sprockets 3.0.0 → 3.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 196e262a4bc69c0989859f510f703ccf2b2c16ca
-  data.tar.gz: 8c511861fd25f35955e3f4c748bf97a1ef49dc6b
+SHA256:
+  metadata.gz: 46e0f0a150aa8333d2a1d2663167b6f20c1e77db067cea7b545f75927f770807
+  data.tar.gz: 5acd5cb5c64e240dd8180e91f34620195fa1433e625ee48a132fdae58be71ba5
 SHA512:
-  metadata.gz: 78fed6b263b253262e03d814f7b1989da90e4c840a7be325a6bae7ff40d58dbc807ae9469f95400ef8fbf33f1ade9746757344a42da29c48dc0a228567337d71
-  data.tar.gz: 1798e1b5216d9c9ed70056b0a828f3ac7a119e0dd2773a590a80dec4b209f93c12eedc7ee7e49b00381df16d91891fc124ca7d0aa59253e9602dc34a398d79ed
+  metadata.gz: 97a06eb2e0767903da7bcda387211d881f3b98d57269a8abed5045e277db5f133f381c4f8fd23fcccf45a4032c85309841abba13b9218a52b21121a5a9bfc02a
+  data.tar.gz: 1d9c8d75bab64c366473226cc61806cd64c1951a67d90cc1220c1474e6a02cc5003b2dffb1b6324abefb7e7c8b292145635ac0bed6ae947a35393d67acd3c40e

data/CHANGELOG.md

@@ -0,0 +1,296 @@
+**3.7.2** (June 19, 2018)
+
+* Security release for [CVE-2018-3760](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3760).
+
+**3.7.1** (December 19, 2016)
+
+* Ruby 2.4 support for Sprockets 3.
+
+**3.7.0** (July 21, 2016)
+
+* Deprecated interfaces now emit deprecation warnings #345
+
+**3.6.3** (July 1, 2016)
+
+* Faster asset lookup in large directories #336
+* Faster PathUtils.match_path_extname https://github.com/rails/sprockets/commit/697269cf81e5261fdd7072e32bd489403027fd7e
+* Fixed uglifier comment stripping #326
+* Error messages now show load path info #313
+
+**3.6.2** (June 21, 2016)
+
+* More performance improvements.
+
+**3.6.1** (June 17, 2016)
+
+* Some performance improvements.
+
+**3.6.0** (April 6, 2016)
+
+* Add `Manifest#find_sources` to return the source of the compiled assets.
+* Fix the list of compressable mime types.
+* Improve performance of the `FileStore` cache.
+
+**3.5.2** (December 8, 2015)
+
+* Fix JRuby bug with concurrent-ruby.
+* Fix disabling gzip generation in cached environments.
+
+**3.5.1** (December 5, 2015)
+
+* Fix gzip asset generation for assets already on disk.
+
+**3.5.0** (December 3, 2015)
+
+* Reintroduce Gzip file generation for non-binary assets.
+
+**3.4.1** (November 25, 2015)
+
+* PathUtils::Entries will no longer error on an empty directory.
+
+**3.4.0** (October 5, 2015)
+
+* Expose method to override the sass cache in the SassProcessor.
+
+**3.3.5** (September 25, 2015)
+
+* Fix bug related to absolute path being reintroduced into history cache #141.
+
+**3.3.4** (September 1, 2015)
+
+* Relative cache contents now work with windows.
+
+**3.3.3** (August 21, 2015)
+
+* Remove more absolute paths from cache contents.
+
+**3.3.2** (August 19, 2015)
+
+* Fix cache contents to use relative paths instead of absolute paths.
+
+**3.3.1** (August 15, 2015)
+
+* Fix legacy Tilt integration when locals is required argument.
+
+**3.3.0** (August 12, 2015)
+
+* Change internal cache key to use relative asset paths instead of absolute paths.
+
+**3.2.0** (June 2, 2015)
+
+* Updated SRI integrity to align with spec changes
+* Deprecated Manifest integrity attribute
+* Cleanup concatenating JS sources with newlines
+
+**3.1.0** (May 10, 2015)
+
+* Removed "index" logical path normalization. Asset#logical_path is always the
+  full logical path to the index file.
