studio-engine 0.74.0 → 0.74.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a6961114226763cef0af1b1500c982609412516d95c78c0985f63012882e92e
-  data.tar.gz: 4694c467547769140156eac7824a72fd0d510d84f0c30637cba40a87c3344187
+  metadata.gz: d056d9eddc4bd13c863b5ec0f3e239e7591fc16ddd2170ac5192537f5a190326
+  data.tar.gz: 289b7050571718689aa567db5f0434be21c41ee7074b4b49d26969f16b07a815
 SHA512:
-  metadata.gz: 509affb42c8bf58a11289e0e0c16cfb2b298625456284b0d56775373fba4ac225c9bc6ba6bd695acb028a44a517836989204dfbb97bd96b1ed69ca2f1e9e7023
-  data.tar.gz: 36ed3258453f8025f591335348f989e333a6d805de78979e325c2a005a197d74c17f04995c6fcf6776bbebb2dae9d4404c483f0effe1e095bf29f2e02947ca83
+  metadata.gz: 15c2e97be72e8fe2e4e67719a569f6d456f82e961fd36b11d0c5062d8ace97836316398eef5058bf9436cdec7ec4ed33aca31ca7decf70bcfe3569dd8665e693
+  data.tar.gz: 6dd53cf3747fdb36271afaea5a76c0dc2ee615e25f394083b3219476a5222991999edf97474e1022e9f2f584350ba05b04cbfaa01d5fe0f28ce2995f3a06d6fa

