spoom 1.8.11 → 1.8.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4112003bfcd62cb8c66104ac6c773669d20d4a5ab0b070e93a9d7633cdff7126
-  data.tar.gz: 8cee75de87ce5526c8a3e6c1cf7b7d2ae7a0b98b48a1f1ea1250959984d88ca3
+  metadata.gz: 284bf38248b3fb6c057966d56d0bbcd01e3fa4142e6a619ffacb98eb159a6d7d
+  data.tar.gz: 44551f71e890cde0d0a71e77b8a4d627c7aafbddaa8e0e3a7106135c6962398a
 SHA512:
-  metadata.gz: e23ea3cf62bc326705b91a7618efc658f7b1bcc1df17532b9f0218766cf61ab807f956751c11389db6317c1885ada0d403d51c8b92d9d0131c0ce5b0c04442c7
-  data.tar.gz: 19bfdcbb7adbb766647ae1619450154587ccb673ad9d84b7a1f070dd3f1f9c9bef3d38f233df3b4f914e7a786832bbfe1b4fd51f972a2a4873c626a0250abbb9
+  metadata.gz: 60c251eaa56b3ad7ffac08afe381203869146040b144c7893013dcb098fc9150bad9a05b49bc303919946904b0757a6ddd285282a80bf64f607630d942b57d19
+  data.tar.gz: 462f445ffb6b740ef17486e52d3e3c65d000f482199206ea3ef6e39c7a9aa7183c9df8097b73967f89f3db5c88d3e751edba61c3fb691f2909a48930a0d78b5e

data/README.md

@@ -387,6 +387,20 @@ Remove a reported dead code candidate:
 spoom deadcode remove path/to/file.rb:42:18-47:23
 ```
 
+#### Custom plugins
+
+Teach `spoom deadcode` about your project's own DSLs by adding plugins to `.spoom/deadcode/plugins/*.rb`. Each file should define a subclass of `Spoom::Deadcode::Plugins::Base`:
+
+```ruby
+# .spoom/deadcode/plugins/my_plugin.rb
+class MyPlugin < Spoom::Deadcode::Plugins::Base
+  ignore_methods_named("my_dsl_method")
+end
+```
+
+> [!WARNING]
+> Custom plugins are loaded with `require`, so `spoom deadcode` executes any Ruby code in `.spoom/deadcode/plugins/` of the project being analyzed. Only run `spoom deadcode` on projects you trust, and inspect or remove `.spoom/deadcode/plugins/` before analyzing untrusted code (such as a pull request from an outside contributor).
+
 ## Ruby API
 
 ### Parsing Sorbet config

data/lib/spoom/cli/deadcode.rb

@@ -73,7 +73,18 @@ module Spoom
         end
 
         plugin_classes = Spoom::Deadcode.plugins_from_gemfile_lock(context)
-        plugin_classes.merge(Spoom::Deadcode.load_custom_plugins(context))
+
+        custom_plugin_files = context.glob("#{Spoom::Deadcode::DEFAULT_CUSTOM_PLUGINS_PATH}/*.rb")
+        unless custom_plugin_files.empty?
