapshot
         end
+
+        private
+
+        # Read `key` from `obj` as an Integer
+        #
+        # Snapshot files live in the analyzed project and can't be trusted to hold the types spoom wrote.
+        # Raises `Snapshot::Error` if the value can't be interpreted as an Integer.
+        #: (Hash[String, untyped] obj, String key, ?default: Integer) -> Integer
+        def integer_field(obj, key, default: 0)
+          if (value = obj[key])
+            Integer(value)
+          else
+            default
+          end
+        rescue ArgumentError, TypeError
+          raise Error, "Expected an integer for `#{key}`, got #{value.inspect}"
+        end
       end
     end
 

data/lib/spoom/sorbet/sigils.rb

@@ -51,6 +51,21 @@ module Spoom
           !!strictness && valid_strictness?(strictness)
         end
 
+        # returns true if the passed content contains a valid sigil at or above the passed strictness
+        # internal sigils do not satisfy a minimum strictness
+        #: (String content, String strictness) -> bool
+        def satisfies_minimum_strictness?(content, strictness)
+          return false unless contains_valid_sigil?(content)
+
+          current_strictness = strictness_in_content(content)
+          strictness = strictness.strip
+          return false if current_strictness == STRICTNESS_INTERNAL || strictness == STRICTNESS_INTERNAL
+
+          strictness_index = VALID_STRICTNESS.index(current_strictness)
+          minimum_index = VALID_STRICTNESS.index(strictness)
+          !!strictness_index && !!minimum_index && strictness_index >= minimum_index
+        end
+
         # returns a string which is the passed content but with the sigil updated to a new strictness
         #: (String content, String new_strictness) -> String
         def update_sigil(content, new_strictness)

data/lib/spoom/sorbet/translate/rbs_comments_to_sorbet_sigs.rb

@@ -6,7 +6,9 @@ module Spoom
     module Translate
       module RBSCommentsToSorbetSigs
         class << self
-          RBS_ANNOTATION_MARKERS = [
+          RBS_REWRITE_PATTERN = Regexp.union([
+            "#:",
+            "#|",
             "# @abstract",
             "# @interface",
             "# @sealed",
@@ -15,9 +17,16 @@ module Spoom
             "# @override",
             "# @overridable",
             "# @without_runtime",
-          ].freeze #: Array[String]
-          RBS_REWRITE_PATTERN = Regexp.union(["#:", "#|", *RBS_ANNOTATION_MARKERS]).freeze #: Regexp
-          private_constant :RBS_ANNOTATION_MARKERS, :RBS_REWRITE_PATTERN
+          ]).freeze #: Regexp
+          private_constant :RBS_REWRITE_PATTERN
+
+          # Detects RBS comment markers (`#:`, `#|`, and supported `# @...` annotations).
+          # Use this check to skip parsing files without those markers.
+          # It does not validate RBS syntax or check the `typed:` sigil.
+          #: (String ruby_contents) -> bool
+          def contains_rbs_syntax?(ruby_contents)
+            ruby_contents.match?(RBS_REWRITE_PATTERN)
+          end
 
           #: (
           #|   String ruby_contents,
@@ -34,7 +43,7 @@ module Spoom
             erase_generic_types: false,
             force: false
           )
-            return ruby_contents unless ruby_contents.match?(RBS_REWRITE_PATTERN) &&
+            return ruby_contents unless contains_rbs_syntax?(ruby_contents) &&
               (force || Sigils.contains_valid_sigil?(ruby_contents))
 
             options = Options.new(

data/lib/spoom/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Spoom
-  VERSION = "1.8.10"
+  VERSION = "1.8.12"
 end

data/rbi/spoom.rbi

@@ -614,6 +614,11 @@ class Spoom::Coverage::D3::Base
   sig { returns(::String) }
   def tooltip; end
 
+  private
+
+  sig { params(value: T.untyped).returns(::String) }
+  def js_literal(value); end
+
   class << self
     sig { returns(::String) }
     def header_script; end
@@ -623,6 +628,7 @@ class Spoom::Coverage::D3::Base
   end
 end
 
