sprokovuln 0.2.0

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/sass_compressor.rb

@@ -0,0 +1,51 @@
+require 'sprockets/autoload'
+require 'sprockets/digest_utils'
+
+module Sprockets
+  # Public: Sass CSS minifier.
+  #
+  # To accept the default options
+  #
+  #     environment.register_bundle_processor 'text/css',
+  #       Sprockets::SassCompressor
+  #
+  # Or to pass options to the Sass::Engine class.
+  #
+  #     environment.register_bundle_processor 'text/css',
+  #       Sprockets::SassCompressor.new({ ... })
+  #
+  class SassCompressor
+    VERSION = '1'
+
+    # Public: Return singleton instance with default options.
+    #
+    # Returns SassCompressor object.
+    def self.instance
+      @instance ||= new
+    end
+
+    def self.call(input)
+      instance.call(input)
+    end
+
+    def self.cache_key
+      instance.cache_key
+    end
+
+    attr_reader :cache_key
+
+    def initialize(options = {})
+      @options = {
+        syntax: :scss,
+        cache: false,
+        read_cache: false,
+        style: :compressed
+      }.merge(options).freeze
+      @cache_key = "#{self.class.name}:#{Autoload::Sass::VERSION}:#{VERSION}:#{DigestUtils.digest(options)}".freeze
+    end
+
+    def call(input)
+      Autoload::Sass::Engine.new(input[:data], @options).render
+    end
+  end
+end

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/sass_functions.rb

@@ -0,0 +1,2 @@
+# Deprecated: Require sprockets/sass_processor instead
+require 'sprockets/sass_processor'

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/sass_importer.rb

@@ -0,0 +1,2 @@
+# Deprecated: Require sprockets/sass_processor instead
+require 'sprockets/sass_processor'

