view_component 4.0.2 → 4.12.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 05c8fa66735f8008894ba88d64885dc307bc71381e2b88391798fa4266da7279
4
- data.tar.gz: f217babfa1c1894f377fff73fc3b603755122422c8596e349ffd0d8689e86708
3
+ metadata.gz: b2f1a7d34956fc9ae629c0f0e710f4a7335b33ebc99f1c3eccafc41d19713524
4
+ data.tar.gz: efd4bec7d2425da171f89f28fbc1bfaf9f2cba94fd0f2a9cbce674830281938e
5
5
  SHA512:
6
- metadata.gz: a10d8362a64c181f11dd0aff69725eb7045a4a4cb546c2e960183bf416083dc8b5bcee76c807be3341dd01919eba3fdc2636083de2794101d8751f1c405396a1
7
- data.tar.gz: 2ae8c40ff912472d16d27e3a92af772905d74b3ab010ced00578208ee281f53f59adc31bc0ef0b170cf1ea8c64cd0750db0c0804bb65deca11a33f430cc7012d
6
+ metadata.gz: 5d0f5024d419a56b5e178f0cce3d77ac4a1ae2d4d3efc0ac5334e7b55a4dcb6cc7460aa4d60a47bce63918b0a452b53c5425297ef03da2ce074793407acef570
7
+ data.tar.gz: be1d649efec64995de234eb70998001d42cd9b0197bdce00ec5011d68cb2a2784925abf283b3f51c3986a55a446db3ba0c17cedf406c919e31b178ece2be6b51
@@ -1,5 +1,7 @@
1
1
  # frozen_string_literal: true
2
2
 
3
+ require "view_component/errors"
4
+
3
5
  class ViewComponentsSystemTestController < ActionController::Base # :nodoc:
4
6
  if Rails.env.test?
5
7
  before_action :validate_file_path
@@ -8,18 +10,27 @@ class ViewComponentsSystemTestController < ActionController::Base # :nodoc:
8
10
  @_tmpdir ||= FileUtils.mkdir_p("./tmp/view_components/").first
9
11
  end
10
12
 
13
+ rescue_from ViewComponent::SystemTestControllerNefariousPathError, with: :render_not_found
14
+
11
15
  def system_test_entrypoint
12
16
  render file: @path
13
17
  end
14
18
 
15
19
  private
16
20
 
21
+ def render_not_found
22
+ head :not_found
23
+ end
24
+
17
25
  # Ensure that the file path is valid and doesn't target files outside
18
26
  # the expected directory (e.g. via a path traversal or symlink attack)
19
27
  def validate_file_path
20
28
  base_path = ::File.realpath(self.class.temp_dir)
21
29
  @path = ::File.realpath(params.permit(:file)[:file], base_path)
22
- raise ViewComponent::SystemTestControllerNefariousPathError unless @path.start_with?(base_path)
30
+ allowed_prefix = "#{base_path}#{::File::SEPARATOR}"
31
+ unless @path == base_path || @path.start_with?(allowed_prefix)
32
+ raise ViewComponent::SystemTestControllerNefariousPathError
33
+ end
23
34
  end
24
35
  end
25
36
  end
data/docs/CHANGELOG.md CHANGED
@@ -10,6 +10,196 @@ nav_order: 6
10
10
 