+Spoom::Coverage::D3::Base::JS_LITERAL_ESCAPES = T.let(T.unsafe(nil), Hash)
 Spoom::Coverage::D3::COLOR_FALSE = T.let(T.unsafe(nil), String)
 Spoom::Coverage::D3::COLOR_IGNORE = T.let(T.unsafe(nil), String)
 Spoom::Coverage::D3::COLOR_STRICT = T.let(T.unsafe(nil), String)
@@ -672,27 +678,32 @@ class Spoom::Coverage::D3::ColorPalette
   sig { returns(::String) }
   def false_color; end
 
-  def false_color=(_arg0); end
+  sig { params(false_color: ::String).returns(::String) }
+  def false_color=(false_color); end
 
   sig { returns(::String) }
   def ignore_color; end
 
-  def ignore_color=(_arg0); end
+  sig { params(ignore_color: ::String).returns(::String) }
+  def ignore_color=(ignore_color); end
 
   sig { returns(::String) }
   def strict_color; end
 
-  def strict_color=(_arg0); end
+  sig { params(strict_color: ::String).returns(::String) }
+  def strict_color=(strict_color); end
 
   sig { returns(::String) }
   def strong_color; end
 
-  def strong_color=(_arg0); end
+  sig { params(strong_color: ::String).returns(::String) }
+  def strong_color=(strong_color); end
 
   sig { returns(::String) }
   def true_color; end
 
-  def true_color=(_arg0); end
+  sig { params(true_color: ::String).returns(::String) }
+  def true_color=(true_color); end
 end
 
 class Spoom::Coverage::D3::Pie < ::Spoom::Coverage::D3::Base
@@ -939,62 +950,74 @@ class Spoom::Coverage::Snapshot
   sig { returns(::Integer) }
   def calls_typed; end
 
-  def calls_typed=(_arg0); end
+  sig { params(calls_typed: ::Integer).returns(::Integer) }
+  def calls_typed=(calls_typed); end
 
   sig { returns(::Integer) }
   def calls_untyped; end
 
-  def calls_untyped=(_arg0); end
+  sig { params(calls_untyped: ::Integer).returns(::Integer) }
+  def calls_untyped=(calls_untyped); end
 
   sig { returns(::Integer) }
   def classes; end
 
-  def classes=(_arg0); end
+  sig { params(classes: ::Integer).returns(::Integer) }
+  def classes=(classes); end
 
   sig { returns(T.nilable(::String)) }
   def commit_sha; end
 
-  def commit_sha=(_arg0); end
+  sig { params(commit_sha: T.nilable(::String)).returns(T.nilable(::String)) }
+  def commit_sha=(commit_sha); end
 
   sig { returns(T.nilable(::Integer)) }
   def commit_timestamp; end
 
-  def commit_timestamp=(_arg0); end
+  sig { params(commit_timestamp: T.nilable(::Integer)).returns(T.nilable(::Integer)) }
+  def commit_timestamp=(commit_timestamp); end
 
   sig { returns(::Integer) }
   def duration; end
 
-  def duration=(_arg0); end
+  sig { params(duration: ::Integer).returns(::Integer) }
+  def duration=(duration); end
 
   sig { returns(::Integer) }
   def files; end
 
-  def files=(_arg0); end
+  sig { params(files: ::Integer).returns(::Integer) }
+  def files=(files); end
 
   sig { returns(::Integer) }
   def methods_with_sig; end
 
-  def methods_with_sig=(_arg0); end
+  sig { params(methods_with_sig: ::Integer).returns(::Integer) }
+  def methods_with_sig=(methods_with_sig); end
 
   sig { returns(::Integer) }
   def methods_with_sig_excluding_rbis; end
 
-  def methods_with_sig_excluding_rbis=(_arg0); end
+  sig { params(methods_with_sig_excluding_rbis: ::Integer).returns(::Integer) }
+  def methods_with_sig_excluding_rbis=(methods_with_sig_excluding_rbis); end
 