data/CHANGELOG.md

@@ -6,6 +6,111 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Fixed
 
+- **A quote in a host local can no longer close an Alpine attribute and turn the
+  rest of the element into markup.** Four partials built an attribute — its OWN
+  QUOTES included — as a Ruby String and marked it `html_safe`, which is the one
+  shape ERB's attribute escaping can never reach: the marking tells ERB to stand
+  down, so a double quote in the local ended the attribute and the HTML parser read
+  the remainder as new attributes. Measured, not reasoned: one hostile
+  `auto_redirect_seconds` turned the success card's root into an element carrying
+  attributes named `quote"`, `\`, `<` and `script`, with its `class` swallowed
+  whole. This is strictly worse than the JS-string-literal class fixed in
+  *Host-supplied locals can no longer brick an Alpine component* below, which at
+  least stayed inside its attribute.
+
+  **THE REPAIR IS NOT ESCAPING.** These locals are Alpine EXPRESSIONS by contract —
+  the caller is handing the engine JS on purpose — so `escape_javascript` would
+  break the feature it was protecting. The partials stop writing the quotes and let
+  ActionView write them: `tag.attributes("x-init": expr.html_safe)`. `tag_option`
+  runs `gsub('"', "&quot;")` on the finished value UNCONDITIONALLY, on the line
+  AFTER the escape branch it skips for a marked String, so the expression keeps its
+  apostrophes, angle brackets and backslashes byte-for-byte and still cannot end the
+  attribute. `blocks/_rail_row:112` already did exactly this and was the worked
+  example.
+
+  **WHAT MOVED — twelve splices in four files.** `blocks/_success_card` (the
+  Ruby-built `x-data` countdown object, and the `x-init` call list that splices
+  `auto_redirect_url_key`), `blocks/_processing_card` (one assembled `x-data`/`x-init`
+  pair carrying TWO locals — `resolve_expr` and `min_duration`, which only LOOKS
+  numeric because just its guard calls `.to_i`), `blocks/_leveling_activity` (the
+  Next Quest `@click`, plus `minlength` / `maxlength` / `pattern` / `title` on the
+  form input), and `components/_sidebar_panel` (`@click.outside`,
+  `@keydown.escape.window` and `@turbo:before-cache.window` on the root of the shell
+  every link menu hangs from). No default or in-repo value contains a character tag
+  encoding touches, so every shipped page renders byte-for-byte what it did — a
+  render-level test asserts that directly.
+
+  **THE MARKING NOW FOLLOWS WHAT THE VALUE IS.** Code stays `html_safe` and reaches
+  the browser unchanged; CONTENT does not. The four input constraint attributes are
+  a length, a regex and a tooltip, so they take the full escaping a content
+  attribute is owed — which also closes a second latent bug the marking carried, a
+  bare `&` in a `title` or `pattern` reaching the browser as the start of an entity.
+
+  **TWO OF THE SIX SITES ON THE ORIGINAL LIST WERE ALREADY SAFE and were left
+  alone.** `blocks/_rail_row:112` routes its handler through `content_tag`, and
+  `board/_card_shell:54` escapes both halves of its arbitrary-attribute passthrough
+  through ERB. Both were re-verified by rendering them with a hostile value, not by
+  reading them. Filing a fix for either would have bought a guard that can never
+  bite.
+
+  **HOW THE GUARDS ASSERT.** `test/views/assembled_attribute_locals_test.rb` reads
+  every seam through Nokogiri's HTML5 parser — the algorithm a browser runs — and
+  asserts on the DECODED attribute value, never on the template's output bytes,
+  because ERB entity-escapes an unmarked value too and a raw-markup structural
+  assertion therefore cannot fail. (HTML5 rather than HTML4 on purpose: HTML4
+  silently drops an `@click`, so every Alpine assertion made through it reads nil on
+  a correct page.) Each seam makes two claims — the element carries exactly the
+  attributes a benign value gives it, and the browser recovers the whole expression
+  — plus a non-vacuity control that fails if the partial ever stops splicing the
+  local at all. All twelve were mutated back to their assembled form ONE AT A TIME
+  and each was killed by its own test; the shared `_processing_card` call was also
+  mutated per-local. `test/lib/studio/attribute_encoding_contract_test.rb` pins the
+  ActionView property the whole repair stands on, so a future Rails moving that
+  `gsub` reports itself as one dependency change rather than twelve partial bugs.
+
+  **STILL OPEN, and named rather than quietly folded in:**
+  `studio/mailers/_layered_banner:69,100` assemble `background=` and `bgcolor=` the
+  same way. Same shape, different family — email attributes, no Alpine, no JS — so
+  they are left for their own ticket rather than widened into this one.
+
+- **The Rails guard sweep really is finished now, and a test says so instead of a
+  comment.** Fixing `Studio::S3` left THREE sites still guarding a Rails method
+  call on a bare `defined?(Rails)`: both keyword defaults in
+  `Studio::MailTransport.configure!` (`rails_env:` reading `Rails.env`, `logger:`
+  reading `Rails.logger`) and the developer-desk route guard in
+  `Studio.routes`. All three now ask `Rails.respond_to?` first.
+
+  **THE MAIL TRANSPORT ONE WAS ARMED, not theoretical.** `lib/studio.rb` requires
+  `studio/js_literal` (line 11) — whose first line is `require "action_view"`,
+  which is what defines the namespace-only `module Rails` — BEFORE it requires
+  `studio/mail_transport` (line 25). Measured at this branch's head, a bare
+  `Studio::MailTransport.configure!(env: {}, action_mailer: mailer)` died with
+  `NoMethodError: undefined method 'env' for module Rails`. No shipped app can
+  reach it (every host configures mail from an initializer, where `Rails.env`
+  exists, and all four in-repo callers pass `rails_env:` explicitly) — the cost
+  lands on the next gem unit test that omits the kwarg, which is the same
+  half-hour the `Studio::S3` fix already paid once.
+
+  **THE TWO DEFAULTS ARE SEPARATE STRAGGLERS**, and the first hid the second: Ruby
+  evaluates only the defaults a caller omitted, and `rails_env:` is declared above
+  `logger:`, so a bare call raised out of `Rails.env` and never reached
+  `Rails.logger`. `test/lib/studio/mail_transport_namespace_only_rails_test.rb`
+  supplies one argument and omits the other in each test, so each guard is pinned
+  independently rather than behind its neighbour.
+
+  **THE ROUTE GUARD IS PINNED BY A SCAN, deliberately.** `Studio.routes` only
+  loads inside a real Rails application, where `Rails.env` exists — so the
+  condition under test cannot be constructed where the file loads, and no
+  behavioural test can reach it. `test/lib/studio/rails_guard_sweep_test.rb` is
+  the tree-wide net instead, and it asserts both that it really read the files and
+  that its predicate still flags the original shape, so it cannot pass for free.
+
+  **The completeness claim itself was the other half of the bug.** `lib/studio/s3.rb`
+  and this changelog both said that fix "was the straggler" — while one of the
+  remaining three sat in `lib/studio.rb`, the very file the comment cited as
+  already clean. Both claims are corrected, and the comment now points at the test
+  rather than restating that the sweep is done.
+
 - **The app census in these comments was short by the most important app.** Ten
   sites said this engine is mounted by SIX apps and that THREE of them bundle no
   `solana-studio`. Measured 2026-09-07 by the criterion that reproduces it — a
@@ -363,7 +468,9 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
   singleton methods, so that guard reads true and the next call raises
   `NoMethodError: undefined method 'env' for module Rails`. It now asks
   `Rails.respond_to?(:env)`, which is the form `lib/studio.rb` already uses in three
-  places; this was the straggler. No shipped app can reach it — every host boots a
+  places. **This entry originally called it "the straggler"; that was wrong** —
+  three more sites carried the bare form, swept in *The Rails guard sweep really is
+  finished now* above. No shipped app can reach it — every host boots a
   real application — but the engine's own pure-Ruby unit lane can, and it did:
   adding one `require` for a file that needs `action_view` turned an untouched
   `email_catalog_test` red with two errors about email uploads.