11
11
  ## main
12
12
 
13
+ ## 4.12.0
14
+
15
+ * Fix stale render context on reused component instances. A `ViewComponent::Base` instance memoized its controller, helpers, request, view context, lookup context, view flow, and requested format details on first render via `||=`. Rendering the same instance a second time (intentionally or via aliasing) reused that stale context, which could leak data across requests, sessions, or users. `#render_in` now resets these ivars on every call so each render derives its context from the current view.
16
+
17
+ *Joel Hawksley*
18
+
19
+ * Fix HTML-safety bypass in `around_render`. `ViewComponent::Base#around_render` could return HTML-unsafe strings that bypassed the escaping applied to normal `#call` return values, creating an XSS risk. The vulnerability was amplified in `ViewComponent::Collection#render_in`, which joined per-item results and unconditionally marked the output `html_safe`. HTML-unsafe strings returned from `around_render` are now escaped (with a warning) and `Collection#render_in` now uses `safe_join` so unsafe per-item output is escaped instead of laundered into a `SafeBuffer`.
20
+
21
+ *Joel Hawksley*
22
+
23
+ ## 4.11.0
24
+
25
+ * Update `render_in` signature to accept `**_` for compatibility with Rails [#50623](https://github.com/rails/rails/pull/50623).
26
+
27
+ *Joel Hawksley*
28
+
29
+ * Fix translation scope resolution in nested lambda-backed slots. Relative `t(".key")` calls inside lambda-backed slots were resolving against an intermediate component's scope instead of the original partial's scope where the block was defined.
30
+
31
+ *Artin Boghosian*
32
+
33
+ ## 4.10.0
34
+
35
+ * Fix `NameError: uninitialized constant ViewComponent::SystemTestControllerNefariousPathError` when booting in the test environment with `eager_load = true`.
36
+
37
+ *Joel Hawksley*
38
+
39
+ * Fix yielded content rendered at wrong location when using form helpers.
40
+
41
+ *Joel Hawksley*, *Markus*
42
+
43
+ ## 4.9.0
44
+
45
+ * Fix path traversal vulnerability in `ViewComponentsSystemTestController` where sibling directories sharing a string prefix with the allowed temp directory could bypass the path containment check. The `start_with?` check has been replaced with a separator-aware prefix check, and nefarious path errors now return a 404 instead of an unhandled exception.
46
+
47
+ *Joel Hawksley*
48
+
49
+ * Fix preview route vulnerability where inherited methods on `ViewComponent::Preview` (such as `render_with_template`) could be invoked via the preview URL, allowing arbitrary internal Rails templates to be rendered with attacker-controlled locals and request parameters. `render_args` now raises `AbstractController::ActionNotFound` for any example not explicitly declared on the preview subclass.
50
+
51
+ *Joel Hawksley*
52
+
53
+ * Add `yard-lint` to CI.
54
+
55
+ *Joel Hawksley*
56
+
57
+ ## 4.8.0
58
+
59
+ * Add `compile.view_component` ActiveSupport::Notifications event for eager compilation at boot time.
60
+
61
+ *Joel Hawksley*, *GitHub Copilot*
62
+
63
+ ## 4.7.0
64
+
65
+ * Fix stale content cache when slots are accessed before `render_in`.
66
+
67
+ *Jared Armstrong*
68
+
69
+ * Add rubocop-view_component to resources.
70
+
71
+ *Andy Waite*
72
+
73
+ * Fix bug where inheritance of components with formatless templates improperly raised a NoMethodError.
74
+
75
+ *GitHub Copilot*, *Joel Hawksley*, *Cameron Dutro*
76
+
77
+ ## 4.6.0
78
+
79
+ * Add `view_identifier` to the `render.view_component` instrumentation event payload, containing the path to the component's template file (e.g. `app/components/my_component.html.erb`). For components using inline render methods, `view_identifier` will be `nil`.
80
+
81
+ *GitHub Copilot*
82
+
83
+ * Replace deprecated `require_dependency` with `require` in preview loading.
84
+
85
+ *GitHub Copilot*
86
+
87
+ * Return `html_safe` empty string from `render_in` when `render?` is false.
88
+
89
+ *GitHub Copilot*
90
+
91
+ ## 4.5.0
92
+
93
+ * Fix initialization ordering issue causing missing asset errors in Sprockets.
94
+
95
+ *Cameron Dutro*
96
+
97
+ ## 4.4.0
98
+
99
+ * Fix segfaults when Ruby coverage is enabled.
100
+
101
+ *George Holborn*, *Joel Hawksley*
102
+
103
+ * Add `protocol` parameter to `with_request_url` test helper to enable testing with HTTPS protocol.
104
+
105
+ *Joel Hawksley*
106
+
107
+ ## 4.3.0
108
+
109
+ * Fix load order issues for 3rd-party template handlers.
110
+
111
+ *Cameron Dutro*
112
+
113
+ * Fix segfault when Ruby coverage is enabled with Rails 8.1 ERB templates.
114
+
115
+ *George Holborn*
116
+
117
+ * Automatically merge dependabot PRs.
118
+
119
+ *Joel Hawksley*
120
+
121
+ * Use Ruby 4.0.0 in CI and dev.
122
+
123
+ *Joel Hawksley*
124
+
125
+ ## 4.2.0
126
+
127
+ * Fix translation scope resolution in deeply nested component blocks (3+ levels). Translations called inside deeply nested slot blocks using `renders_many`/`renders_one` were incorrectly resolving to an intermediate component's scope instead of the partial's scope where the block was defined. The fix captures the virtual path at block definition time and restores it during block execution, ensuring translations always resolve relative to where the block was created regardless of nesting depth.
128
+
129
+ *Nathaniel Watts*
130
+
131
+ * Allow `render_inline` with Nokogiri::HTML5 to parse more arbitrary content including bare table content otherwise illegal fragments like `<td>`.
132
+
133
+ *Jonathan Rochkind*
134
+
135
+ * Remove known issue from docs as ActiveScaffold is [now compatible](https://github.com/activescaffold/active_scaffold/pull/743) with ViewComponent.
136
+
137
+ *David Löwenfels*
138
+
139
+ * Add test to document the current behavior for resolving relative translation keys within partial blocks. When rendering a partial, relative translation keys are resolved relative to the partial's own path rather than the caller’s path. This test ensures that this behavior remains consistent.
140
+
141
+ *Oussama Hilal*
142
+
143
+ * Allow I18n calls in `render?`.
144
+
145
+ *23tux*
146
+
147
+ * ViewComponent now works without `rails` and `railties` gems loaded, enabling compatibility with Bridgetown 2.0.
148
+
149
+ *Tom Lord*
150
+
151
+ * Capture partial block in the component's context, allowing access to the component instance inside the block.
152
+
153
+ *23tux*
154
+
155
+ * Add `after_compile` class method hook to enable extensions to run logic after component compilation.
156
+
157
+ *Jose Solás*
158
+
159
+ * Fix outdated reference to preview layout configuration in docs.
160
+
161
+ *Lucas Geron*
162
+
163
+ * Allow ruby-head CI job to fail without failing workflow.
164
+
165
+ *Hakan Ensari*
166
+
167
+ * Fix bug where error line numbers were incorrect in Rails 8.1.
168
+
169
+ *Joel Hawksley*
170
+
171
+ * Remove `< 8.2` upper bound for `activesupport` and `actionview` dependencies.
172
+
173
+ *Hans Lemuet*
174
+
175
+ * Test compatibility with Herb/ReActionView.
176
+
177
+ *Joel Hawksley*
178
+
179
+ * Remove Who Uses ViewComponent section from docs.
180
+
181
+ *Joel Hawksley*
182
+
183
+ ## 4.1.1
184
+
185
+ * Resolve deprecation warning for `ActiveSupport::Configurable`.
186
+
187
+ *Simon Fish*
188
+
189
+ * Make `ViewComponent::VERSION` accessible to other gems by default.
190
+
191
+ *Hans Lemuet*
192
+
193
+ ## 4.1.0
194
+
195
+ * Add Rails 8.1 support.
196
+
197
+ *Hans Lemuet*
198
+
199
+ * Declare `actionview` as a `view_component` gem dependency.
200
+
201
+ *Michal Cichra*
202
+
13
203
  ## 4.0.2
14
204
 