   sig { returns(::Integer) }
   def methods_without_sig; end
 
-  def methods_without_sig=(_arg0); end
+  sig { params(methods_without_sig: ::Integer).returns(::Integer) }
+  def methods_without_sig=(methods_without_sig); end
 
   sig { returns(::Integer) }
   def methods_without_sig_excluding_rbis; end
 
-  def methods_without_sig_excluding_rbis=(_arg0); end
+  sig { params(methods_without_sig_excluding_rbis: ::Integer).returns(::Integer) }
+  def methods_without_sig_excluding_rbis=(methods_without_sig_excluding_rbis); end
 
   sig { returns(::Integer) }
   def modules; end
 
-  def modules=(_arg0); end
+  sig { params(modules: ::Integer).returns(::Integer) }
+  def modules=(modules); end
 
   sig { params(out: T.any(::IO, ::StringIO), colors: T::Boolean, indent_level: ::Integer).void }
   def print(out: T.unsafe(nil), colors: T.unsafe(nil), indent_level: T.unsafe(nil)); end
@@ -1002,27 +1025,32 @@ class Spoom::Coverage::Snapshot
   sig { returns(::Integer) }
   def rbi_files; end
 
-  def rbi_files=(_arg0); end
+  sig { params(rbi_files: ::Integer).returns(::Integer) }
+  def rbi_files=(rbi_files); end
 
   sig { returns(T::Hash[::String, ::Integer]) }
   def sigils; end
 
-  def sigils=(_arg0); end
+  sig { params(sigils: T::Hash[::String, ::Integer]).returns(T::Hash[::String, ::Integer]) }
+  def sigils=(sigils); end
 
   sig { returns(T::Hash[::String, ::Integer]) }
   def sigils_excluding_rbis; end
 
-  def sigils_excluding_rbis=(_arg0); end
+  sig { params(sigils_excluding_rbis: T::Hash[::String, ::Integer]).returns(T::Hash[::String, ::Integer]) }
+  def sigils_excluding_rbis=(sigils_excluding_rbis); end
 
   sig { returns(::Integer) }
   def singleton_classes; end
 
-  def singleton_classes=(_arg0); end
+  sig { params(singleton_classes: ::Integer).returns(::Integer) }
+  def singleton_classes=(singleton_classes); end
 
   sig { returns(::Integer) }
   def timestamp; end
 
-  def timestamp=(_arg0); end
+  sig { params(timestamp: ::Integer).returns(::Integer) }
+  def timestamp=(timestamp); end
 
   sig { returns(T::Hash[::String, T.untyped]) }
   def to_h; end
@@ -1033,12 +1061,14 @@ class Spoom::Coverage::Snapshot
   sig { returns(T.nilable(::String)) }
   def version_runtime; end
 
-  def version_runtime=(_arg0); end
+  sig { params(version_runtime: T.nilable(::String)).returns(T.nilable(::String)) }
+  def version_runtime=(version_runtime); end
 
   sig { returns(T.nilable(::String)) }
   def version_static; end
 
-  def version_static=(_arg0); end
+  sig { params(version_static: T.nilable(::String)).returns(T.nilable(::String)) }
+  def version_static=(version_static); end
 
   class << self
     sig { params(json: ::String).returns(::Spoom::Coverage::Snapshot) }
@@ -1046,9 +1076,15 @@ class Spoom::Coverage::Snapshot
 
     sig { params(obj: T::Hash[::String, T.untyped]).returns(::Spoom::Coverage::Snapshot) }
     def from_obj(obj); end
+
+    private
+
+    sig { params(obj: T::Hash[::String, T.untyped], key: ::String, default: ::Integer).returns(::Integer) }
+    def integer_field(obj, key, default: T.unsafe(nil)); end
   end
 end
 