data/app/views/components/_sidebar_panel.html.erb

@@ -34,9 +34,19 @@
   <% if id.present? %>id="<%= id %>"<% end %>
   x-cloak
   x-show="<%= open %>"
-  <%= %(#{outside_action.present? ? "@click.outside=\"#{outside_action}\"" : ""}).html_safe %>
-  <%= %(#{escape_action.present? ? "@keydown.escape.window=\"#{escape_action}\"" : ""}).html_safe %>
-  <%= %(#{close_action.present? ? "@turbo:before-cache.window=\"#{close_action}\"" : ""}).html_safe %>
+  <%# THE THREE DISMISSAL HANDLERS, EMITTED BY tag.attributes. Each was built as
+      %(@name="#{action}").html_safe — the attribute's OWN quotes assembled in Ruby
+      and then marked safe, which is the one shape ERB's escaping can never reach. A
+      double quote in any of the three actions closed the attribute and everything
+      after it became markup on the panel's root element.
+
+      The actions stay html_safe: they are Alpine EXPRESSIONS the host wrote (see the
+      @click at the close button below, and `open` above). tag_option's
+      gsub('"', "&quot;") runs on the finished value whether or not it is marked, so
+      the expression reaches Alpine unchanged and cannot end the attribute. %>
+  <%= tag.attributes("@click.outside": outside_action.html_safe) if outside_action.present? %>
+  <%= tag.attributes("@keydown.escape.window": escape_action.html_safe) if escape_action.present? %>
+  <%= tag.attributes("@turbo:before-cache.window": close_action.html_safe) if close_action.present? %>
   x-transition:enter="transition ease-out duration-300"
   x-transition:enter-start="translate-x-full"
   x-transition:enter-end="translate-x-0"

