sprokovuln 0.2.0

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/digest_utils.rb

@@ -0,0 +1,180 @@
+require 'digest/md5'
+require 'digest/sha1'
+require 'digest/sha2'
+require 'set'
+
+module Sprockets
+  # Internal: Hash functions and digest related utilities. Mixed into
+  # Environment.
+  module DigestUtils
+    extend self
+
+    # Internal: Default digest class.
+    #
+    # Returns a Digest::Base subclass.
+    def digest_class
+      Digest::SHA256
+    end
+
+    # Internal: Maps digest bytesize to the digest class.
+    DIGEST_SIZES = {
+      16 => Digest::MD5,
+      20 => Digest::SHA1,
+      32 => Digest::SHA256,
+      48 => Digest::SHA384,
+      64 => Digest::SHA512
+    }
+
+    # Internal: Detect digest class hash algorithm for digest bytes.
+    #
+    # While not elegant, all the supported digests have a unique bytesize.
+    #
+    # Returns Digest::Base or nil.
+    def detect_digest_class(bytes)
+      DIGEST_SIZES[bytes.bytesize]
+    end
+
+    ADD_VALUE_TO_DIGEST = {
+      String     => ->(val, digest) { digest << val },
+      FalseClass => ->(val, digest) { digest << 'FalseClass'.freeze },
+      TrueClass  => ->(val, digest) { digest << 'TrueClass'.freeze  },
+      NilClass   => ->(val, digest) { digest << 'NilClass'.freeze   },
+
+      Symbol => ->(val, digest) {
+        digest << 'Symbol'.freeze
+        digest << val.to_s
+      },
+      Integer => ->(val, digest) {
+        digest << 'Integer'.freeze
+        digest << val.to_s
+      },
+      Array => ->(val, digest) {
+        digest << 'Array'.freeze
+        val.each do |element|
+          ADD_VALUE_TO_DIGEST[element.class].call(element, digest)
+        end
+      },
+      Hash => ->(val, digest) {
+        digest << 'Hash'.freeze
+        val.sort.each do |array|
+          ADD_VALUE_TO_DIGEST[Array].call(array, digest)
+        end
+      },
+      Set => ->(val, digest) {
+        digest << 'Set'.freeze
+        ADD_VALUE_TO_DIGEST[Array].call(val.to_a, digest)
+      },
+      Encoding => ->(val, digest) {
+        digest << 'Encoding'.freeze
+        digest << val.name
+      },
+    }
+    if 0.class != Integer # Ruby < 2.4
+      ADD_VALUE_TO_DIGEST[Fixnum] = ->(val, digest) {
+        digest << 'Integer'.freeze
+        digest << val.to_s
+      }
+      ADD_VALUE_TO_DIGEST[Bignum] = ->(val, digest) {
+        digest << 'Integer'.freeze
+        digest << val.to_s
+      }
+    end
+    ADD_VALUE_TO_DIGEST.default_proc = ->(_, val) {
+      raise TypeError, "couldn't digest #{ val }"
+    }
+    private_constant :ADD_VALUE_TO_DIGEST
+
+    # Internal: Generate a hexdigest for a nested JSON serializable object.
+    #
+    # This is used for generating cache keys, so its pretty important its
+    # wicked fast. Microbenchmarks away!
+    #
+    # obj - A JSON serializable object.
+    #
+    # Returns a String digest of the object.
+    def digest(obj)
+      digest = digest_class.new
+
+      ADD_VALUE_TO_DIGEST[obj.class].call(obj, digest)
+      digest.digest
+    end
+
+    # Internal: Pack a binary digest to a hex encoded string.
+    #
+    # bin - String bytes
+    #
+    # Returns hex String.
+    def pack_hexdigest(bin)
+      bin.unpack('H*').first
+    end
+
+    # Internal: Unpack a hex encoded digest string into binary bytes.
+    #
+    # hex - String hex
+    #
+    # Returns binary String.
+    def unpack_hexdigest(hex)
+      [hex].pack('H*')
+    end
+
+    # Internal: Pack a binary digest to a base64 encoded string.
+    #
+    # bin - String bytes
+    #
+    # Returns base64 String.
+    def pack_base64digest(bin)
+      [bin].pack('m0')
+    end
+
+    # Internal: Pack a binary digest to a urlsafe base64 encoded string.
+    #
+    # bin - String bytes
+    #
+    # Returns urlsafe base64 String.
+    def pack_urlsafe_base64digest(bin)
+      str = pack_base64digest(bin)
+      str.tr!('+/'.freeze, '-_'.freeze)
+      str.tr!('='.freeze, ''.freeze)
+      str
+    end
+
+    # Internal: Maps digest class to the CSP hash algorithm name.
+    HASH_ALGORITHMS = {
+      Digest::SHA256 => 'sha256'.freeze,
+      Digest::SHA384 => 'sha384'.freeze,
+      Digest::SHA512 => 'sha512'.freeze
+    }
+
+    # Public: Generate hash for use in the `integrity` attribute of an asset tag
+    # as per the subresource integrity specification.
+    #
+    # digest - The String byte digest of the asset content.
+    #
+    # Returns a String or nil if hash algorithm is incompatible.
+    def integrity_uri(digest)
+      case digest
+      when Digest::Base
+        digest_class = digest.class
+        digest = digest.digest
+      when String
+        digest_class = DIGEST_SIZES[digest.bytesize]
+      else
+        raise TypeError, "unknown digest: #{digest.inspect}"
+      end
+
+      if hash_name = HASH_ALGORITHMS[digest_class]
+        "#{hash_name}-#{pack_base64digest(digest)}"
+      end
+    end
+
+    # Public: Generate hash for use in the `integrity` attribute of an asset tag
+    # as per the subresource integrity specification.
+    #
+    # digest - The String hexbyte digest of the asset content.
+    #
+    # Returns a String or nil if hash algorithm is incompatible.
+    def hexdigest_integrity_uri(hexdigest)
+      integrity_uri(unpack_hexdigest(hexdigest))
+    end
+  end
+end