+class Spoom::Coverage::Snapshot::Error < ::Spoom::Error; end
 Spoom::Coverage::Snapshot::STRICTNESSES = T.let(T.unsafe(nil), Array)
 
 class Spoom::Coverage::SnapshotPrinter < ::Spoom::Printer
@@ -1577,7 +1613,8 @@ class Spoom::Deadcode::Remover::NodeContext
   sig { returns(T::Array[::Prism::Node]) }
   def nesting; end
 
-  def nesting=(_arg0); end
+  sig { params(nesting: T::Array[::Prism::Node]).returns(T::Array[::Prism::Node]) }
+  def nesting=(nesting); end
 
   sig { returns(T.nilable(::Prism::Node)) }
   def next_node; end
@@ -2322,7 +2359,8 @@ class Spoom::LSP::SymbolPrinter < ::Spoom::Printer
   sig { returns(T.nilable(::String)) }
   def prefix; end
 
-  def prefix=(_arg0); end
+  sig { params(prefix: T.nilable(::String)).returns(T.nilable(::String)) }
+  def prefix=(prefix); end
 
   sig { params(objects: T::Array[::Spoom::LSP::PrintableSymbol]).void }
   def print_list(objects); end
@@ -2482,7 +2520,8 @@ class Spoom::Model::Class < ::Spoom::Model::Namespace
   sig { returns(T.nilable(::String)) }
   def superclass_name; end
 
-  def superclass_name=(_arg0); end
+  sig { params(superclass_name: T.nilable(::String)).returns(T.nilable(::String)) }
+  def superclass_name=(superclass_name); end
 end
 
 class Spoom::Model::Comment
@@ -2879,7 +2918,8 @@ class Spoom::Printer
   sig { returns(T.any(::IO, ::StringIO)) }
   def out; end
 
-  def out=(_arg0); end
+  sig { params(out: T.any(::IO, ::StringIO)).returns(T.any(::IO, ::StringIO)) }
+  def out=(out); end
 
   sig { params(string: T.nilable(::String)).void }
   def print(string); end
@@ -2974,7 +3014,8 @@ class Spoom::Sorbet::Config
   sig { returns(T::Boolean) }
   def no_stdlib; end
 
-  def no_stdlib=(_arg0); end
+  sig { params(no_stdlib: T::Boolean).returns(T::Boolean) }
+  def no_stdlib=(no_stdlib); end
 
   sig { returns(::String) }
   def options_string; end
@@ -2982,7 +3023,9 @@ class Spoom::Sorbet::Config
   sig { returns(T::Array[::String]) }
   def paths; end
 
-  def paths=(_arg0); end
+  sig { params(paths: T::Array[::String]).returns(T::Array[::String]) }
+  def paths=(paths); end
+
   def typed_overrides; end
   def typed_overrides=(_arg0); end
 
@@ -3216,6 +3259,9 @@ module Spoom::Sorbet::Sigils
     sig { params(path: T.any(::Pathname, ::String)).returns(T.nilable(::String)) }
     def file_strictness(path); end
 
+    sig { params(content: ::String, strictness: ::String).returns(T::Boolean) }
+    def satisfies_minimum_strictness?(content, strictness); end
+
     sig { params(strictness: ::String).returns(::String) }
     def sigil_string(strictness); end
 
@@ -3322,6 +3368,9 @@ end
 
 module Spoom::Sorbet::Translate::RBSCommentsToSorbetSigs
   class << self
+    sig { params(ruby_contents: ::String).returns(T::Boolean) }
+    def contains_rbs_syntax?(ruby_contents); end
+
     sig do
       params(
         ruby_contents: ::String,

data/templates/page.erb

@@ -5,7 +5,7 @@
   <meta http-equiv="x-ua-compatible" content="ie=edge" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
 
-  <title><%= title %></title>
+  <title><%= ERB::Util.html_escape(title) %></title>
   <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css">
 
   <style>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spoom
 version: !ruby/object:Gem::Version
-  version: 1.8.10
+  version: 1.8.12
 platform: ruby
 authors:
 - Alexandre Terrasa