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/sass_processor.rb

@@ -0,0 +1,292 @@
+require 'rack/utils'
+require 'sprockets/autoload'
+require 'uri'
+
+module Sprockets
+  # Processor engine class for the SASS/SCSS compiler. Depends on the `sass` gem.
+  #
+  # For more infomation see:
+  #
+  #   https://github.com/sass/sass
+  #   https://github.com/rails/sass-rails
+  #
+  class SassProcessor
+    autoload :CacheStore, 'sprockets/sass_cache_store'
+
+    # Internal: Defines default sass syntax to use. Exposed so the ScssProcessor
+    # may override it.
+    def self.syntax
+      :sass
+    end
+
+    # Public: Return singleton instance with default options.
+    #
+    # Returns SassProcessor object.
+    def self.instance
+      @instance ||= new
+    end
+
+    def self.call(input)
+      instance.call(input)
+    end
+
+    def self.cache_key
+      instance.cache_key
+    end
+
+    attr_reader :cache_key
+
+    # Public: Initialize template with custom options.
+    #
+    # options - Hash
+    # cache_version - String custom cache version. Used to force a cache
+    #                 change after code changes are made to Sass Functions.
+    #
+    def initialize(options = {}, &block)
+      @cache_version = options[:cache_version]
+      @cache_key = "#{self.class.name}:#{VERSION}:#{Autoload::Sass::VERSION}:#{@cache_version}".freeze
+
+      @functions = Module.new do
+        include Functions
+        include options[:functions] if options[:functions]
+        class_eval(&block) if block_given?
+      end
+    end
+
+    def call(input)
+      context = input[:environment].context_class.new(input)
+
+      options = {
+        filename: input[:filename],
+        syntax: self.class.syntax,
+        cache_store: build_cache_store(input, @cache_version),
+        load_paths: input[:environment].paths,
+        sprockets: {
+          context: context,
+          environment: input[:environment],
+          dependencies: context.metadata[:dependencies]
+        }
+      }
+
+      engine = Autoload::Sass::Engine.new(input[:data], options)
+
+      css = Utils.module_include(Autoload::Sass::Script::Functions, @functions) do
+        engine.render
+      end
+
+      # Track all imported files
+      sass_dependencies = Set.new([input[:filename]])
+      engine.dependencies.map do |dependency|
+        sass_dependencies << dependency.options[:filename]
+        context.metadata[:dependencies] << URIUtils.build_file_digest_uri(dependency.options[:filename])
+      end
+
+      context.metadata.merge(data: css, sass_dependencies: sass_dependencies)
+    end
+
+    # Public: Build the cache store to be used by the Sass engine.
+    #
+    # input - the input hash.
+    # version - the cache version.
+    #
+    # Override this method if you need to use a different cache than the
+    # Sprockets cache.
+    def build_cache_store(input, version)
+      CacheStore.new(input[:cache], version)
+    end
+    private :build_cache_store
+
+    # Public: Functions injected into Sass context during Sprockets evaluation.
+    #
+    # This module may be extended to add global functionality to all Sprockets
+    # Sass environments. Though, scoping your functions to just your environment
+    # is preferred.
+    #
+    # module Sprockets::SassProcessor::Functions
+    #   def asset_path(path, options = {})
+    #   end
+    # end
+    #
+    module Functions
+      # Public: Generate a url for asset path.
+      #
+      # Default implementation is deprecated. Currently defaults to
+      # Context#asset_path.
+      #
+      # Will raise NotImplementedError in the future. Users should provide their
+      # own base implementation.
+      #
+      # Returns a Sass::Script::String.
+      def asset_path(path, options = {})
+        path = path.value
+
+        path, _, query, fragment = URI.split(path)[5..8]
+        path     = sprockets_context.asset_path(path, options)
+        query    = "?#{query}" if query
+        fragment = "##{fragment}" if fragment
+
+        Autoload::Sass::Script::String.new("#{path}#{query}#{fragment}", :string)
+      end
+
+      # Public: Generate a asset url() link.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def asset_url(path, options = {})
+        Autoload::Sass::Script::String.new("url(#{asset_path(path, options).value})")
+      end
+
+      # Public: Generate url for image path.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def image_path(path)
+        asset_path(path, type: :image)
+      end
+
+      # Public: Generate a image url() link.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def image_url(path)
+        asset_url(path, type: :image)
+      end
+
+      # Public: Generate url for video path.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def video_path(path)
+        asset_path(path, type: :video)
+      end
+
+      # Public: Generate a video url() link.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def video_url(path)
+        asset_url(path, type: :video)
+      end
+
+      # Public: Generate url for audio path.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def audio_path(path)
+        asset_path(path, type: :audio)
+      end
+
+      # Public: Generate a audio url() link.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def audio_url(path)
+        asset_url(path, type: :audio)
+      end
+
+      # Public: Generate url for font path.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def font_path(path)
+        asset_path(path, type: :font)
+      end
+
+      # Public: Generate a font url() link.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def font_url(path)
+        asset_url(path, type: :font)
+      end
+
+      # Public: Generate url for javascript path.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def javascript_path(path)
+        asset_path(path, type: :javascript)
+      end
+
+      # Public: Generate a javascript url() link.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def javascript_url(path)
+        asset_url(path, type: :javascript)
+      end
+
+      # Public: Generate url for stylesheet path.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def stylesheet_path(path)
+        asset_path(path, type: :stylesheet)
+      end
+
+      # Public: Generate a stylesheet url() link.
+      #
+      # path - Sass::Script::String URL path
+      #
+      # Returns a Sass::Script::String.
+      def stylesheet_url(path)
+        asset_url(path, type: :stylesheet)
+      end
+
+      # Public: Generate a data URI for asset path.
+      #
+      # path - Sass::Script::String logical asset path
+      #
+      # Returns a Sass::Script::String.
+      def asset_data_url(path)
+        url = sprockets_context.asset_data_uri(path.value)
+        Autoload::Sass::Script::String.new("url(" + url + ")")
+      end
+
+      protected
+        # Public: The Environment.
+        #
+        # Returns Sprockets::Environment.
+        def sprockets_environment
+          options[:sprockets][:environment]
+        end
+
+        # Public: Mutatable set of dependencies.
+        #
+        # Returns a Set.
+        def sprockets_dependencies
+          options[:sprockets][:dependencies]
+        end
+
+        # Deprecated: Get the Context instance. Use APIs on
+        # sprockets_environment or sprockets_dependencies directly.
+        #
+        # Returns a Context instance.
+        def sprockets_context
+          options[:sprockets][:context]
+        end
+
+    end
+  end
+
+  class ScssProcessor < SassProcessor
+    def self.syntax
+      :scss
+    end
+  end
+
+  # Deprecated: Use Sprockets::SassProcessor::Functions instead.
+  SassFunctions = SassProcessor::Functions
+end

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/sass_template.rb

@@ -0,0 +1,19 @@
+require 'sprockets/sass_processor'
+
+module Sprockets
+  # Deprecated
+  class SassTemplate < SassProcessor
+    def self.call(*args)
+      Deprecation.new.warn "SassTemplate is deprecated please use SassProcessor instead"
+      super
+    end
+  end
+
+  # Deprecated
+  class ScssTemplate < ScssProcessor
+    def self.call(*args)
+      Deprecation.new.warn "ScssTemplate is deprecated please use ScssProcessor instead"
+      super
+    end
+  end
+end