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/directive_processor.rb

@@ -0,0 +1,404 @@
+require 'set'
+require 'shellwords'
+
+module Sprockets
+  # The `DirectiveProcessor` is responsible for parsing and evaluating
+  # directive comments in a source file.
+  #
+  # A directive comment starts with a comment prefix, followed by an "=",
+  # then the directive name, then any arguments.
+  #
+  #     // JavaScript
+  #     //= require "foo"
+  #
+  #     # CoffeeScript
+  #     #= require "bar"
+  #
+  #     /* CSS
+  #      *= require "baz"
+  #      */
+  #
+  # This makes it possible to disable or modify the processor to do whatever
+  # you'd like. You could add your own custom directives or invent your own
+  # directive syntax.
+  #
+  # `Environment#processors` includes `DirectiveProcessor` by default.
+  #
+  # To remove the processor entirely:
+  #
+  #     env.unregister_processor('text/css', Sprockets::DirectiveProcessor)
+  #     env.unregister_processor('application/javascript', Sprockets::DirectiveProcessor)
+  #
+  # Then inject your own preprocessor:
+  #
+  #     env.register_processor('text/css', MyProcessor)
+  #
+  class DirectiveProcessor
+    VERSION = '1'
+
+    # Directives are denoted by a `=` followed by the name, then
+    # argument list.
+    #
+    # A few different styles are allowed:
+    #
+    #     // =require foo
+    #     //= require foo
+    #     //= require "foo"
+    #
+    DIRECTIVE_PATTERN = /
+      ^ \W* = \s* (\w+.*?) (\*\/)? $
+    /x
+
+    def self.instance
+      @instance ||= new(
+        # Deprecated: Default to C and Ruby comment styles
+        comments: ["//", ["/*", "*/"]] + ["#", ["###", "###"]]
+      )
+    end
+
+    def self.call(input)
+      instance.call(input)
+    end
+
+    def initialize(options = {})
+      @header_pattern = compile_header_pattern(Array(options[:comments]))
+    end
+
+    def call(input)
+      dup._call(input)
+    end
+
+    def _call(input)
+      @environment  = input[:environment]
+      @uri          = input[:uri]
+      @filename     = input[:filename]
+      @dirname      = File.dirname(@filename)
+      @content_type = input[:content_type]
+      @required     = Set.new(input[:metadata][:required])
+      @stubbed      = Set.new(input[:metadata][:stubbed])
+      @links        = Set.new(input[:metadata][:links])
+      @dependencies = Set.new(input[:metadata][:dependencies])
+
+      data, directives = process_source(input[:data])
+      process_directives(directives)
+
+      { data: data,
+        required: @required,
+        stubbed: @stubbed,
+        links: @links,
+        dependencies: @dependencies }
+    end
+
+    protected
+      # Directives will only be picked up if they are in the header
+      # of the source file. C style (/* */), JavaScript (//), and
+      # Ruby (#) comments are supported.
+      #
+      # Directives in comments after the first non-whitespace line
+      # of code will not be processed.
+      def compile_header_pattern(comments)
+        re = comments.map { |c|
+          case c
+          when String
+            "(?:#{Regexp.escape(c)}.*\\n?)+"
+          when Array
+            "(?:#{Regexp.escape(c[0])}(?m:.*?)#{Regexp.escape(c[1])})"
+          else
+            raise TypeError, "unknown comment type: #{c.class}"
+          end
+        }.join("|")
+        Regexp.compile("\\A(?:(?m:\\s*)(?:#{re}))+")
+      end
+
+      def process_source(source)
+        header = source[@header_pattern, 0] || ""
+        body   = $' || source
+
+        header, directives = extract_directives(header)
+
+        data = ""
+        data.force_encoding(body.encoding)
+        data << header << "\n" unless header.empty?
+        data << body
+        # Ensure body ends in a new line
+        data << "\n" if data.length > 0 && data[-1] != "\n"
+
+        return data, directives
+      end
+
+      # Returns an Array of directive structures. Each structure
+      # is an Array with the line number as the first element, the
+      # directive name as the second element, followed by any
+      # arguments.
+      #
+      #     [[1, "require", "foo"], [2, "require", "bar"]]
+      #
+      def extract_directives(header)
+        processed_header = ""
+        directives = []
+
+        header.lines.each_with_index do |line, index|
+          if directive = line[DIRECTIVE_PATTERN, 1]
+            name, *args = Shellwords.shellwords(directive)
+            if respond_to?("process_#{name}_directive", true)
