view_component 3.0.0.rc1 → 3.0.0.rc3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 18fc4d884af4512c13d7b1f4184c59e57859a8d797451ec0b2063ff425a7d357
-  data.tar.gz: 8da2e96b470f354b1d09f1b461506e64cca4345522f2b9ddfa4143ee5bf0627c
+  metadata.gz: f88375c08b20eb604992d315362fbdf6e0654fd87d7766d1ac404daecb1b57c9
+  data.tar.gz: 5f37ce63b609f5ff542a7e7c4629c952e3a02fc4e2ffc83df28aee86ff5d40cd
 SHA512:
-  metadata.gz: 9750449d8d23a150a099e8c3fa6620eb7ba03adecfeefaa9e4f0c3ce463353d9918f1212971ae214557675eae367232ccd96308e89f11831259efa1000b8fa22
-  data.tar.gz: 7b1a6852d060bea82ab51e69f3328d95dd6491d11fb2f88b84fa8b235fb17a83670a05764c8df116127017332fd3a6f9d76d9205fd5bcc31d925ec9e39a573b8
+  metadata.gz: 425107ab124527b5199b4174437c17a0f2dae4447b77a9393f68dd8c7a88517e25a3100fa0ed4cf6190d7e3b38390c6fd5cf48718753a53169f72dfe50ae5d12
+  data.tar.gz: b1642a727d8a586d8dec7a2e7075b570f5ccb20cee0b3c41037ac0b119adc6261ca1d1fb1dea0558f4bb40a0a45ba73b111ce4816a85be6798e3fb2bfaf76daf

data/app/controllers/view_components_system_test_controller.rb

@@ -1,7 +1,28 @@
 # frozen_string_literal: true
 
 class ViewComponentsSystemTestController < ActionController::Base # :nodoc:
+  TEMP_DIR = FileUtils.mkdir_p("./tmp/view_components/").first
+
+  before_action :validate_test_env
+  before_action :validate_file_path
+
   def system_test_entrypoint
-    render file: "./tmp/view_components/#{params.permit(:file)[:file]}"
+    render file: @path
+  end
+
+  private
+
+  def validate_test_env
+    raise "ViewComponentsSystemTestController must only be called in a test environment" unless Rails.env.test?
+  end
+
+  # Ensure that the file path is valid and doesn't target files outside
+  # the expected directory (e.g. via a path traversal or symlink attack)
+  def validate_file_path
+    base_path = ::File.realpath(TEMP_DIR)
+    @path = ::File.realpath(params.permit(:file)[:file], base_path)
+    unless @path.start_with?(base_path)
+      raise ArgumentError, "Invalid file path"
+    end
   end
 end

data/docs/CHANGELOG.md

@@ -10,6 +10,82 @@ nav_order: 5
 
 ## main
 
+## v3.0.0.rc3
+
+Run into an issue with this release candidate? [Let us know](https://github.com/ViewComponent/view_component/issues/1629).
+
+* Fix typos in generator docs.
+
+    *Sascha Karnatz*
+
+* Add `TestHelpers#vc_test_controller`.
+
+    *Joel Hawksley*
+
+* Document `config.view_component.capture_compatibility_patch_enabled` as option for the known incompatibilities with Rails form helpers.
+
+    *Tobias L. Maier*
+
+* Add support for experimental inline templates.
+
+    *Blake Williams*
+
+* Expose `translate` and `t` I18n methods on component classes.
+
+    *Elia Schito*
+
+* Protect against Arbitrary File Read edge case in `ViewComponentsSystemTestController`.
+
+    *Nick Malcolm*
+
+## v3.0.0.rc2
+
+Run into an issue with this release? [Let us know](https://github.com/ViewComponent/view_component/issues/1629).
+
+* BREAKING: Rename `SlotV2` to `Slot` and `SlotableV2` to `Slotable`.
+
+    *Joel Hawksley*
+
+* BREAKING: Incorporate `PolymorphicSlots` into `Slotable`. To migrate, remove any references to `PolymorphicSlots` as they are no longer necessary.
+
+    *Joel Hawksley*
+
+* BREAKING: Rename private TestHelpers#controller, #build_controller, #request, and #preview_class to avoid conflicts. Note: While these methods were undocumented and marked as private, they was easily accessible in tests. As such, we're cautiously considering this to be a breaking change.
+
+    *Joel Hawksley*
+
+* Avoid loading ActionView::Base during Rails initialization. Originally submitted in #1528.
+
+    *Jonathan del Strother*
+
+* Improve documentation of known incompatibilities with Rails form helpers.
+
+    *Tobias L. Maier*
+
+* Remove dependency on environment task from `view_component:statsetup`.
+
+    *Svetlin Simonyan*
+
+* Add experimental `config.view_component.capture_compatibility_patch_enabled` option resolving rendering issues related to forms, capture, turbo frames, etc.
+
+    *Blake Williams*
+
+* Add `#content?` method that indicates if content has been passed to component.
+
+    *Joel Hawksley*
+
+* Added example of a custom preview controller.
+
+    *Graham Rogers*
+
+* Add Krystal to list of companies using ViewComponent.
+
+     *Matt Bearman*
+
+* Add Mon Ami to list of companies using ViewComponent.
+
+    *Ethan Lee-Tyson*
+
 ## 3.0.0.rc1
 