+* Fixed static asset mtimes
+* Fix manifest cleanup by age
+* Removed redundant minifier level cache
+* Updated SRI format according to spec changes
+
+**3.0.3** (April 27, 2015)
+
+* Fix static asset mtime fallback
+* Only warn when specified asset version can not be loaded.
+
+**3.0.2** (April 22, 2015)
+
+* Ensure legacy Tilt handlers return String class data. Fixes issues with Haml
+  Tilt handler.
+* Type check and improve error messages raised on bad processor returned results.
+* Improve error message for relative paths not under load path.
+* Changed HTML encoding fallback from ISO-8859-1 to default external.
+* Avoid falling back to 0 mtimes which may cause warnings with tar
+
+**3.0.1** (April 14, 2015)
+
+* Fixed `Context#depend_on` with paths outside the load path
+
+**3.0.0** (April 12, 2015)
+
+[Guide to upgrading from Sprockets 2.x to 3.x](https://github.com/rails/sprockets/blob/3.x/UPGRADING.md)
+
+* New processor API. Tilt interface is deprecated.
+* Improved file store caching backend.
+* MIME Types now accept charset custom charset detecters. Improves support for UTF-16/32 files.
+* Environment#version no longer affects asset digests. Only used for busting the asset cache.
+* Removed builtin support for LESS.
+* Removed `//= include` directive support.
+* Deprecated `BundledAsset#to_a`. Use `BundledAsset#included` to access debugging subcomponents.
+* Support circular dependencies. For parity with ES6 modules.
+* Manifest compilation will no longer generate .gz files by default. [Mixing
+  Content-Encoding and ETags is just a bad
+  idea](https://issues.apache.org/bugzilla/show_bug.cgi?id=39727)
+* Added linked or referenced assets. When an asset is compiled, any of its links will be compiled as well.
+* Introduce some limitations around enumerating all logical paths. 4.x will deprecate it and favor linked manifests for compliation.
+* Add Asset integrity attribute for Subresource Integrity
+* Default digest changed to SHA256. Configuring `digest_class` is deprecated.
+* Rename `Asset#digest` to `Asset#hexdigest`. `Asset#digest` is deprecated and will
+  return a raw byte String in 4.x.
+* Added transitional compatibility flag to `Environment#resolve(path, compat: true)`. 2.x mode operates with `compat: true` and 4.x with `compat: false`
+* `manifest-abc123.json` renamed to `.sprockets-abc123.json`
+
+**2.12.3** (October 28, 2014)
+
+* Security: Fix directory traversal bug in development mode server.
+
+**2.12.2** (September 5, 2014)
+
+* Ensure internal asset lookups calls are still restricted to load paths within
+  asset compiles. Though, you should not depend on internal asset resolves to be
+  completely restricted for security reasons. Assets themselves should be
+  considered full scripting environments with filesystem access.
+
+**2.12.1** (April 17, 2014)
+
+* Fix making manifest target directory when its different than the output directory.
+
+**2.12.0** (March 13, 2014)
+
+* Avoid context reference in SassImporter hack so its Marshallable. Fixes
+ issues with Sass 3.3.x.
+
+**2.11.0** (February 19, 2014)
+
+* Cache store must now be an LRU implementation.
+* Default digest changed to SHA1. To continue using MD5.
+  `env.digest_class = Digest::MD5`.
+
+**2.10.0** (May 24, 2013)
+
+* Support for `bower.json`
+
+**2.9.3** (April 20, 2013)
+
+* Fixed sass caching bug
+
+**2.9.2** (April 8, 2013)
+
+* Improve file freshness check performance
+* Directive processor encoding fixes
+
+**2.9.1** (April 6, 2013)
+
+* Support for Uglifier 2.x
+
+**2.9.0** (February 25, 2013)
+
+* Write out gzipped variants of bundled assets.