+              directives << [index + 1, name, *args]
+              # Replace directive line with a clean break
+              line = "\n"
+            end
+          end
+          processed_header << line
+        end
+
+        return processed_header.chomp, directives
+      end
+
+      # Gathers comment directives in the source and processes them.
+      # Any directive method matching `process_*_directive` will
+      # automatically be available. This makes it easy to extend the
+      # processor.
+      #
+      # To implement a custom directive called `require_glob`, subclass
+      # `Sprockets::DirectiveProcessor`, then add a method called
+      # `process_require_glob_directive`.
+      #
+      #     class DirectiveProcessor < Sprockets::DirectiveProcessor
+      #       def process_require_glob_directive
+      #         Dir["#{dirname}/#{glob}"].sort.each do |filename|
+      #           require(filename)
+      #         end
+      #       end
+      #     end
+      #
+      # Replace the current processor on the environment with your own:
+      #
+      #     env.unregister_processor('text/css', Sprockets::DirectiveProcessor)
+      #     env.register_processor('text/css', DirectiveProcessor)
+      #
+      def process_directives(directives)
+        directives.each do |line_number, name, *args|
+          begin
+            send("process_#{name}_directive", *args)
+          rescue Exception => e
+            e.set_backtrace(["#{@filename}:#{line_number}"] + e.backtrace)
+            raise e
+          end
+        end
+      end
+
+      # The `require` directive functions similar to Ruby's own `require`.
+      # It provides a way to declare a dependency on a file in your path
+      # and ensures its only loaded once before the source file.
+      #
+      # `require` works with files in the environment path:
+      #
+      #     //= require "foo.js"
+      #
+      # Extensions are optional. If your source file is ".js", it
+      # assumes you are requiring another ".js".
+      #
+      #     //= require "foo"
+      #
+      # Relative paths work too. Use a leading `./` to denote a relative
+      # path:
+      #
+      #     //= require "./bar"
+      #
+      def process_require_directive(path)
+        @required << resolve(path, accept: @content_type, pipeline: :self)
+      end
+
+      # `require_self` causes the body of the current file to be inserted
+      # before any subsequent `require` directives. Useful in CSS files, where
+      # it's common for the index file to contain global styles that need to
+      # be defined before other dependencies are loaded.
+      #
+      #     /*= require "reset"
+      #      *= require_self
+      #      *= require_tree .
+      #      */
+      #
+      def process_require_self_directive
+        if @required.include?(@uri)
+          raise ArgumentError, "require_self can only be called once per source file"
+        end
+        @required << @uri
+      end
+
+      # `require_directory` requires all the files inside a single
+      # directory. It's similar to `path/*` since it does not follow
+      # nested directories.
+      #
+      #     //= require_directory "./javascripts"
+      #
+      def process_require_directory_directive(path = ".")
+        path = expand_relative_dirname(:require_directory, path)
+        require_paths(*@environment.stat_directory_with_dependencies(path))
+      end
+
+      # `require_tree` requires all the nested files in a directory.
+      # Its glob equivalent is `path/**/*`.
+      #
+      #     //= require_tree "./public"
+      #
+      def process_require_tree_directive(path = ".")
+        path = expand_relative_dirname(:require_tree, path)
+        require_paths(*@environment.stat_sorted_tree_with_dependencies(path))
+      end
+
+      # Allows you to state a dependency on a file without
+      # including it.
+      #
+      # This is used for caching purposes. Any changes made to
+      # the dependency file will invalidate the cache of the
+      # source file.
+      #
+      # This is useful if you are using ERB and File.read to pull
+      # in contents from another file.
+      #
+      #     //= depend_on "foo.png"
+      #
+      def process_depend_on_directive(path)
+        resolve(path)
+      end
+
+      # Allows you to state a dependency on an asset without including
+      # it.
+      #
+      # This is used for caching purposes. Any changes that would
+      # invalid the asset dependency will invalidate the cache our the