data/vendor/ruby/gems/sprockets-3.7.1/lib/sprockets/server.rb

@@ -0,0 +1,292 @@
+require 'time'
+require 'rack/utils'
+
+module Sprockets
+  # `Server` is a concern mixed into `Environment` and
+  # `CachedEnvironment` that provides a Rack compatible `call`
+  # interface and url generation helpers.
+  module Server
+    # `call` implements the Rack 1.x specification which accepts an
+    # `env` Hash and returns a three item tuple with the status code,
+    # headers, and body.
+    #
+    # Mapping your environment at a url prefix will serve all assets
+    # in the path.
+    #
+    #     map "/assets" do
+    #       run Sprockets::Environment.new
+    #     end
+    #
+    # A request for `"/assets/foo/bar.js"` will search your
+    # environment for `"foo/bar.js"`.
+    def call(env)
+      start_time = Time.now.to_f
+      time_elapsed = lambda { ((Time.now.to_f - start_time) * 1000).to_i }
+
+      if !['GET', 'HEAD'].include?(env['REQUEST_METHOD'])
+        return method_not_allowed_response
+      end
+
+      msg = "Served asset #{env['PATH_INFO']} -"
+
+      # Extract the path from everything after the leading slash
+      path = Rack::Utils.unescape(env['PATH_INFO'].to_s.sub(/^\//, ''))
+
+      # Strip fingerprint
+      if fingerprint = path_fingerprint(path)
+        path = path.sub("-#{fingerprint}", '')
+      end
+
+      # URLs containing a `".."` are rejected for security reasons.
+      if forbidden_request?(path)
+        return forbidden_response(env)
+      end
+
+      # Look up the asset.
+      options = {}
+      options[:pipeline] = :self if body_only?(env)
+
+      asset = find_asset(path, options)
+
+      # 2.x/3.x compatibility hack. Just ignore fingerprints on ?body=1 requests.
+      # 3.x/4.x prefers strong validation of fingerprint to body contents, but
+      # 2.x just ignored it.
+      if asset && parse_asset_uri(asset.uri)[1][:pipeline] == "self"
+        fingerprint = nil
+      end
+
+      if fingerprint
+        if_match = fingerprint
+      elsif env['HTTP_IF_MATCH']
+        if_match = env['HTTP_IF_MATCH'][/^"(\w+)"$/, 1]
+      end
+
+      if env['HTTP_IF_NONE_MATCH']
+        if_none_match = env['HTTP_IF_NONE_MATCH'][/^"(\w+)"$/, 1]
+      end
+
+      if asset.nil?
+        status = :not_found
+      elsif fingerprint && asset.etag != fingerprint
+        status = :not_found
+      elsif if_match && asset.etag != if_match
+        status = :precondition_failed
+      elsif if_none_match && asset.etag == if_none_match
+        status = :not_modified
+      else
+        status = :ok
+      end
+
+      case status
+      when :ok
+        logger.info "#{msg} 200 OK (#{time_elapsed.call}ms)"
+        ok_response(asset, env)
+      when :not_modified
+        logger.info "#{msg} 304 Not Modified (#{time_elapsed.call}ms)"
+        not_modified_response(env, if_none_match)
+      when :not_found
+        logger.info "#{msg} 404 Not Found (#{time_elapsed.call}ms)"
+        not_found_response(env)
+      when :precondition_failed
+        logger.info "#{msg} 412 Precondition Failed (#{time_elapsed.call}ms)"
+        precondition_failed_response(env)
+      end
+    rescue Exception => e
+      logger.error "Error compiling asset #{path}:"
+      logger.error "#{e.class.name}: #{e.message}"
+
+      case File.extname(path)
+      when ".js"
+        # Re-throw JavaScript asset exceptions to the browser
+        logger.info "#{msg} 500 Internal Server Error\n\n"
+        return javascript_exception_response(e)
+      when ".css"
+        # Display CSS asset exceptions in the browser
+        logger.info "#{msg} 500 Internal Server Error\n\n"
+        return css_exception_response(e)
+      else
+        raise
+      end
+    end
+
+    private
+      def forbidden_request?(path)
+        # Prevent access to files elsewhere on the file system
+        #
+        #     http://example.org/assets/../../../etc/passwd
+        #
+        path.include?("..") || absolute_path?(path)
+      end
+
+      def head_request?(env)
+        env['REQUEST_METHOD'] == 'HEAD'
+      end
+
+      # Returns a 200 OK response tuple
+      def ok_response(asset, env)
+        if head_request?(env)
+          [ 200, headers(env, asset, 0), [] ]
+        else
+          [ 200, headers(env, asset, asset.length), asset ]
+        end
+      end
+
+      # Returns a 304 Not Modified response tuple
+      def not_modified_response(env, etag)
+        [ 304, cache_headers(env, etag), [] ]
+      end
+
+      # Returns a 403 Forbidden response tuple
+      def forbidden_response(env)
+        if head_request?(env)
+          [ 403, { "Content-Type" => "text/plain", "Content-Length" => "0" }, [] ]