+
+**2.8.2** (December 10, 2012)
+
+* Fixed top level Sass constant references
+* Fixed manifest logger when environment is disabled
+
+**2.8.1** (October 31, 2012)
+
+* Fixed Sass importer bug
+
+**2.8.0** (October 16, 2012)
+
+* Allow manifest location to be separated from output directory
+* Pass logical path and absolute path to each_logical_path iterator
+
+**2.7.0** (October 10, 2012)
+
+* Added --css-compressor and --js-compressor command line flags
+* Added css/js compressor shorthand
+* Change default manifest.json filename to be a randomized manifest-16HEXBYTES.json
+* Allow nil environment to be passed to manifest
+* Allow manifest instance to be set on rake task
+
+**2.6.0** (September 19, 2012)
+
+* Added bower component.json require support
+
+**2.5.0** (September 4, 2012)
+
+* Fixed Ruby 2.0 RegExp warning
+* Provide stubbed implementation of context *_path helpers
+* Add SassCompressor
+
+**2.4.5** (July 10, 2012)
+
+* Tweaked some logger levels
+
+**2.4.4** (July 2, 2012)
+
+* Canonicalize logical path extensions
+* Check absolute paths passed to depend_on
+
+**2.4.3** (May 16, 2012)
+
+* Exposed :sprockets in sass options
+* Include dependency paths in asset mtime
+
+**2.4.2** (May 7, 2012)
+
+* Fixed MultiJson feature detect
+
+**2.4.1** (April 26, 2012)
+
+* Fixed MultiJson API change
+* Fixed gzip mtime
+
+**2.4.0** (March 27, 2012)
+
+* Added global path registry
+* Added global processor registry
+
+**2.3.2** (March 26, 2012)
+
+* Fix Context#logical_path with dots
+
+**2.3.1** (February 11, 2012)
+
+* Added bytesize to manifest
+* Added Asset#bytesize alias
+* Security: Check path for forbidden access after unescaping
+
+**2.3.0** (January 16, 2012)
+
+* Added special Sass importer that automatically tracks any `@import`ed files.
+
+**2.2.0** (January 10, 2012)
+
+* Added `sprockets` command line utility.
+* Added rake/sprocketstask.
+* Added json manifest log of compiled assets.
+* Added `stub` directive that allows you to exclude files from the bundle.
+* Added per environment external encoding (Environment#default_external_encoding). Defaults to UTF-8. Fixes issues where LANG is not set correctly and Rubys default external is set to ASCII.
+
+**2.1.2** (November 20, 2011)
+
+* Disabled If-Modified-Since server checks. Fixes some browser caching issues when serving the asset body only. If-None-Match caching is sufficient.
+
+**2.1.1** (November 18, 2011)
+
+* Fix windows absolute path check bug.
+
+**2.1.0** (November 11, 2011)
+
+* Directive comment lines are now turned into empty lines instead of removed. This way line numbers in
+  CoffeeScript syntax errors are correct.
+* Performance and caching bug fixes.
+
+**2.0.3** (October 17, 2011)
+
+* Detect format extensions from right to left.
+* Make JST namespace configurable.
+
+**2.0.2** (October 4, 2011)
+
+* Fixed loading stale cache from bundler gems.
+
+**2.0.1** (September 30, 2011)
+
+* Fixed bug with fingerprinting file names with multiple dots.
+* Decode URIs as default internal.
+* Fix symlinked asset directories.
+
+**2.0.0** (August 29, 2011)
+
+* Initial public release.

data/README.md

@@ -20,6 +20,54 @@ Or include it in your project's `Gemfile` with Bundler:
 gem 'sprockets', '~> 3.0'
 ```
 
+## Using sprockets
+
+For most people interested in using sprockets you will want to see [End User Asset Generation](guides/end_user_asset_generation.md) guide. This contains information about sprocket's directive syntax, and default processing behavior.
+
+If you are a framework developer that is using sprockets, see [Building an Asset Processing Framework](guides/building_an_asset_processing_framework.md).
+
+If you are a library developer who is extending the functionality of sprockets, see [Extending Sprockets](guides/extending_sprockets.md).
+
+Below is a disjointed mix of documentation for all three of these roles. Eventually they will be moved to an appropriate guide, for now the recommended way to consume documentation is to view the appropriate guide first and then supplement with docs from the README.