data/app/views/studio/board/_card_shell.html.erb

@@ -32,6 +32,20 @@
     attrs:         Hash of extra root attributes ({ "x-data" => "…", "data-foo" => 1 }),
                    values are HTML-escaped — the rebase seam for a card that carries
                    its own Alpine/data-* on the root.
+
+                   NOT A CANDIDATE FOR THE ASSEMBLED-ATTRIBUTE SWEEP: nothing here is
+                   marked html_safe, so ERB escapes both halves. A double quote in a
+                   VALUE becomes " and the parser decodes it back — the value half
+                   cannot break out. Verified 2026-09-08 by rendering, not reading.
+
+                   THE NAME HALF IS A DIFFERENT QUESTION, and entity decoding is not
+                   what answers it. html_escape does not touch a SPACE, and a space
+                   ENDS an attribute name: a name of `data-y=1 x-init` renders as
+                   `data-y=1 x-init="…"` and the parser builds a real SECOND attribute
+                   — measured, an injected x-init Alpine will run. What makes this seam
+                   safe today is that nothing passes attrs: at all — zero call sites in
+                   studio-engine, turf-monster and mcritchie-studio. Its first caller
+                   owes an allow-list on the NAME before this emits it.
 %>
 <%
   id            = local_assigns.fetch(:id)

data/app/views/studio/modals/blocks/_leveling_activity.html.erb

@@ -138,10 +138,23 @@
           <% if input %>
             <input type="<%= input_type %>" x-model="value" class="input-field w-full"
                    placeholder="<%= placeholder %>"
-                   <%= "minlength=\"#{min_length}\"".html_safe if min_length.to_i.positive? %>
-                   <%= "maxlength=\"#{max_length}\"".html_safe if max_length.present? %>
-                   <%= "pattern=\"#{pattern}\"".html_safe if pattern.present? %>
-                   <%= "title=\"#{pattern_title}\"".html_safe if pattern_title.present? %>
+                   <%# FOUR CONSTRAINT ATTRIBUTES, ENCODED AND — unlike the Alpine
+                       handlers in this file — DELIBERATELY NOT html_safe. Each was
+                       assembled as `attr="#{value}"`.html_safe, which handed ERB a
+                       String it must not touch, so a double quote in any of the four
+                       closed the attribute and the rest became markup. minlength
+                       looks numeric and is not: only the GUARD calls .to_i, the
+                       interpolation splices the local raw.
+
+                       These are CONTENT, not code — a length, a regex, a tooltip
+                       sentence — so they take the full escaping a content attribute
+                       is owed and the parser decodes it back. That also repairs a
+                       second latent bug the marking carried: a bare & in a title or
+                       pattern used to reach the browser as the start of an entity. %>
+                   <%= tag.attributes(minlength: min_length) if min_length.to_i.positive? %>
+                   <%= tag.attributes(maxlength: max_length) if max_length.present? %>
+                   <%= tag.attributes(pattern: pattern) if pattern.present? %>
+                   <%= tag.attributes(title: pattern_title) if pattern_title.present? %>
                    autofocus>
           <% end %>
           <% if consent_label.present? %>
@@ -180,7 +193,12 @@
       </div>
 
       <% if next_label.present? && next_open.present? %>
-        <button type="button" @click="<%= next_open %>" class="btn btn-primary btn-lg w-full">
+        <%# next_open is html_safe (:102) because it is a developer-authored Alpine
+            EXPRESSION — so ERB steps aside here and a double quote in it used to
+            close the @click attribute outright. tag.attributes writes the quotes and
+            entity-encodes any of its own that appear in the value, leaving the
+            expression otherwise byte-identical. %>
+        <button type="button" <%= tag.attributes("@click": next_open) %> class="btn btn-primary btn-lg w-full">
           <%= next_label %>
         </button>
       <% end %>