+        else
+          [ 403, { "Content-Type" => "text/plain", "Content-Length" => "9" }, [ "Forbidden" ] ]
+        end
+      end
+
+      # Returns a 404 Not Found response tuple
+      def not_found_response(env)
+        if head_request?(env)
+          [ 404, { "Content-Type" => "text/plain", "Content-Length" => "0", "X-Cascade" => "pass" }, [] ]
+        else
+          [ 404, { "Content-Type" => "text/plain", "Content-Length" => "9", "X-Cascade" => "pass" }, [ "Not found" ] ]
+        end
+      end
+
+      def method_not_allowed_response
+        [ 405, { "Content-Type" => "text/plain", "Content-Length" => "18" }, [ "Method Not Allowed" ] ]
+      end
+
+      def precondition_failed_response(env)
+        if head_request?(env)
+          [ 412, { "Content-Type" => "text/plain", "Content-Length" => "0", "X-Cascade" => "pass" }, [] ]
+        else
+          [ 412, { "Content-Type" => "text/plain", "Content-Length" => "19", "X-Cascade" => "pass" }, [ "Precondition Failed" ] ]
+        end
+      end
+
+      # Returns a JavaScript response that re-throws a Ruby exception
+      # in the browser
+      def javascript_exception_response(exception)
+        err  = "#{exception.class.name}: #{exception.message}\n  (in #{exception.backtrace[0]})"
+        body = "throw Error(#{err.inspect})"
+        [ 200, { "Content-Type" => "application/javascript", "Content-Length" => body.bytesize.to_s }, [ body ] ]
+      end
+
+      # Returns a CSS response that hides all elements on the page and
+      # displays the exception
+      def css_exception_response(exception)
+        message   = "\n#{exception.class.name}: #{exception.message}"
+        backtrace = "\n  #{exception.backtrace.first}"
+
+        body = <<-CSS
+          html {
+            padding: 18px 36px;
+          }
+
+          head {
+            display: block;
+          }
+
+          body {
+            margin: 0;
+            padding: 0;
+          }
+
+          body > * {
+            display: none !important;
+          }
+
+          head:after, body:before, body:after {
+            display: block !important;
+          }
+
+          head:after {
+            font-family: sans-serif;
+            font-size: large;
+            font-weight: bold;
+            content: "Error compiling CSS asset";
+          }
+
+          body:before, body:after {
+            font-family: monospace;
+            white-space: pre-wrap;
+          }
+
+          body:before {
+            font-weight: bold;
+            content: "#{escape_css_content(message)}";
+          }
+
+          body:after {
+            content: "#{escape_css_content(backtrace)}";
+          }
+        CSS
+
+        [ 200, { "Content-Type" => "text/css; charset=utf-8", "Content-Length" => body.bytesize.to_s }, [ body ] ]
+      end
+
+      # Escape special characters for use inside a CSS content("...") string
+      def escape_css_content(content)
+        content.
+          gsub('\\', '\\\\005c ').
+          gsub("\n", '\\\\000a ').
+          gsub('"',  '\\\\0022 ').
+          gsub('/',  '\\\\002f ')
+      end
+
+      # Test if `?body=1` or `body=true` query param is set
+      def body_only?(env)
+        env["QUERY_STRING"].to_s =~ /body=(1|t)/
+      end
+
+      def cache_headers(env, etag)
+        headers = {}
+
+        # Set caching headers
+        headers["Cache-Control"] = "public"
+        headers["ETag"]          = %("#{etag}")
+
+        # If the request url contains a fingerprint, set a long
+        # expires on the response
+        if path_fingerprint(env["PATH_INFO"])
+          headers["Cache-Control"] << ", max-age=31536000"
+
+        # Otherwise set `must-revalidate` since the asset could be modified.
+        else
+          headers["Cache-Control"] << ", must-revalidate"
+          headers["Vary"] = "Accept-Encoding"
+        end
+
+        headers
+      end
+
+      def headers(env, asset, length)
+        headers = {}
+
+        # Set content length header
+        headers["Content-Length"] = length.to_s
+
+        # Set content type header
+        if type = asset.content_type
+          # Set charset param for text/* mime types
+          if type.start_with?("text/") && asset.charset
+            type += "; charset=#{asset.charset}"
+          end
+          headers["Content-Type"] = type
+        end
+
+        headers.merge(cache_headers(env, asset.etag))
+      end
+
+      # Gets ETag fingerprint.
+      #
+      #     "foo-0aa2105d29558f3eb790d411d7d8fb66.js"
+      #     # => "0aa2105d29558f3eb790d411d7d8fb66"
+      #
+      def path_fingerprint(path)
+        path[/-([0-9a-f]{7,128})\.[^.]+\z/, 1]
+      end
+  end
+end