+
+## Behavior
+
+### Index files are proxies for folders
+
+In sprockets index files such as `index.js` or `index.css` files inside of a folder will generate a file with the folder's name. So if you have a `foo/index.js` file it will compile down to `foo.js`. This is similar to NPM's behavior of using [folders as modules](https://nodejs.org/api/modules.html#modules_folders_as_modules). It is also somewhat similar to the way that a file in `public/my_folder/index.html` can be reached by a request to `/my_folder`. This means that you cannot directly use an index file. For example this would not work:
+
+```
+<%= asset_path("foo/index.js") %>
+```
+
+Instead you would need to use:
+
+```
+<%= asset_path("foo.js") %>
+```
+
+Why would you want to use this behavior?  It is common behavior where you might want to include an entire directory of files in a top level javascript. You can do this in sprockets using `require_tree .`
+
+```
+//= require_tree .
+```
+
+This has the problem that files are required alphabetically. If your directory has `jquery-ui.js` and `jquery.min.js` then sprockets will require `jquery-ui.js` before `jquery` is required which won't work (because jquery-ui depends on jquery). Previously the only way to get the correct ordering would be to rename your files, something like `0-jquery-ui.js`. Instead of doing that you can use an index file.
+
+For example, if you have an `application.js` and want all the files in the `foo/` folder you could do this:
+
+```
+//= require foo.js
+```
+
+Then create a file `foo/index.js` that requires all the files in that folder in any order you want:
+
+```
+//= require foo.min.js
+//= require foo-ui.js
+```
+
+Now in your `application.js` will correctly load the `foo.min.js` before `foo-ui.js`. If you used `require_tree` it would not work correctly.
 
 ## Understanding the Sprockets Environment
 
@@ -449,189 +497,7 @@ submit a pull request.
 
 ### Version History
 
-**3.0.0**
-
-* New processor API. Tilt interface is deprecated.
-* Improved file store caching backend.
-* MIME Types now accept charset custom charset detecters. Improves support for UTF-16/32 files.
-* Environment#version no longer affects asset digests. Only used for busting the asset cache.
-* Removed builtin support for LESS.
-* Removed `//= include` directive support.
-* Deprecated `BundledAsset#to_a`. Use `BundledAsset#included` to access debugging subcomponents.
-* Support circular dependencies. For parity with ES6 modules.
-* Manifest compilation will no longer generate .gz files by default. [Mixing
-  Content-Encoding and ETags is just a bad
-  idea](https://issues.apache.org/bugzilla/show_bug.cgi?id=39727)
-* Added linked or referenced assets. When an asset is compiled, any of its links will be compiled as well.
-* Introduce some limitations around enumerating all logical paths. 4.x will deprecate it and favor linked manifests for compliation.
-* Add Asset integrity attribute for Subresource Integrity
-* Default digest changed to SHA256. Configuring `digest_class` is deprecated.
-* Rename `Asset#digest` to `Asset#hexdigest`. `Asset#digest` is deprecated and will
-  return a raw byte String in 4.x.
-* Added transitional compatibility flag to `Environment#resolve(path, compat: true)`. 2.x mode operates with `compat: true` and 4.x with `compat: false`
-* `manifest-abc123.json` renamed to `.sprockets-abc123.json`
-
-**2.12.3** (October 28, 2014)
-
-* Security: Fix directory traversal bug in development mode server.
-
-**2.12.2** (September 5, 2014)
-
-* Ensure internal asset lookups calls are still restricted to load paths within
-  asset compiles. Though, you should not depend on internal asset resolves to be
-  completely restricted for security reasons. Assets themselves should be
-  considered full scripting environments with filesystem access.
-
-**2.12.1** (April 17, 2014)
-
-* Fix making manifest target directory when its different than the output directory.
-
-**2.12.0** (March 13, 2014)
-
-* Avoid context reference in SassImporter hack so its Marshallable. Fixes
- issues with Sass 3.3.x.
-
-**2.11.0** (February 19, 2014)
-
-* Cache store must now be an LRU implementation.
-* Default digest changed to SHA1. To continue using MD5.
-  `env.digest_class = Digest::MD5`.