15
205
  * Share the view context in tests to prevent out-of-order rendering issues for certain advanced use-cases, eg. testing instances of Rails' `FormBuilder`.
@@ -488,10 +678,6 @@ This release makes the following breaking changes:
488
678
 
489
679
  *Martin Meyerhoff*, *Joel Hawksley*
490
680
 
491
- * Add Content Harmony & Learn To Be to list of companies using ViewComponent.
492
-
493
- *Kane Jamison*
494
-
495
681
  * Clarify error message about render-dependent logic.
496
682
 
497
683
  Error messages about render-dependent logic were sometimes inaccurate, saying `during initialization` despite also being raised after a component had been initialized but before it was rendered.
@@ -510,10 +696,6 @@ This release makes the following breaking changes:
510
696
 
511
697
  *Reegan Viljoen*
512
698
 
513
- * Add HomeStyler AI to list of companies using ViewComponent.
514
-
515
- *JP Balarini*
516
-
517
699
  ## 3.21.0
518
700
 
519
701
  * Updates testing docs to include an example of how to use with RSpec.
@@ -524,10 +706,6 @@ This release makes the following breaking changes:
524
706
 
525
707
  *KAWAKAMI Moeki*
526
708
 
527
- * Add FreeATS to list of companies using ViewComponent.
528
-
529
- *Ilia Liamshin*
530
-
531
709
  * Ensure HTML output safety wrapper is used for all inline templates.
532
710
 