+      # source file.
+      #
+      # Unlike `depend_on`, the path must be a requirable asset.
+      #
+      #     //= depend_on_asset "bar.js"
+      #
+      def process_depend_on_asset_directive(path)
+        load(resolve(path))
+      end
+
+      # Allows dependency to be excluded from the asset bundle.
+      #
+      # The `path` must be a valid asset and may or may not already
+      # be part of the bundle. Once stubbed, it is blacklisted and
+      # can't be brought back by any other `require`.
+      #
+      #     //= stub "jquery"
+      #
+      def process_stub_directive(path)
+        @stubbed << resolve(path, accept: @content_type, pipeline: :self)
+      end
+
+      # Declares a linked dependency on the target asset.
+      #
+      # The `path` must be a valid asset and should not already be part of the
+      # bundle. Any linked assets will automatically be compiled along with the
+      # current.
+      #
+      #   /*= link "logo.png" */
+      #
+      def process_link_directive(path)
+        @links << load(resolve(path)).uri
+      end
+
+      # `link_directory` links all the files inside a single
+      # directory. It's similar to `path/*` since it does not follow
+      # nested directories.
+      #
+      #     //= link_directory "./fonts"
+      #
+      # Use caution when linking against JS or CSS assets. Include an explicit
+      # extension or content type in these cases
+      #
+      #     //= link_directory "./scripts" .js
+      #
+      def process_link_directory_directive(path = ".", accept = nil)
+        path = expand_relative_dirname(:link_directory, path)
+        accept = expand_accept_shorthand(accept)
+        link_paths(*@environment.stat_directory_with_dependencies(path), accept)
+      end
+
+      # `link_tree` links all the nested files in a directory.
+      # Its glob equivalent is `path/**/*`.
+      #
+      #     //= link_tree "./images"
+      #
+      # Use caution when linking against JS or CSS assets. Include an explicit
+      # extension or content type in these cases
+      #
+      #     //= link_tree "./styles" .css
+      #
+      def process_link_tree_directive(path = ".", accept = nil)
+        path = expand_relative_dirname(:link_tree, path)
+        accept = expand_accept_shorthand(accept)
+        link_paths(*@environment.stat_sorted_tree_with_dependencies(path), accept)
+      end
+
+    private
+      def expand_accept_shorthand(accept)
+        if accept.nil?
+          nil
+        elsif accept.include?("/")
+          accept
+        elsif accept.start_with?(".")
+          @environment.mime_exts[accept]
+        else
+          @environment.mime_exts[".#{accept}"]
+        end
+      end
+
+      def require_paths(paths, deps)
+        resolve_paths(paths, deps, accept: @content_type, pipeline: :self) do |uri|
+          @required << uri
+        end
+      end
+
+      def link_paths(paths, deps, accept)
+        resolve_paths(paths, deps, accept: accept) do |uri|
+          @links << load(uri).uri
+        end
+      end
+
+      def resolve_paths(paths, deps, options = {})
+        @dependencies.merge(deps)
+        paths.each do |subpath, stat|
+          next if subpath == @filename || stat.directory?
+          uri, deps = @environment.resolve(subpath, options.merge(compat: false))
+          @dependencies.merge(deps)
+          yield uri if uri
+        end
+      end
+
+      def expand_relative_dirname(directive, path)
+        if @environment.relative_path?(path)
+          path = File.expand_path(path, @dirname)
+          stat = @environment.stat(path)
+
+          if stat && stat.directory?
+            path
+          else
+            raise ArgumentError, "#{directive} argument must be a directory"
+          end
+        else
+          # The path must be relative and start with a `./`.
+          raise ArgumentError, "#{directive} argument must be a relative path"
+        end
+      end
+
+      def load(uri)
+        asset = @environment.load(uri)
+        @dependencies.merge(asset.metadata[:dependencies])
+        asset
+      end
+
+      def resolve(path, options = {})
+        # Prevent absolute paths in directives
+        if @environment.absolute_path?(path)
+          raise FileOutsidePaths, "can't require absolute file: #{path}"
+        end
+
+        uri, deps = @environment.resolve!(path, options.merge(base_path: @dirname))
+        @dependencies.merge(deps)
+        uri
+      end
+  end
+end