 1,000+ days and 100+ releases later, the 200+ contributors to ViewComponent are proud to ship v3.0.0!

data/lib/view_component/base.rb

@@ -6,9 +6,8 @@ require "view_component/collection"
 require "view_component/compile_cache"
 require "view_component/compiler"
 require "view_component/config"
-require "view_component/polymorphic_slots"
 require "view_component/preview"
-require "view_component/slotable_v2"
+require "view_component/slotable"
 require "view_component/translatable"
 require "view_component/with_content_helper"
 
@@ -21,7 +20,7 @@ module ViewComponent
       #
       # @return [ViewComponent::Config]
       def config
-        @config ||= ViewComponent::Config.defaults
+        @config ||= ActiveSupport::OrderedOptions.new
       end
 
       # Replaces the entire config. You shouldn't need to use this directly
@@ -29,8 +28,7 @@ module ViewComponent
       attr_writer :config
     end
 
-    include ViewComponent::PolymorphicSlots
-    include ViewComponent::SlotableV2
+    include ViewComponent::Slotable
     include ViewComponent::Translatable
     include ViewComponent::WithContentHelper
 
@@ -245,22 +243,40 @@ module ViewComponent
       @request ||= controller.request if controller.respond_to?(:request)
     end
 
-    private
-
-    attr_reader :view_context
-
+    # The content passed to the component instance as a block.
+    #
+    # @return [String]
     def content
       @__vc_content_evaluated = true
       return @__vc_content if defined?(@__vc_content)
 
       @__vc_content =
-        if @view_context && @__vc_render_in_block
+        if __vc_render_in_block_provided?
           view_context.capture(self, &@__vc_render_in_block)
-        elsif defined?(@__vc_content_set_by_with_content)
+        elsif __vc_content_set_by_with_content_defined?
           @__vc_content_set_by_with_content
         end
     end
 
+    # Whether `content` has been passed to the component.
+    #
+    # @return [Boolean]
+    def content?
+      __vc_render_in_block_provided? || __vc_content_set_by_with_content_defined?
+    end
+
+    private
+
+    attr_reader :view_context
+
+    def __vc_render_in_block_provided?
+      @view_context && @__vc_render_in_block
+    end
+
+    def __vc_content_set_by_with_content_defined?
+      defined?(@__vc_content_set_by_with_content)
+    end
+
     def content_evaluated?
       @__vc_content_evaluated
     end
@@ -465,6 +481,11 @@ module ViewComponent
         compiler.compiled?
       end
 
+      # @private
+      def ensure_compiled
+        compile unless compiled?
+      end
+
       # Compile templates to instance methods, assuming they haven't been compiled already.
       #
       # Do as much work as possible in this step, as doing so reduces the amount