-
-**2.10.0** (May 24, 2013)
-
-* Support for `bower.json`
-
-**2.9.3** (April 20, 2013)
-
-* Fixed sass caching bug
-
-**2.9.2** (April 8, 2013)
-
-* Improve file freshness check performance
-* Directive processor encoding fixes
-
-**2.9.1** (April 6, 2013)
-
-* Support for Uglifier 2.x
-
-**2.9.0** (February 25, 2013)
-
-* Write out gzipped variants of bundled assets.
-
-**2.8.2** (December 10, 2012)
-
-* Fixed top level Sass constant references
-* Fixed manifest logger when environment is disabled
-
-**2.8.1** (October 31, 2012)
-
-* Fixed Sass importer bug
-
-**2.8.0** (October 16, 2012)
-
-* Allow manifest location to be separated from output directory
-* Pass logical path and absolute path to each_logical_path iterator
-
-**2.7.0** (October 10, 2012)
-
-* Added --css-compressor and --js-compressor command line flags
-* Added css/js compressor shorthand
-* Change default manifest.json filename to be a randomized manifest-16HEXBYTES.json
-* Allow nil environment to be passed to manifest
-* Allow manifest instance to be set on rake task
-
-**2.6.0** (September 19, 2012)
-
-* Added bower component.json require support
-
-**2.5.0** (September 4, 2012)
-
-* Fixed Ruby 2.0 RegExp warning
-* Provide stubbed implementation of context *_path helpers
-* Add SassCompressor
-
-**2.4.5** (July 10, 2012)
-
-* Tweaked some logger levels
-
-**2.4.4** (July 2, 2012)
-
-* Canonicalize logical path extensions
-* Check absolute paths passed to depend_on
-
-**2.4.3** (May 16, 2012)
-
-* Exposed :sprockets in sass options
-* Include dependency paths in asset mtime
-
-**2.4.2** (May 7, 2012)
-
-* Fixed MultiJson feature detect
-
-**2.4.1** (April 26, 2012)
-
-* Fixed MultiJson API change
-* Fixed gzip mtime
-
-**2.4.0** (March 27, 2012)
-
-* Added global path registry
-* Added global processor registry
-
-**2.3.2** (March 26, 2012)
-
-* Fix Context#logical_path with dots
-
-**2.3.1** (February 11, 2012)
-
-* Added bytesize to manifest
-* Added Asset#bytesize alias
-* Security: Check path for forbidden access after unescaping
-
-**2.3.0** (January 16, 2012)
-
-* Added special Sass importer that automatically tracks any `@import`ed files.
-
-**2.2.0** (January 10, 2012)
-
-* Added `sprockets` command line utility.
-* Added rake/sprocketstask.
-* Added json manifest log of compiled assets.
-* Added `stub` directive that allows you to exclude files from the bundle.
-* Added per environment external encoding (Environment#default_external_encoding). Defaults to UTF-8. Fixes issues where LANG is not set correctly and Rubys default external is set to ASCII.
-
-**2.1.2** (November 20, 2011)
-
-* Disabled If-Modified-Since server checks. Fixes some browser caching issues when serving the asset body only. If-None-Match caching is sufficient.
-
-**2.1.1** (November 18, 2011)
-
-* Fix windows absolute path check bug.
-
-**2.1.0** (November 11, 2011)
-
-* Directive comment lines are now turned into empty lines instead of removed. This way line numbers in
-  CoffeeScript syntax errors are correct.
-* Performance and caching bug fixes.
-
-**2.0.3** (October 17, 2011)
-
-* Detect format extensions from right to left.
-* Make JST namespace configurable.
-
-**2.0.2** (October 4, 2011)
-
-* Fixed loading stale cache from bundler gems.
-
-**2.0.1** (September 30, 2011)
-
-* Fixed bug with fingerprinting file names with multiple dots.
-* Decode URIs as default internal.
-* Fix symlinked asset directories.
-
-**2.0.0** (August 29, 2011)
-
-* Initial public release.