533
711
  *Joel Hawksley*
@@ -578,10 +756,6 @@ This release makes the following breaking changes:
578
756
 
579
757
  *Blake Williams*
580
758
 
581
- * Add [Niva]([niva.co](https://www.niva.co/)) to companies who use `ViewComponent`.
582
-
583
- *Daniel Vu Dao*
584
-
585
759
  * Fix `preview_paths` in docs.
586
760
 
587
761
  *Javier Aranda*
@@ -646,10 +820,6 @@ This release makes the following breaking changes:
646
820
 
647
821
  *Joel Hawksley*
648
822
 
649
- * Add Kicksite to list of companies using ViewComponent.
650
-
651
- *Adil Lari*
652
-
653
823
  * Allow overridden slot methods to use `super`.
654
824
 
655
825
  *Andrew Schwartz*
@@ -889,10 +1059,6 @@ This release makes the following breaking changes:
889
1059
 
890
1060
  *Simon Fish*
891
1061
 
892
- * Add Simundia to list of companies using ViewComponent.
893
-
894
- *Alexandre Ignjatovic*
895
-
896
1062
  * Reduce UnboundMethod objects by memoizing initialize_parameters.
897
1063
 
898
1064
  *Rainer Borene*
@@ -943,10 +1109,6 @@ This release makes the following breaking changes:
943
1109
 
944
1110
  *milk1000cc*
945
1111
 
946
- * Add PeopleForce to list of companies using ViewComponent.
947
-
948
- *Volodymyr Khandiuk*
949
-
950
1112
  ## 3.5.0
951
1113
 
952
1114
  * Add Skroutz to users list.
@@ -1021,14 +1183,6 @@ This release makes the following breaking changes:
1021
1183
 
1022
1184
  *Joel Hawksley*
1023
1185
 
1024
- * Add Ophelos to list of companies using ViewComponent.
1025
-
1026
- *Graham Rogers*
1027
-
1028
- * Add FlightLogger to list of companies using ViewComponent.
1029
-
1030
- *Joseph Carpenter*
1031
-
1032
1186
  * Fix coverage reports overwriting each other when running locally.
1033
1187
 
1034
1188
  *Jonathan del Strother*
@@ -1268,14 +1422,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1268
1422
 
1269
1423
  *Graham Rogers*
1270
1424
 
1271
- * Add Krystal to list of companies using ViewComponent.
1272
-
1273
- *Matt Bearman*
1274
-
1275
- * Add Mon Ami to list of companies using ViewComponent.
1276
-
1277
- *Ethan Lee-Tyson*
1278
-
1279
1425
  ## 3.0.0.rc1
1280
1426
 
1281
1427
  1,000+ days and 100+ releases later, the 200+ contributors to ViewComponent are proud to ship v3.0.0!
@@ -1424,10 +1570,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1424
1570
 
1425
1571
  *Hans Lemuet*
1426
1572
 
1427
- * Add Startup Jobs to list of companies using ViewComponent.
1428
-
1429
- *Marc Köhlbrugge*
1430
-
1431
1573
  * Run PVC's accessibility tests in a single process to avoid resource contention in CI.
1432
1574
 
1433
1575
  *Cameron Dutro*
@@ -1468,10 +1610,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1468
1610
 
1469
1611
  ## 2.74.0
1470
1612
 
1471
- * Add Avo to list of companies using ViewComponent.
1472
-
1473
- *Adrian Marin*
1474
-
1475
1613
  * Promote experimental `_output_postamble` method to public API as `output_postamble`.
1476
1614
 
1477
1615
  *Joel Hawksley*
@@ -1498,10 +1636,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1498
1636
 
1499
1637
  *Erinna Chen*
1500
1638
 
1501
- * Add PrintReleaf to list of companies using ViewComponent.
1502
-
1503
- *Ry Kulp*
1504
-
1505
1639
  * Simplify CI configuration to a single build per Ruby/Rails version.
1506
1640
 
1507
1641
  *Joel Hawksley*
@@ -1510,10 +1644,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1510
1644
 
1511
1645
  *Ruben Smit*
1512
1646
 
1513
- * Add Yobbers to list of companies using ViewComponent.
1514
-
1515
- *Anton Prins*
1516
-
1517
1647
  ## 2.72.0
1518
1648
 