data/app/views/studio/modals/blocks/_processing_card.html.erb

@@ -41,8 +41,27 @@
   # JS sides of the convention agree on the same floor.
   min_duration = local_assigns[:min_duration] || 1400
   resolve_expr = local_assigns[:resolve_expr]
+
+  # THE AUTO-RESOLVE PAIR, ENCODED RATHER THAN ASSEMBLED. This line used to build
+  # ` x-data="{}" x-init="…"` as one html_safe String, quotes and all, so ERB had
+  # nothing left to escape: a double quote in EITHER local — min_duration as much as
+  # resolve_expr, since min_duration is interpolated raw and only its GUARD calls
+  # .to_i — closed the attribute and turned the remainder into markup.
+  #
+  # tag.attributes writes the quotes instead. The x-init value stays html_safe
+  # because it is CODE the caller handed us, and tag_option's unconditional
+  # gsub('"', """) still fires on an html_safe value, so the JS arrives intact
+  # and the attribute cannot end early. safe_join supplies the separating space
+  # without a second hand-marked String.
+  resolve_attrs =
+    if resolve_expr
+      safe_join([" ", tag.attributes(
+        "x-data": "{}",
+        "x-init": "window.StudioModals.holdAtLeast(#{min_duration}).then(() => { #{resolve_expr} })".html_safe
+      )])
+    end
 %>
-<div class="text-center py-6"<%= " x-data=\"{}\" x-init=\"window.StudioModals.holdAtLeast(#{min_duration}).then(() => { #{resolve_expr} })\"".html_safe if resolve_expr %>>
+<div class="text-center py-6"<%= resolve_attrs %>>
   <div class="mx-auto <%= spinner_class %> rounded-full border-<%= color %>/30 border-t-<%= color %> animate-spin mb-5"></div>
   <% if local_assigns[:title_key] %>
     <p class="text-base font-bold text-heading mb-1" x-text="<%= title_key %>"></p>

data/app/views/studio/modals/blocks/_success_card.html.erb

@@ -122,9 +122,26 @@
   init_calls = []
   init_calls << "fireConfetti()" if fire_confetti
   init_calls << "startCountdown(#{local_assigns[:auto_redirect_url_key]})" if has_redirect
+  init_expr = init_calls.join("; ").html_safe
 %>
-<div x-data="<%= data_attr %>"
-     <%= "x-init=\"#{init_calls.join('; ')}\"".html_safe if init_calls.any? %>
+<%# BOTH ALPINE ATTRIBUTES ARE EMITTED BY tag.attributes, NOT ASSEMBLED BY HAND.
+    Each carries Ruby-built JS that splices a host local — redirect_secs into the
+    x-data object, auto_redirect_url_key into startCountdown() — and both blobs are
+    html_safe, because they are CODE and the caller is owed the JS it wrote.
+
+    THAT MARKING USED TO BE THE HOLE. html_safe tells ERB to step aside, so a double
+    quote in either local closed the ATTRIBUTE and everything after it became markup:
+    x-data="{ _remaining: it's a " quote" …  — measured, not reasoned.
+
+    tag.attributes closes it without touching the JS. ActionView's tag_option runs
+    gsub('"', "&quot;") on the finished value UNCONDITIONALLY, outside the escape
+    branch it skips for an html_safe string (actionview tag_helper.rb, the line after
+    the escape ternary), so the attribute cannot be closed early and the HTML parser
+    decodes the entity back before Alpine ever sees it. Every other character reaches
+    the attribute byte-for-byte as it does today. blocks/_rail_row:112 is the same
+    move on a whole tag and its comment carries the rest of the reasoning. %>
+<div <%= tag.attributes("x-data": data_attr) %>
+     <%= tag.attributes("x-init": init_expr) if init_calls.any? %>
      class="text-center py-6">
 
