view_component 2.81.0 → 2.83.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd53c4661f35fd92f4b4cf05bfcd8af23c5a4e6bd60b13a6af492393b75290fe
-  data.tar.gz: def906e9d722ffeb43fc79677c6c3613de4c9f7eec63eecc4d36f0feedfe5785
+  metadata.gz: 27bcac094fd171c4eb5c5ef2319372747f0efd62ca643fefdc2b544fd6efbd73
+  data.tar.gz: 49d93b90f2cf504ded99a6cfe0db780ec178131800a35eff210488da62aae673
 SHA512:
-  metadata.gz: 2f6c8525b8e0b1366e283b870deebc95ae0920c6910846a658590c8665239fbdc1c6f0ef1681c95ee811ac9d7a995a86f7cf6764cb61e636a8e8de305567f2a7
-  data.tar.gz: 447035b6780c59291f2014856703fc73d13838d4765f7185657e6f26b4be60937b561cafac7a994a68c12c68f10f7c0956948cd4c44355f3d0b875d85738e2d4
+  metadata.gz: 89a7f4702ccfc60f9128a99a3ff0ab5b35237fc0aaba860c01e705754330d557b3c380de369cd63db430f3d42d2cb2370a0677eee07ae73a61118921ec715994
+  data.tar.gz: 99c1af02c38bba37dc3f44b70818eadae73e307c4d05dd321585fb8cbdfed667367e34255fbbae11b9197fca731704e53a76b38abcfac93e45378c48a798cb43

data/app/controllers/view_components_system_test_controller.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
-require "rails/application_controller"
-
-class ViewComponentsSystemTestController < Rails::ApplicationController # :nodoc:
+class ViewComponentsSystemTestController < ActionController::Base # :nodoc:
   def system_test_entrypoint
     render file: "./tmp/view_components/#{params.permit(:file)[:file]}"
   end

data/docs/CHANGELOG.md

@@ -10,6 +10,22 @@ nav_order: 5
 
 ## main
 
+## 2.83.0
+
+* Ensure HTML output safety.
+
+    *Cameron Dutro*
+
+## 2.82.0
+
+* Revert "Avoid loading ActionView::Base during initialization (#1528)"
+
+    *Jon Rohan*
+
+* Fix tests using `with_rendered_component_path` with custom layouts.
+
+    *Ian Hollander*
+
 ## 2.81.0
 
 * Adjust the way response objects are set on the preview controller to work around a recent change in Rails main.

data/lib/view_component/base.rb

@@ -23,7 +23,7 @@ module ViewComponent
       #
       # @return [ViewComponent::Config]
       def config
-        @config ||= ActiveSupport::OrderedOptions.new
+        @config ||= ViewComponent::Config.defaults
       end
 
       # Replaces the entire config. You shouldn't need to use this directly
@@ -130,7 +130,12 @@ module ViewComponent
       before_render
 
       if render?
-        render_template_for(@__vc_variant).to_s + output_postamble
+        # Avoid allocating new string when output_postamble is blank
+        if output_postamble.blank?
+          safe_render_template_for(@__vc_variant).to_s
+        else
+          safe_render_template_for(@__vc_variant).to_s + safe_output_postamble
+        end
       else
         ""
       end
@@ -157,7 +162,7 @@ module ViewComponent
     #
     # @return [String]
     def output_postamble
-      ""
+      @@default_output_postamble ||= "".html_safe
     end
 
     # Called before rendering the component. Override to perform operations that
@@ -309,6 +314,38 @@ module ViewComponent
       @__vc_content_evaluated
     end
 
+    def maybe_escape_html(text)
+      return text if request && !request.format.html?
+      return text if text.blank?
+
+      if text.html_safe?
+        text
+      else
+        yield
+        html_escape(text)
+      end
+    end
+
+    def safe_render_template_for(variant)
+      if compiler.renders_template_for_variant?(variant)
+        render_template_for(variant)
+      else
+        maybe_escape_html(render_template_for(variant)) do
+          Kernel.warn("WARNING: The #{self.class} component rendered HTML-unsafe output. The output will be automatically escaped, but you may want to investigate.")
+        end
+      end
+    end
+
+    def safe_output_postamble
+      maybe_escape_html(output_postamble) do
+        Kernel.warn("WARNING: The #{self.class} component was provided an HTML-unsafe postamble. The postamble will be automatically escaped, but you may want to investigate.")
+      end
+    end
+
+    def compiler
+      @compiler ||= self.class.compiler
+    end
+
     # Set the controller used for testing components:
     #
     # ```ruby

data/lib/view_component/compiler.rb

@@ -16,6 +16,7 @@ module ViewComponent
     def initialize(component_class)
       @component_class = component_class
       @redefinition_lock = Mutex.new
+      @variants_rendering_templates = Set.new
     end
 
     def compiled?
@@ -61,6 +62,7 @@ module ViewComponent
         # Remove existing compiled template methods,
         # as Ruby warns when redefining a method.
         method_name = call_method_name(template[:variant])
+        @variants_rendering_templates << template[:variant]
 
         redefinition_lock.synchronize do
           component_class.silence_redefinition_of_method(method_name)
@@ -81,6 +83,10 @@ module ViewComponent
       CompileCache.register(component_class)
     end
 
+    def renders_template_for_variant?(variant)
+      @variants_rendering_templates.include?(variant)
+    end
+
     private
 
     attr_reader :component_class, :redefinition_lock

data/lib/view_component/engine.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
 require "rails"
-require "view_component/config"
+require "view_component/base"
 
 module ViewComponent
   class Engine < Rails::Engine # :nodoc:
-    config.view_component = ViewComponent::Config.defaults
+    config.view_component = ViewComponent::Base.config
 
     rake_tasks do
       load "view_component/rails/tasks/view_component.rake"
@@ -14,6 +14,9 @@ module ViewComponent
     initializer "view_component.set_configs" do |app|
       options = app.config.view_component
 
+      %i[generate preview_controller preview_route show_previews_source].each do |config_option|
+        options[config_option] ||= ViewComponent::Base.public_send(config_option)
+      end
       options.instrumentation_enabled = false if options.instrumentation_enabled.nil?
       options.render_monkey_patch_enabled = true if options.render_monkey_patch_enabled.nil?
       options.show_previews = (Rails.env.development? || Rails.env.test?) if options.show_previews.nil?
@@ -36,8 +39,6 @@ module ViewComponent
 
     initializer "view_component.enable_instrumentation" do |app|
       ActiveSupport.on_load(:view_component) do
-        Base.config = app.config.view_component
-
         if app.config.view_component.instrumentation_enabled.present?
           # :nocov:
           ViewComponent::Base.prepend(ViewComponent::Instrumentation)

data/lib/view_component/version.rb

@@ -3,7 +3,7 @@
 module ViewComponent
   module VERSION
     MAJOR = 2
-    MINOR = 81
+    MINOR = 83
     PATCH = 0
 
     STRING = [MAJOR, MINOR, PATCH].join(".")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: view_component
 version: !ruby/object:Gem::Version
-  version: 2.81.0
+  version: 2.83.0
 platform: ruby
 authors:
 - ViewComponent Team
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-10 00:00:00.000000000 Z
+date: 2024-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -409,7 +409,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.32
+rubygems_version: 3.4.5
 signing_key:
 specification_version: 4
 summary: A framework for building reusable, testable & encapsulated view components