data/lib/view_component/capture_compatibility.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module ViewComponent
+  # CaptureCompatibility is a module that patches #capture to fix issues
+  # related to ViewComponent and functionality that relies on `capture`
+  # like forms, capture itself, turbo frames, etc.
+  #
+  # This underlying incompatibility with ViewComponent and capture is
+  # that several features like forms keep a reference to the primary
+  # `ActionView::Base` instance which has its own @output_buffer. When
+  # `#capture` is called on the original `ActionView::Base` instance while
+  # evaluating a block from a ViewComponent the @output_buffer is overridden
+  # in the ActionView::Base instance, and *not* the component. This results
+  # in a double render due to `#capture` implementation details.
+  #
+  # To resolve the issue, we override `#capture` so that we can delegate
+  # the `capture` logic to the ViewComponent that created the block.
+  module CaptureCompatibility
+    def self.included(base)
+      base.class_eval do
+        alias_method :original_capture, :capture
+      end
+
+      base.prepend(InstanceMethods)
+    end
+
+    module InstanceMethods
+      def capture(*args, &block)
+        # Handle blocks that originate from C code and raise, such as `&:method`
+        return original_capture(*args, &block) if block.source_location.nil?
+
+        block_context = block.binding.receiver
+
+        if block_context != self && block_context.class < ActionView::Base
+          block_context.original_capture(*args, &block)
+        else
+          original_capture(*args, &block)
+        end
+      end
+    end
+  end
+end

data/lib/view_component/compiler.rb

@@ -51,24 +51,46 @@ module ViewComponent
         component_class.validate_collection_parameter!
       end
 
-      templates.each do |template|
-        # Remove existing compiled template methods,
-        # as Ruby warns when redefining a method.
-        method_name = call_method_name(template[:variant])
+      if has_inline_template?
+        template = component_class.inline_template
 
         redefinition_lock.synchronize do
-          component_class.silence_redefinition_of_method(method_name)
+          component_class.silence_redefinition_of_method("call")
           # rubocop:disable Style/EvalWithLocation
-          component_class.class_eval <<-RUBY, template[:path], 0
-          def #{method_name}
-            #{compiled_template(template[:path])}
+          component_class.class_eval <<-RUBY, template.path, template.lineno
+          def call
+            #{compiled_inline_template(template)}
           end
           RUBY
           # rubocop:enable Style/EvalWithLocation
+
+          component_class.silence_redefinition_of_method("render_template_for")
+          component_class.class_eval <<-RUBY, __FILE__, __LINE__ + 1
+          def render_template_for(variant = nil)
+            call
+          end
+          RUBY
+        end
+      else
+        templates.each do |template|
+          # Remove existing compiled template methods,
+          # as Ruby warns when redefining a method.
+          method_name = call_method_name(template[:variant])
+
+          redefinition_lock.synchronize do
+            component_class.silence_redefinition_of_method(method_name)
+            # rubocop:disable Style/EvalWithLocation
+            component_class.class_eval <<-RUBY, template[:path], 0
+            def #{method_name}
+              #{compiled_template(template[:path])}
+            end
+            RUBY
+            # rubocop:enable Style/EvalWithLocation
+          end
         end
-      end
 
-      define_render_template_for
+        define_render_template_for
+      end
 
       component_class.build_i18n_backend
 
@@ -103,12 +125,16 @@ module ViewComponent
       end
     end
 
+    def has_inline_template?
+      component_class.respond_to?(:inline_template) && component_class.inline_template.present?
+    end
+
     def template_errors
       @__vc_template_errors ||=
         begin
           errors = []
 
-          if (templates + inline_calls).empty?
+          if (templates + inline_calls).empty? && !has_inline_template?
             errors << "Couldn't find a template file or inline render method for #{component_class}."
           end
 
@@ -216,9 +242,21 @@ module ViewComponent
       end
     end
 
+    def compiled_inline_template(template)
+      handler = ActionView::Template.handler_for_extension(template.language)
+      template.rstrip! if component_class.strip_trailing_whitespace?
+
+      compile_template(template.source, handler)
+    end
+
     def compiled_template(file_path)
       handler = ActionView::Template.handler_for_extension(File.extname(file_path).delete("."))
       template = File.read(file_path)
+
+      compile_template(template, handler)
+    end
+
+    def compile_template(template, handler)
       template.rstrip! if component_class.strip_trailing_whitespace?
 
       if handler.method(:call).parameters.length > 1

data/lib/view_component/config.rb

@@ -23,7 +23,8 @@ module ViewComponent
           show_previews: Rails.env.development? || Rails.env.test?,
           preview_paths: default_preview_paths,
           test_controller: "ApplicationController",
-          default_preview_layout: nil
+          default_preview_layout: nil,
+          capture_compatibility_patch_enabled: false
         })
       end
 
@@ -137,6 +138,13 @@ module ViewComponent
       # A custom default layout used for the previews index page and individual
       # previews.
       # Defaults to `nil`. If this is falsy, `"component_preview"` is used.
+      #
+      # @!attribute capture_compatibility_patch_enabled
+      # @return [Boolean]
+      # Enables the experimental capture compatibility patch that makes ViewComponent
+      # compatible with forms, capture, and other built-ins.
+      # previews.
+      # Defaults to `false`.
 