   <%# Icon — emoji takes priority over the default circular green check %>

data/lib/studio/js_literal.rb

@@ -43,6 +43,19 @@ module Studio
   # safe). The name says `in_attribute` so that the next person reaching for this in
   # a <script> has to stop and notice the difference.
   #
+  # AND IT IS THE WRONG REPAIR FOR AN ATTRIBUTE THE PARTIAL ASSEMBLES ITSELF —
+  # `<%= "x-init=\"#{expr}\"".html_safe %>`, where the attribute's OWN QUOTES are
+  # built in Ruby. Nothing here helps: escaping the value would break the Alpine
+  # EXPRESSION the caller deliberately handed the engine, and the marking has already
+  # told ERB to stand down, so a double quote closes the ATTRIBUTE and the remainder
+  # is parsed as MARKUP. The repair is to stop writing the quotes and let ActionView
+  # write them — `tag.attributes("x-init": expr.html_safe)` — because tag_option
+  # quote-escapes the finished value UNCONDITIONALLY, outside the escape branch it
+  # skips for a marked String. The expression survives byte-for-byte and cannot end
+  # the attribute. modals/blocks/_rail_row:112 and components/_sidebar_panel carry
+  # the worked examples; test/lib/studio/attribute_encoding_contract_test.rb pins the
+  # ActionView behaviour the whole thing rests on.
+  #
   # AND IT IS THE WRONG REPAIR FOR IDENTIFIER POSITION. A local spliced in as a bare
   # NAME — `$store.<%= modal_store %>.close()` — must be VALIDATED, never escaped:
   # escape_javascript also escapes `$`, so a legitimate store name like `dsModals$2`

data/lib/studio/mail_transport.rb

@@ -6,9 +6,9 @@ module Studio
 
     class << self
       def configure!(env: ENV,
-                     rails_env: defined?(Rails) ? Rails.env : "development",
+                     rails_env: defined?(Rails) && Rails.respond_to?(:env) ? Rails.env : "development",
                      action_mailer: defined?(ActionMailer) ? ActionMailer::Base : nil,
-                     logger: defined?(Rails) ? Rails.logger : nil,
+                     logger: defined?(Rails) && Rails.respond_to?(:logger) ? Rails.logger : nil,
                      mailer_from: defined?(Studio) && Studio.respond_to?(:mailer_from) ? Studio.mailer_from : nil,
                      resend_loader: method(:load_resend!),
                      resend_configurer: method(:configure_resend!))

data/lib/studio/s3.rb

@@ -128,10 +128,18 @@ module Studio
         # before any Rails APPLICATION does — defines a namespace-only `module
         # Rails` with no singleton methods on it. Against that, a bare
         # `defined?(Rails)` reads TRUE and the very next call dies with
-        # NoMethodError: undefined method `env` for module Rails. lib/studio.rb
-        # already spells the guard this way in three places; this was the
-        # straggler, and it turned an unrelated green suite red the first time a
-        # unit test pulled action_view in.
+        # NoMethodError: undefined method `env` for module Rails. It turned an
+        # unrelated green suite red the first time a unit test pulled action_view
+        # in.
+        #
+        # THIS WAS NOT THE LAST ONE, though it was described that way when it
+        # landed. Three sites still carried the bare form afterwards — both
+        # keyword defaults in lib/studio/mail_transport.rb and the developer-desk
+        # route guard in lib/studio.rb — and the claim that the sweep was finished
+        # is how they survived a second review. The whole tree is swept now, and
+        # test/lib/studio/rails_guard_sweep_test.rb is what keeps it that way; do
+        # not restate completeness here, because a comment cannot notice the next
+        # straggler and that test can.
         defined?(Rails) && Rails.respond_to?(:env) && Rails.env&.production? ? "production" : "dev"
       end
     end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.74.0"
+  VERSION = "0.74.1"
 end

data/lib/studio.rb

@@ -856,7 +856,7 @@ module Studio
       # Developer-desk tools. Drawn outside production, and each controller
       # re-checks Studio.local_tool_enabled? per request (loopback only) — the
       # route being absent is the outer gate, not the only one.
-      unless defined?(Rails) && Rails.env.production?
+      unless defined?(Rails) && Rails.respond_to?(:env) && Rails.env.production?
         get "_studio/local_emails", to: "studio/local_emails#index", as: :studio_local_emails
         get "_studio/local_review", to: "studio/local_reviews#show",  as: :studio_local_review
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.74.0
+  version: 0.74.1
 platform: ruby
 authors:
 - Alex McRitchie