1519
1649
  * Deprecate support for Ruby < 2.7 for removal in v3.0.0.
@@ -1528,10 +1658,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1528
1658
 
1529
1659
  *Joel Hawksley.
1530
1660
 
1531
- * Add Aluuno to list of companies using ViewComponent.
1532
-
1533
- *Daniel Naves de Carvalho*
1534
-
1535
1661
  * Add `source_code_uri` to gemspec.
1536
1662
 
1537
1663
  *Yoshiyuki Hirano*
@@ -1566,22 +1692,10 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1566
1692
 
1567
1693
  *Joel Hawksley*
1568
1694
 
1569
- * Add Arrows to list of companies using ViewComponent.
1570
-
1571
- *Matt Swanson*
1572
-
1573
- * Add WIP to list of companies using ViewComponent.
1574
-
1575
- *Marc Köhlbrugge*
1576
-
1577
1695
  * Update slots documentation to include how to reference slots.
1578
1696
 
1579
1697
  *Brittany Ellich*
1580
1698
 
1581
- * Add Clio to list of companies using ViewComponent.
1582
-
1583
- *Mike Buckley*
1584
-
1585
1699
  ## 2.69.0
1586
1700
 
1587
1701
  * Add missing `require` to fix `pvc` build.
@@ -1699,10 +1813,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1699
1813
 
1700
1814
  *Vikram Dighe*
1701
1815
 
1702
- * Add HappyCo to list of companies using ViewComponent.
1703
-
1704
- *Josh Clayton*
1705
-
1706
1816
  * Add predicate method support to polymorphic slots.
1707
1817
 
1708
1818
  *Graham Rogers*
@@ -1813,10 +1923,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1813
1923
 
1814
1924
  *Thomas Hutterer*
1815
1925
 
1816
- * Add FreeAgent to list of companies using ViewComponent.
1817
-
1818
- *Simon Fish*
1819
-
1820
1926
  * Include polymorphic slots in `ViewComponent::Base` by default.
1821
1927
 
1822
1928
  *Cameron Dutro*
@@ -1872,18 +1978,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1872
1978
 
1873
1979
  *Joel Hawksley*
1874
1980
 
1875
- * Add G2 to list of companies that use ViewComponent.
1876
-
1877
- *Jack Shuff*
1878
-
1879
- * Add Within3 to list of companies that use ViewComponent.
1880
-
1881
- *Drew Bragg*
1882
-
1883
- * Add Mission Met to list of companies that use ViewComponent.
1884
-
1885
- *Nick Smith*
1886
-
1887
1981
  * Fix `#with_request_url` test helper not parsing nested query parameters into nested hashes.
1888
1982
 
1889
1983
  *Richard Marbach*
@@ -1923,10 +2017,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1923
2017
 
1924
2018
  *Blake Williams*
1925
2019
 
1926
- * Add QuickNode to list of companies that use ViewComponent.
1927
-
1928
- *Luc Castera*
1929
-
1930
2020
  * Include the `Translatable` module by default.
1931
2021
 
1932
2022
  *Elia Schito*
@@ -1957,10 +2047,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1957
2047
 
1958
2048
  *Jason Swett*
1959
2049
 
1960
- * Add Bearer to list of companies that use ViewComponent.
1961
-
1962
- *Yaroslav Shmarov*
1963
-
1964
2050
  * Add articles to resources page.
1965
2051
 
1966
2052
  *Joel Hawksley*
@@ -1990,10 +2076,6 @@ Run into an issue with this release? [Let us know](https://github.com/ViewCompon
1990
2076
 
1991
2077
  *Hans Lemuet*
1992
2078
 
1993
- * Alphabetize companies using ViewComponent and add Brightline to the list.
1994
-
1995
- *Jack Schuss*
1996
-
1997
2079
  * Add CMYK value for ViewComponent Red color on logo page.
1998
2080
 
1999
2081
  *Dylan Smith*
@@ -23,7 +23,7 @@ module ViewComponent
23
23
  class_option :skip_suffix, type: :boolean, default: false
24
24
 
25
25
  def create_component_file
26
- template "component.rb", File.join(component_path, class_path, "#{file_name}#{options[:skip_suffix] ? "" : "_component"}.rb")
26
+ template "component.rb", File.join(component_path, class_path, "#{file_name}#{"_component" unless options[:skip_suffix]}.rb")
27
27
  end
28
28
 
29
29
  hook_for :test_framework