view_component 2.83.0 → 3.21.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 27bcac094fd171c4eb5c5ef2319372747f0efd62ca643fefdc2b544fd6efbd73
-  data.tar.gz: 49d93b90f2cf504ded99a6cfe0db780ec178131800a35eff210488da62aae673
+  metadata.gz: 24be9824d2f5208831e8de57930415019c781a1245224659efb9258372dcafbc
+  data.tar.gz: 33182c814b14959c85370e274619a3da70ea19906dd40c8d0be0cd12c9f16a2b
 SHA512:
-  metadata.gz: 89a7f4702ccfc60f9128a99a3ff0ab5b35237fc0aaba860c01e705754330d557b3c380de369cd63db430f3d42d2cb2370a0677eee07ae73a61118921ec715994
-  data.tar.gz: 99c1af02c38bba37dc3f44b70818eadae73e307c4d05dd321585fb8cbdfed667367e34255fbbae11b9197fca731704e53a76b38abcfac93e45378c48a798cb43
+  metadata.gz: 0d856adb4c86acc808277c7fcc17291b41328b932b53991db003dccab6e23f2a02177e200065e78d3004f8233df98b0926202138b8b536f67c8f848f876231e2
+  data.tar.gz: a7c6b583fd6eaf4bdb20cdc9d7ca86ed0a5e818e90d1099c5fd799d2127122c058d5d58285251ea0713aeb73d719cabad8ab971e994e0f658767235089953dfd

data/app/controllers/concerns/view_component/preview_actions.rb

@@ -11,6 +11,10 @@ module ViewComponent
       before_action :require_local!, unless: :show_previews?
 
       content_security_policy(false) if respond_to?(:content_security_policy)
+
+      # Including helpers here ensures that we're loading the
+      # latest version of helpers if code-reloading is enabled
+      helper :all if include_all_helpers
     end
 
     def index
@@ -55,7 +59,7 @@ module ViewComponent
     def find_preview
       candidates = []
       params[:path].to_s.scan(%r{/|$}) { candidates << Regexp.last_match.pre_match }
-      preview = candidates.detect { |candidate| ViewComponent::Preview.exists?(candidate) }
+      preview = candidates.sort_by(&:length).reverse_each.detect { |candidate| ViewComponent::Preview.exists?(candidate) }
 
       if preview
         @preview = ViewComponent::Preview.find(preview)

data/app/controllers/view_components_system_test_controller.rb

@@ -1,7 +1,30 @@
 # frozen_string_literal: true
 
 class ViewComponentsSystemTestController < ActionController::Base # :nodoc:
+  before_action :validate_test_env
+  before_action :validate_file_path
+
+  def self.temp_dir
+    @_tmpdir ||= FileUtils.mkdir_p("./tmp/view_components/").first
+  end
+
   def system_test_entrypoint
-    render file: "./tmp/view_components/#{params.permit(:file)[:file]}"
+    render file: @path
+  end
+
+  private
+
+  def validate_test_env
+    raise ViewComponent::SystemTestControllerOnlyAllowedInTestError unless Rails.env.test?
+  end
+
+  # Ensure that the file path is valid and doesn't target files outside
+  # the expected directory (e.g. via a path traversal or symlink attack)
+  def validate_file_path
+    base_path = ::File.realpath(self.class.temp_dir)
+    @path = ::File.realpath(params.permit(:file)[:file], base_path)
+    unless @path.start_with?(base_path)
+      raise ViewComponent::SystemTestControllerNefariousPathError
+    end
   end
 end

data/app/helpers/preview_helper.rb

@@ -1,6 +1,10 @@
 # frozen_string_literal: true
 
 module PreviewHelper
+  # :nocov:
+  include ActionView::Helpers::AssetUrlHelper if Rails.version.to_f < 6.1
+  # :nocov:
+
   AVAILABLE_PRISM_LANGUAGES = %w[ruby erb haml]
   FALLBACK_LANGUAGE = "ruby"
 
@@ -10,6 +14,14 @@ module PreviewHelper
     render "preview_source"
   end
 
+  def prism_css_source_url
+    serve_static_preview_assets? ? asset_path("prism.css", skip_pipeline: true) : "https://cdn.jsdelivr.net/npm/prismjs@1.28.0/themes/prism.min.css"
+  end
+
+  def prism_js_source_url
+    serve_static_preview_assets? ? asset_path("prism.min.js", skip_pipeline: true) : "https://cdn.jsdelivr.net/npm/prismjs@1.28.0/prism.min.js"
+  end
+
   def find_template_data(lookup_context:, template_identifier:)
     template = lookup_context.find_template(template_identifier)
 
@@ -18,6 +30,7 @@ module PreviewHelper
         source: template.source,
         prism_language_name: prism_language_name_by_template(template: template)
       }
+    # :nocov:
     else
       # Fetch template source via finding it through preview paths
       # to accomodate source view when exclusively using templates
@@ -31,10 +44,8 @@ module PreviewHelper
         path =~ /#{template_identifier}*.(html)/
       end
 
-      # In-case of a conflict due to multiple template files with
-      # the same name
-      raise "found 0 matches for templates for #{template_identifier}." if matching_templates.empty?
-      raise "found multiple templates for #{template_identifier}." if matching_templates.size > 1
+      raise ViewComponent::NoMatchingTemplatesForPreviewError.new(template_identifier) if matching_templates.empty?
+      raise ViewComponent::MultipleMatchingTemplatesForPreviewError.new(template_identifier) if matching_templates.size > 1
 
       template_file_path = matching_templates.first
       template_source = File.read(template_file_path)
@@ -45,6 +56,7 @@ module PreviewHelper
         prism_language_name: prism_language_name
       }
     end
+    # :nocov:
   end
 
   private
@@ -57,6 +69,7 @@ module PreviewHelper
     language
   end
 
+  # :nocov:
   def prism_language_name_by_template_path(template_file_path:)
     language = template_file_path.gsub(".html", "").split(".").last
 
@@ -64,4 +77,9 @@ module PreviewHelper
 
     language
   end
+  # :nocov:
+
+  def serve_static_preview_assets?
+    ViewComponent::Base.config.show_previews && Rails.application.config.public_file_server.enabled
+  end
 end

data/app/views/view_components/_preview_source.html.erb

@@ -1,4 +1,4 @@
-<link href="<%= asset_path('prism.css', skip_pipeline: true) %>" media="screen" rel="stylesheet" type="text/css">
+<link href="<%= prism_css_source_url %>" media="screen" rel="stylesheet" type="text/css">
 <div class="view-component-source-example">
   <h2>Source:</h2>
   <pre class="source">
@@ -14,4 +14,4 @@
     <% end %>
   </pre>
 </div>
-<script type="text/javascript" src="<%= asset_path('prism.min.js', skip_pipeline: true) %>"></script>
+<script type="text/javascript" src="<%= prism_js_source_url %>"></script>