+Please see the [CHANGELOG](https://github.com/rails/sprockets/tree/master/CHANGELOG.md)
 
 ## License
 

data/bin/sprockets

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+$VERBOSE = nil
 
 require 'sprockets'
 require 'optparse'

data/lib/sprockets/asset.rb

@@ -19,7 +19,6 @@ module Sprockets
       @content_type = attributes[:content_type]
       @filename     = attributes[:filename]
       @id           = attributes[:id]
-      @integrity    = attributes[:integrity]
       @load_path    = attributes[:load_path]
       @logical_path = attributes[:logical_path]
       @metadata     = attributes[:metadata]
@@ -140,7 +139,9 @@ module Sprockets
     end
 
     # Public: A "named information" URL for subresource integrity.
-    attr_reader :integrity
+    def integrity
+      DigestUtils.integrity_uri(metadata[:digest])
+    end
 
     # Public: Add enumerator to allow `Asset` instances to be used as Rack
     # compatible body objects.

data/lib/sprockets/base.rb

@@ -10,6 +10,8 @@ require 'sprockets/path_dependency_utils'
 require 'sprockets/path_utils'
 require 'sprockets/resolve'
 require 'sprockets/server'
+require 'sprockets/loader'
+require 'sprockets/uri_tar'
 
 module Sprockets
   # `Base` class for `Environment` and `Cached`.
@@ -48,9 +50,10 @@ module Sprockets
         # Caveat: Digests are cached by the path's current mtime. Its possible
         # for a files contents to have changed and its mtime to have been
         # negligently reset thus appearing as if the file hasn't changed on
-        # disk. Also, the mtime is only read to the nearest second. Its
+        # disk. Also, the mtime is only read to the nearest second. It's
         # also possible the file was updated more than once in a given second.
-        cache.fetch("file_digest:#{path}:#{stat.mtime.to_i}") do
+        key = UnloadedAsset.new(path, self).file_digest_key(stat.mtime.to_i)
+        cache.fetch(key) do
           self.stat_digest(path, stat)
         end
       end
@@ -95,5 +98,13 @@ module Sprockets
         "root=#{root.to_s.inspect}, " +
         "paths=#{paths.inspect}>"
     end
+
+    def compress_from_root(uri)
+      URITar.new(uri, self).compress
+    end
+
+    def expand_from_root(uri)
+      URITar.new(uri, self).expand
+    end
   end
 end

data/lib/sprockets/bundle.rb

@@ -44,7 +44,11 @@ module Sprockets
     def self.process_bundle_reducers(assets, reducers)
       initial = {}
       reducers.each do |k, (v, _)|
-        initial[k] = v if !v.nil?
+        if v.respond_to?(:call)
+          initial[k] = v.call
+        elsif !v.nil?
+          initial[k] = v
+        end
       end
 
       assets.reduce(initial) do |h, asset|

data/lib/sprockets/cache/file_store.rb

@@ -36,7 +36,6 @@ module Sprockets
       #            (default: 1000).
       def initialize(root, max_size = DEFAULT_MAX_SIZE, logger = self.class.default_logger)
         @root     = root
-        @size     = find_caches.inject(0) { |n, (_, stat)| n + stat.size }
         @max_size = max_size
         @gc_size  = max_size * 0.75
         @logger   = logger
@@ -107,11 +106,11 @@ module Sprockets
         # Write data
         PathUtils.atomic_write(path) do |f|
           f.write(raw)
-          @size += f.size unless exists
+          @size = size + f.size unless exists
         end
 
         # GC if necessary
-        gc! if @size > @max_size
+        gc! if size > @max_size
 
         value
       end
@@ -120,7 +119,7 @@ module Sprockets
       #
       # Returns String.
       def inspect
-        "#<#{self.class} size=#{@size}/#{@max_size}>"
+        "#<#{self.class} size=#{size}/#{@max_size}>"
       end
 
       private
@@ -138,6 +137,10 @@ module Sprockets
           }.sort_by { |_, stat| stat.mtime.to_i }
         end
 
+        def size
+          @size ||= compute_size(find_caches)
+        end
+
         def compute_size(caches)
           caches.inject(0) { |sum, (_, stat)| sum + stat.size }
         end