+          say_warning(
+            "Loading custom plugins from `#{Spoom::Deadcode::DEFAULT_CUSTOM_PLUGINS_PATH}`. " \
+              "This executes Ruby code from the analyzed project:",
+          )
+          custom_plugin_files.each do |file|
+            $stderr.puts "  #{gray(file)}"
+          end
+          plugin_classes.merge(Spoom::Deadcode.load_custom_plugins(context))
+        end
         if options[:show_plugins]
           $stderr.puts "\nLoaded #{blue(plugin_classes.size.to_s)} plugins\n"
           plugin_classes.each do |plugin|

data/lib/spoom/cli/srb/coverage.rb

@@ -153,6 +153,9 @@ module Spoom
           snapshots = files.sort.map do |file|
             json = File.read(file)
             Spoom::Coverage::Snapshot.from_json(json)
+          rescue Spoom::Coverage::Snapshot::Error => e
+            say_error("Invalid snapshot `#{file}`: #{e.message}")
+            exit(1)
           end.filter(&:commit_timestamp).sort_by!(&:commit_timestamp)
 
           palette = Spoom::Coverage::D3::ColorPalette.new(

data/lib/spoom/coverage/d3/base.rb

@@ -6,6 +6,9 @@ module Spoom
     module D3
       # @abstract
       class Base
+        # Characters that must not appear raw inside a `<script>` element, and their JSON string escapes
+        JS_LITERAL_ESCAPES = { "<" => '\u003c', ">" => '\u003e', "&" => '\u0026' }.freeze #: Hash[String, String]
+
         #: String
         attr_reader :id
 
@@ -43,6 +46,18 @@ module Spoom
         # @abstract
         #: -> String
         def script = raise NotImplementedError, "Abstract method called"
+
+        private
+
+        # Serialize `value` as a JavaScript literal that is safe to embed in a `<script>` tag
+        #
+        # `script_safe` escapes `/` so the data can't contain `</script>`. We also escape `<`, `>` and `&`
+        # so the data can't contain `<!--` or `<script`, which change how the HTML parser reads the rest
+        # of the `<script>` element.
+        #: (untyped value) -> String
+        def js_literal(value)
+          JSON.generate(value, script_safe: true).gsub(/[<>&]/, JS_LITERAL_ESCAPES)
+        end
       end
     end
   end

data/lib/spoom/coverage/d3/circle_map.rb

@@ -47,7 +47,7 @@ module Spoom
 
               function tooltipMap(d) {
                 moveTooltip(d)
-                  .html("<b>" + d.data.name + "</b>")
+                  .html("<b>" + escapeHtml(d.data.name) + "</b>")
               }
             JS
           end
@@ -57,7 +57,7 @@ module Spoom
         #: -> String
         def script
           <<~JS
-            var root = {children: #{@data.to_json}}
+            var root = {children: #{js_literal(@data)}}
             var dataHeight = treeHeight(root)
 
             var opacity = d3.scaleLinear()

data/lib/spoom/coverage/d3/pie.rb

@@ -38,8 +38,8 @@ module Spoom
             <<~JS
               function tooltipPie(d, title, kind, sum) {
                 moveTooltip(d)
-                  .html("<b>" + title + "</b><br><br>"
-                    + "<b>" + d.data.value + "</b> " + kind + "<br>"
+                  .html("<b>" + escapeHtml(title) + "</b><br><br>"
+                    + "<b>" + escapeHtml(d.data.value) + "</b> " + kind + "<br>"
                     + "<b>" + toPercent(d.data.value, sum) + "</b>%")
               }
             JS
@@ -52,11 +52,11 @@ module Spoom
           <<~JS
             #{tooltip}
 
-            var json_#{id} = #{@data.to_json};
+            var json_#{id} = #{js_literal(@data)};
             var pie_#{id} = d3.pie().value((d) => d.value);
             var data_#{id} = pie_#{id}(d3.entries(json_#{id}));
             var sum_#{id} = d3.sum(data_#{id}, (d) => d.data.value);
-            var title_#{id} = #{@title.to_json};
+            var title_#{id} = #{js_literal(@title)};
 
             function draw_#{id}() {
               var pieSize_#{id} = document.getElementById("#{id}").clientWidth - 10;

data/lib/spoom/coverage/d3/timeline.rb

@@ -81,10 +81,10 @@ module Spoom
 
               function tooltipTimeline(d, kind) {
                 moveTooltip(d)
-                  .html("commit <b>" + d.data.commit + "</b><br>"
+                  .html("commit <b>" + escapeHtml(d.data.commit) + "</b><br>"
                     + d3.timeFormat("%y/%m/%d")(parseDate(d.data.timestamp)) + "<br><br>"
-                    + "<b>typed: " + d.key + "</b><br><br>"
-                    + "<b>" + (d.data.values[d.key] ? d.data.values[d.key] : 0) + "</b> " + kind +"<br>"
+                    + "<b>typed: " + escapeHtml(d.key) + "</b><br><br>"
