view_component 4.0.2 → 4.12.0

data/lib/view_component/base.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require "action_view"
-require "active_support/configurable"
+require "action_view/base"
 require "view_component/collection"
 require "view_component/compile_cache"
 require "view_component/compiler"
@@ -47,7 +47,7 @@ module ViewComponent
     end
 
     include ActionView::Helpers
-    include Rails.application.routes.url_helpers if defined?(Rails) && Rails.application
+    include Rails.application.routes.url_helpers if defined?(Rails.application.routes)
     include ERB::Escape
     include ActiveSupport::CoreExt::ERBUtil
 
@@ -82,6 +82,7 @@ module ViewComponent
     # so helpers, etc work as expected.
     #
     # @param view_context [ActionView::Base] The original view context.
+    #
     # @return [void]
     def set_original_view_context(view_context)
       # noop
@@ -102,25 +103,27 @@ module ViewComponent
     # Returns HTML that has been escaped by the respective template handler.
     #
     # @return [String]
-    def render_in(view_context, &block)
+    def render_in(view_context, **_, &block)
       self.class.__vc_compile(raise_errors: true)
 
+      __vc_reset_render_state!
+
       @view_context = view_context
       @old_virtual_path = view_context.instance_variable_get(:@virtual_path)
-      self.__vc_original_view_context ||= view_context
+      self.__vc_original_view_context = view_context
 
       @output_buffer = view_context.output_buffer
 
-      @lookup_context ||= view_context.lookup_context
+      @lookup_context = view_context.lookup_context
 
       # For content_for
-      @view_flow ||= view_context.view_flow
+      @view_flow = view_context.view_flow
 
       # For i18n
       @virtual_path ||= virtual_path
 
       # Describes the inferred request constraints (locales, formats, variants)
-      @__vc_requested_details ||= @lookup_context.vc_requested_details
+      @__vc_requested_details = @lookup_context.vc_requested_details
 
       # For caching, such as #cache_if
       @current_template = nil unless defined?(@current_template)
@@ -131,7 +134,9 @@ module ViewComponent
       end
 
       @__vc_content_evaluated = false
+      remove_instance_variable(:@__vc_content) if defined?(@__vc_content)
       @__vc_render_in_block = block
+      @view_context.instance_variable_set(:@virtual_path, virtual_path)
 
       before_render
 
@@ -139,12 +144,21 @@ module ViewComponent
         value = nil
 
         @output_buffer.with_buffer do
-          @view_context.instance_variable_set(:@virtual_path, virtual_path)
+          inner_rendered_template = nil
+          around_rendered_template = around_render do
+            inner_rendered_template = render_template_for(@__vc_requested_details).to_s
+          end
 
-          rendered_template =
-            around_render do
-              render_template_for(@__vc_requested_details).to_s
-            end
+          # If `around_render` returned the same object the block yielded, the inner
+          # template's escaping is authoritative and we can trust the result. If the
+          # user replaced/wrapped the value, re-check HTML safety to prevent
+          # bypassing the escaping applied to normal `#call` return values
+          # (GHSA-97jw-64cj-jc58).
+          rendered_template = if around_rendered_template.equal?(inner_rendered_template)
+            around_rendered_template
+          else
+            __vc_safe_around_render_output(around_rendered_template)
+          end
 
           # Avoid allocating new string when output_preamble and output_postamble are blank
           value = if output_preamble.blank? && output_postamble.blank?
@@ -161,7 +175,7 @@ module ViewComponent
 
         value
       else
-        ""
+        "".html_safe
       end
     ensure
       view_context.instance_variable_set(:@virtual_path, @old_virtual_path)
@@ -254,13 +268,16 @@ module ViewComponent
     # @private
     def render(options = {}, args = {}, &block)
       if options.respond_to?(:set_original_view_context)
-        options.set_original_view_context(self.__vc_original_view_context)
+        options.set_original_view_context(__vc_original_view_context)
 
         # We assume options is a component, so there's no need to evaluate the
         # block in the view context as we do below.
         @view_context.render(options, args, &block)
       elsif block
         __vc_original_view_context.render(options, args) do
+          # capture the block output in the view context of the component
+          output = capture(&block)
+
           # Partials are rendered to their own buffer and do not append to the
           # original @output_buffer we retain a reference to in #render_in. This
           # is a problem since the block passed to us here in the #render method
@@ -268,13 +285,29 @@ module ViewComponent
           # appends to the original @output_buffer. To avoid this, we evaluate the
           # block in the view context instead, which will append to the output buffer
           # created for the partial.
-          __vc_original_view_context.instance_exec(&block)
+          __vc_original_view_context.capture { output }
         end
       else
         __vc_original_view_context.render(options, args)
       end
     end
 