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/eco_processor.rb

@@ -0,0 +1,32 @@
+require 'sprockets/autoload'
+
+module Sprockets
+  # Processor engine class for the Eco compiler. Depends on the `eco` gem.
+  #
+  # For more infomation see:
+  #
+  #   https://github.com/sstephenson/ruby-eco
+  #   https://github.com/sstephenson/eco
+  #
+  module EcoProcessor
+    VERSION = '1'
+
+    def self.cache_key
+      @cache_key ||= "#{name}:#{Autoload::Eco::Source::VERSION}:#{VERSION}".freeze
+    end
+
+    # Compile template data with Eco compiler.
+    #
+    # Returns a JS function definition String. The result should be
+    # assigned to a JS variable.
+    #
+    #     # => "function(...) {...}"
+    #
+    def self.call(input)
+      data = input[:data]
+      input[:cache].fetch([cache_key, data]) do
+        Autoload::Eco.compile(data)
+      end
+    end
+  end
+end

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/eco_template.rb

@@ -0,0 +1,17 @@
+require 'sprockets/eco_processor'
+
+module Sprockets
+  # Deprecated
+  module EcoTemplate
+    VERSION = EcoProcessor::VERSION
+
+    def self.cache_key
+      EcoProcessor.cache_key
+    end
+
+    def self.call(*args)
+      Deprecation.new.warn "EcoTemplate is deprecated please use EcoProcessor instead"
+      EcoProcessor.call(*args)
+    end
+  end
+end

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/ejs_processor.rb

@@ -0,0 +1,31 @@
+require 'sprockets/autoload'
+
+module Sprockets
+  # Processor engine class for the EJS compiler. Depends on the `ejs` gem.
+  #
+  # For more infomation see:
+  #
+  #   https://github.com/sstephenson/ruby-ejs
+  #
+  module EjsProcessor
+    VERSION = '1'
+
+    def self.cache_key
+      @cache_key ||= "#{name}:#{VERSION}".freeze
+    end
+
+    # Compile template data with EJS compiler.
+    #
+    # Returns a JS function definition String. The result should be
+    # assigned to a JS variable.
+    #
+    #     # => "function(obj){...}"
+    #
+    def self.call(input)
+      data = input[:data]
+      input[:cache].fetch([cache_key, data]) do
+        Autoload::EJS.compile(data)
+      end
+    end
+  end
+end

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/ejs_template.rb

@@ -0,0 +1,17 @@
+require 'sprockets/ejs_processor'
+
+module Sprockets
+  # Deprecated
+  module EjsTemplate
+    VERSION = EjsProcessor::VERSION
+
+    def self.cache_key
+      EjsProcessor.cache_key
+    end
+
+    def self.call(*args)
+      Deprecation.new.warn "EjsTemplate is deprecated please use EjsProcessor instead"
+      EjsProcessor.call(*args)
+    end
+  end
+end