+                    + "<b>" + escapeHtml(d.data.values[d.key] ? d.data.values[d.key] : 0) + "</b> " + kind +"<br>"
                     + "<b>" + toPercent(d.data.values[d.key] ? d.data.values[d.key] : 0, d.data.total) + "%")
               }
             JS
@@ -97,7 +97,7 @@ module Spoom
           <<~HTML
             #{tooltip}
 
-            var data_#{id} = #{@data.to_json};
+            var data_#{id} = #{js_literal(@data)};
 
             function draw_#{id}() {
               var width_#{id} = document.getElementById("#{id}").clientWidth;
@@ -245,10 +245,10 @@ module Spoom
             <<~JS
               function tooltip_#{id}(d) {
                 moveTooltip(d)
-                  .html("commit <b>" + d.commit + "</b><br>"
+                  .html("commit <b>" + escapeHtml(d.commit) + "</b><br>"
                     + d3.timeFormat("%y/%m/%d")(parseDate(d.timestamp)) + "<br><br>"
-                    + "static: v<b>" + d.static + "</b><br>"
-                    + "runtime: v<b>" + d.runtime + "</b><br><br>"
+                    + "static: v<b>" + escapeHtml(d.static) + "</b><br>"
+                    + "runtime: v<b>" + escapeHtml(d.runtime) + "</b><br><br>"
                     + "versions from<br>Gemfile.lock")
               }
             JS
@@ -294,9 +294,9 @@ module Spoom
             <<~JS
               function tooltip_#{id}(d) {
                 moveTooltip(d)
-                  .html("commit <b>" + d.commit + "</b><br>"
+                  .html("commit <b>" + escapeHtml(d.commit) + "</b><br>"
                     + d3.timeFormat("%y/%m/%d")(parseDate(d.timestamp)) + "<br><br>"
-                    + "<b>" + d.runtime + "</b>s<br><br>"
+                    + "<b>" + escapeHtml(d.runtime) + "</b>s<br><br>"
                     + "(sorbet user + system time)")
               }
             JS
@@ -330,8 +330,8 @@ module Spoom
             <<~JS
               #{tooltip}
 
-              var data_#{id} = #{@data.to_json};
-              var keys_#{id} = #{T.unsafe(@keys).to_json};
+              var data_#{id} = #{js_literal(@data)};
+              var keys_#{id} = #{js_literal(@keys)};
 
               var stack_#{id} = d3.stack()
                 .keys(keys_#{id})
@@ -515,11 +515,11 @@ module Spoom
             <<~JS
               function tooltip_#{id}(d) {
                 moveTooltip(d)
-                  .html("commit <b>" + d.data.commit + "</b><br>"
+                  .html("commit <b>" + escapeHtml(d.data.commit) + "</b><br>"
                     + d3.timeFormat("%y/%m/%d")(parseDate(d.data.timestamp)) + "<br><br>"
-                    + "Files: <b>" + d.data.values.files + "</b><br>"
-                    + "RBIs: <b>" + d.data.values.rbis + "</b><br><br>"
-                    + "Total: <b>" + d.data.total + "</b>")
+                    + "Files: <b>" + escapeHtml(d.data.values.files) + "</b><br>"
+                    + "RBIs: <b>" + escapeHtml(d.data.values.rbis) + "</b><br><br>"
+                    + "Total: <b>" + escapeHtml(d.data.total) + "</b>")
               }
             JS
           end
@@ -530,8 +530,8 @@ module Spoom
             <<~JS
               #{tooltip}
 
-              var data_#{id} = #{@data.to_json};
-              var keys_#{id} = #{T.unsafe(@keys).to_json};
+              var data_#{id} = #{js_literal(@data)};
+              var keys_#{id} = #{js_literal(@keys)};
 
               var stack_#{id} = d3.stack()
                 .keys(keys_#{id})

data/lib/spoom/coverage/d3.rb

@@ -76,6 +76,15 @@ module Spoom
               return "#{palette.false_color}";
             }
 
+            function escapeHtml(value) {
+              return String(value)
+                .replace(/&/g, "&")
+                .replace(/</g, "&lt;")
+                .replace(/>/g, "&gt;")
+                .replace(/"/g, "&quot;")
+                .replace(/'/g, "&#39;");
+            }
+
             function toPercent(value, sum) {
               return value ? Math.round(value * 100 / sum) : 0;
             }

data/lib/spoom/coverage/report.rb

@@ -60,7 +60,7 @@ module Spoom
 
       #: -> String
       def header_html
-        "<h1 class='display-3'>#{title}</h1>"
+        "<h1 class='display-3'>#{ERB::Util.html_escape(title)}</h1>"
       end
 
       #: -> String
@@ -219,7 +219,7 @@ module Spoom
           <<~ERB
             <div class="text-center" style="margin-top: 30px">
               Typchecked by Sorbet since <b>#{@sorbet_intro_date&.strftime("%F")}</b>
-              (commit <b>#{@sorbet_intro_commit}</b>).