       def default_preview_paths
         return [] unless defined?(Rails.root) && Dir.exist?("#{Rails.root}/test/components/previews")

data/lib/view_component/engine.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
 require "rails"
-require "view_component/base"
+require "view_component/config"
 
 module ViewComponent
   class Engine < Rails::Engine # :nodoc:
-    config.view_component = ViewComponent::Base.config
+    config.view_component = ViewComponent::Config.defaults
 
     rake_tasks do
       load "view_component/rails/tasks/view_component.rake"
@@ -14,9 +14,6 @@ module ViewComponent
     initializer "view_component.set_configs" do |app|
       options = app.config.view_component
 
-      %i[generate preview_controller preview_route show_previews_source].each do |config_option|
-        options[config_option] ||= ViewComponent::Base.public_send(config_option)
-      end
       options.instrumentation_enabled = false if options.instrumentation_enabled.nil?
       options.render_monkey_patch_enabled = true if options.render_monkey_patch_enabled.nil?
       options.show_previews = (Rails.env.development? || Rails.env.test?) if options.show_previews.nil?
@@ -39,6 +36,8 @@ module ViewComponent
 
     initializer "view_component.enable_instrumentation" do |app|
       ActiveSupport.on_load(:view_component) do
+        Base.config = app.config.view_component
+
         if app.config.view_component.instrumentation_enabled.present?
           # :nocov:
           ViewComponent::Base.prepend(ViewComponent::Instrumentation)
@@ -47,6 +46,14 @@ module ViewComponent
       end
     end
 
+    # :nocov:
+    initializer "view_component.enable_capture_patch" do |app|
+      ActiveSupport.on_load(:view_component) do
+        ActionView::Base.include(ViewComponent::CaptureCompatibility) if app.config.view_component.capture_compatibility_patch_enabled
+      end
+    end
+    # :nocov:
+
     initializer "view_component.set_autoload_paths" do |app|
       options = app.config.view_component
 

data/lib/view_component/inline_template.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module ViewComponent # :nodoc:
+  module InlineTemplate
+    extend ActiveSupport::Concern
+    Template = Struct.new(:source, :language, :path, :lineno)
+
+    class_methods do
+      def method_missing(method, *args)
+        return super if !method.end_with?("_template")
+
+        if defined?(@__vc_inline_template_defined) && @__vc_inline_template_defined
+          raise ViewComponent::ComponentError, "inline templates can only be defined once per-component"
+        end
+
+        if args.size != 1
+          raise ArgumentError, "wrong number of arguments (given #{args.size}, expected 1)"
+        end
+
+        ext = method.to_s.gsub("_template", "")
+        template = args.first
+
+        @__vc_inline_template_language = ext
+
+        caller = caller_locations(1..1)[0]
+        @__vc_inline_template = Template.new(
+          template,
+          ext,
+          caller.absolute_path || caller.path,
+          caller.lineno
+        )
+
+        @__vc_inline_template_defined = true
+      end
+      ruby2_keywords(:method_missing) if respond_to?(:ruby2_keywords, true)
+
+      def respond_to_missing?(method, include_all = false)
+        method.end_with?("_template") || super
+      end
+
+      def inline_template
+        @__vc_inline_template
+      end
+
+      def inline_template_language
+        @__vc_inline_template_language if defined?(@__vc_inline_template_language)
+      end
+
+      def inherited(subclass)
+        super
+        subclass.instance_variable_set(:@__vc_inline_template_language, inline_template_language)
+      end
+    end
+  end
+end

data/lib/view_component/rails/tasks/view_component.rake

@@ -3,7 +3,7 @@
 task stats: "view_component:statsetup"
 
 namespace :view_component do
-  task statsetup: :environment do
+  task :statsetup do
     require "rails/code_statistics"
 
     ::STATS_DIRECTORIES << ["ViewComponents", ViewComponent::Base.view_component_path]

data/lib/view_component/{slot_v2.rb → slot.rb}

@@ -3,7 +3,7 @@
 require "view_component/with_content_helper"
 
 module ViewComponent
-  class SlotV2
+  class Slot
     include ViewComponent::WithContentHelper
 
     attr_writer :__vc_component_instance, :__vc_content_block, :__vc_content