+              (commit <b>#{ERB::Util.html_escape(@sorbet_intro_commit)}</b>).
             </div>
           ERB
         end
@@ -263,8 +263,8 @@ module Spoom
         last = T.must(@snapshots.last)
         <<~ERB
           <h1 class="display-3">
-            #{@project_name}
-            <span class="badge badge-pill badge-dark" style="font-size: 20%;">#{last.commit_sha}</span>
+            #{ERB::Util.html_escape(@project_name)}
+            <span class="badge badge-pill badge-dark" style="font-size: 20%;">#{ERB::Util.html_escape(last.commit_sha)}</span>
           </h1>
         ERB
       end

data/lib/spoom/coverage/snapshot.rb

@@ -4,6 +4,8 @@
 module Spoom
   module Coverage
     class Snapshot
+      class Error < Spoom::Error; end
+
       #: Integer
       attr_accessor :timestamp
 
@@ -173,30 +175,32 @@ module Spoom
         #: (Hash[String, untyped] obj) -> Snapshot
         def from_obj(obj)
           snapshot = Snapshot.new
-          snapshot.timestamp = obj.fetch("timestamp", 0)
-          snapshot.version_static = obj.fetch("version_static", nil)
-          snapshot.version_runtime = obj.fetch("version_runtime", nil)
-          snapshot.duration = obj.fetch("duration", 0)
-          snapshot.commit_sha = obj.fetch("commit_sha", nil)
-          snapshot.commit_timestamp = obj.fetch("commit_timestamp", nil)
-          snapshot.files = obj.fetch("files", 0)
-          snapshot.rbi_files = obj.fetch("rbi_files", 0)
-          snapshot.modules = obj.fetch("modules", 0)
-          snapshot.classes = obj.fetch("classes", 0)
-          snapshot.singleton_classes = obj.fetch("singleton_classes", 0)
-          snapshot.methods_with_sig = obj.fetch("methods_with_sig", 0)
-          snapshot.methods_without_sig = obj.fetch("methods_without_sig", 0)
-          snapshot.calls_typed = obj.fetch("calls_typed", 0)
-          snapshot.calls_untyped = obj.fetch("calls_untyped", 0)
-          snapshot.methods_with_sig_excluding_rbis = obj.fetch("methods_with_sig_excluding_rbis", 0)
-          snapshot.methods_without_sig_excluding_rbis = obj.fetch("methods_without_sig_excluding_rbis", 0)
+          snapshot.timestamp = integer_field(obj, "timestamp")
+          snapshot.version_static = obj.fetch("version_static", nil)&.to_s
+          snapshot.version_runtime = obj.fetch("version_runtime", nil)&.to_s
+          snapshot.duration = integer_field(obj, "duration")
+          snapshot.commit_sha = obj.fetch("commit_sha", nil)&.to_s
+          unless obj.fetch("commit_timestamp", nil).nil?
+            snapshot.commit_timestamp = integer_field(obj, "commit_timestamp")
+          end
+          snapshot.files = integer_field(obj, "files")
+          snapshot.rbi_files = integer_field(obj, "rbi_files")
+          snapshot.modules = integer_field(obj, "modules")
+          snapshot.classes = integer_field(obj, "classes")
+          snapshot.singleton_classes = integer_field(obj, "singleton_classes")
+          snapshot.methods_with_sig = integer_field(obj, "methods_with_sig")
+          snapshot.methods_without_sig = integer_field(obj, "methods_without_sig")
+          snapshot.calls_typed = integer_field(obj, "calls_typed")
+          snapshot.calls_untyped = integer_field(obj, "calls_untyped")
+          snapshot.methods_with_sig_excluding_rbis = integer_field(obj, "methods_with_sig_excluding_rbis")
+          snapshot.methods_without_sig_excluding_rbis = integer_field(obj, "methods_without_sig_excluding_rbis")
 
           sigils = obj.fetch("sigils", {})
           if sigils
             Snapshot::STRICTNESSES.each do |strictness|
               next unless sigils.key?(strictness)
 
-              snapshot.sigils[strictness] = sigils[strictness]
+              snapshot.sigils[strictness] = integer_field(sigils, strictness)
             end
           end
 
@@ -205,12 +209,29 @@ module Spoom
             Snapshot::STRICTNESSES.each do |strictness|
               next unless sigils_excluding_rbis.key?(strictness)
 
-              snapshot.sigils_excluding_rbis[strictness] = sigils_excluding_rbis[strictness]
+              snapshot.sigils_excluding_rbis[strictness] = integer_field(sigils_excluding_rbis, strictness)
             end
           end
 
           snapshot
         end
+
+        private
+
+        # Read `key` from `obj` as an Integer
+        #
+        # Snapshot files live in the analyzed project and can't be trusted to hold the types spoom wrote.
+        # Raises `Snapshot::Error` if the value can't be interpreted as an Integer.
+        #: (Hash[String, untyped] obj, String key, ?default: Integer) -> Integer
+        def integer_field(obj, key, default: 0)
+          if (value = obj[key])
+            Integer(value)
+          else
+            default
+          end
+        rescue ArgumentError, TypeError
+          raise Error, "Expected an integer for `#{key}`, got #{value.inspect}"
+        end
       end
     end
 

data/lib/spoom/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Spoom
-  VERSION = "1.8.11"
+  VERSION = "1.8.12"
 end

data/rbi/spoom.rbi

@@ -614,6 +614,11 @@ class Spoom::Coverage::D3::Base
   sig { returns(::String) }
   def tooltip; end
 
+  private
+
+  sig { params(value: T.untyped).returns(::String) }
+  def js_literal(value); end
+
   class << self
     sig { returns(::String) }
     def header_script; end
@@ -623,6 +628,7 @@ class Spoom::Coverage::D3::Base
   end
 end
 
+Spoom::Coverage::D3::Base::JS_LITERAL_ESCAPES = T.let(T.unsafe(nil), Hash)
 Spoom::Coverage::D3::COLOR_FALSE = T.let(T.unsafe(nil), String)
 Spoom::Coverage::D3::COLOR_IGNORE = T.let(T.unsafe(nil), String)
 Spoom::Coverage::D3::COLOR_STRICT = T.let(T.unsafe(nil), String)
@@ -1070,9 +1076,15 @@ class Spoom::Coverage::Snapshot
 
     sig { params(obj: T::Hash[::String, T.untyped]).returns(::Spoom::Coverage::Snapshot) }
     def from_obj(obj); end
+
+    private
+
+    sig { params(obj: T::Hash[::String, T.untyped], key: ::String, default: ::Integer).returns(::Integer) }
+    def integer_field(obj, key, default: T.unsafe(nil)); end
   end
 end
 
+class Spoom::Coverage::Snapshot::Error < ::Spoom::Error; end
 Spoom::Coverage::Snapshot::STRICTNESSES = T.let(T.unsafe(nil), Array)
 
 class Spoom::Coverage::SnapshotPrinter < ::Spoom::Printer

data/templates/page.erb

@@ -5,7 +5,7 @@
   <meta http-equiv="x-ua-compatible" content="ie=edge" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
 
-  <title><%= title %></title>
+  <title><%= ERB::Util.html_escape(title) %></title>
   <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css">
 
   <style>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spoom
 version: !ruby/object:Gem::Version
-  version: 1.8.11
+  version: 1.8.12
 platform: ruby
 authors:
 - Alexandre Terrasa