+    # Sync @output_buffer with the view context's current output buffer before
+    # capturing. Form helpers create builders with @template_object pointing to
+    # the component. When those builders later call capture inside a partial
+    # (whose _run allocated a fresh OutputBuffer on the view context), the
+    # component's stale @output_buffer would capture from the wrong buffer.
+    # Temporarily switching to the view context's buffer keeps both in sync.
+    #
+    # @private
+    def capture(...)
+      old_output_buffer = @output_buffer
+      @output_buffer = view_context.output_buffer if view_context
+      super
+    ensure
+      @output_buffer = old_output_buffer
+    end
+
     # The current controller. Use sparingly as doing so introduces coupling
     # that inhibits encapsulation & reuse, often making testing difficult.
     #
@@ -302,7 +335,7 @@ module ViewComponent
       @__vc_helpers ||= __vc_original_view_context || controller.view_context
     end
 
-    if ::Rails.env.development? || ::Rails.env.test?
+    if defined?(Rails.env) && (::Rails.env.development? || ::Rails.env.test?)
       # @private
       def method_missing(method_name, *args) # rubocop:disable Style/MissingRespondToMissing
         super
@@ -331,7 +364,7 @@ module ViewComponent
       []
     end
 
-    if Rails::VERSION::MAJOR == 7 && Rails::VERSION::MINOR == 1
+    if defined?(Rails::VERSION) && Rails::VERSION::MAJOR == 7 && Rails::VERSION::MINOR == 1
       # Rails expects us to define `format` on all renderables,
       # but we do not know the `format` of a ViewComponent until runtime.
       def format
@@ -362,7 +395,7 @@ module ViewComponent
 
       @__vc_content =
         if __vc_render_in_block_provided?
-          with_original_virtual_path do
+          with_captured_virtual_path(@old_virtual_path) do
             view_context.capture(self, &@__vc_render_in_block)
           end
         elsif __vc_content_set_by_with_content_defined?
@@ -378,11 +411,14 @@ module ViewComponent
     end
 
     # @private
-    def with_original_virtual_path
-      @view_context.instance_variable_set(:@virtual_path, @old_virtual_path)
+    # Temporarily sets the virtual path to the captured value, then restores it.
+    # This ensures translations and other path-dependent code execute with the correct scope.
+    def with_captured_virtual_path(captured_path)
+      old_virtual_path = @view_context.instance_variable_get(:@virtual_path)
+      @view_context.instance_variable_set(:@virtual_path, captured_path)
       yield
     ensure
-      @view_context.instance_variable_set(:@virtual_path, virtual_path)
+      @view_context.instance_variable_set(:@virtual_path, old_virtual_path)
     end
 
     private
@@ -421,6 +457,28 @@ module ViewComponent
       end
     end
 
+    def __vc_safe_around_render_output(output)
+      __vc_maybe_escape_html(output) do
+        Kernel.warn("WARNING: The #{self.class} component's around_render returned an HTML-unsafe string. The output will be automatically escaped, but you may want to investigate.")
+      end
+    end
+
+    # Resets every render-scoped instance variable derived from the calling view
+    # context so a reused instance cannot leak controller/helper/request/format
+    # state from a previous render. Slot state (`@__vc_set_slots`,
+    # `@__vc_content_set_by_with_content`) is intentionally preserved because it
+    # is populated by callers _before_ `render_in` runs (e.g. via `with_*`
+    # slot setters or `with_content`).
+    def __vc_reset_render_state!
+      %i[
+        @__vc_controller
+        @__vc_helpers
+        @__vc_request
+      ].each do |ivar|
+        remove_instance_variable(ivar) if instance_variable_defined?(ivar)
+      end
+    end
+
     # Configuration for generators.
     #
     # All options under this namespace default to `false` unless otherwise
@@ -512,6 +570,7 @@ module ViewComponent
       # @param extensions [Array<String>] Extensions of which to return matching sidecar files.
       def sidecar_files(extensions)
         return [] unless identifier
+        return [] unless name
 
         extensions = extensions.join(",")
 
@@ -573,7 +632,7 @@ module ViewComponent
         # eager loading is disabled and the parent component is rendered before the child. In
         # such a scenario, the parent will override ViewComponent::Base#render_template_for,
         # meaning it will not be called for any children and thus not compile their templates.
-        if !child.instance_methods(false).include?(:render_template_for) && !child.__vc_compiled?
+        if !child.method_defined?(:render_template_for, false) && !child.__vc_compiled?
           child.class_eval <<~RUBY, __FILE__, __LINE__ + 1
             def render_template_for(requested_details)
               # Force compilation here so the compiler always redefines render_template_for.
@@ -596,7 +655,7 @@ module ViewComponent
         # Set collection parameter to the extended component
         child.with_collection_parameter(__vc_provided_collection_parameter)
 
-        if instance_methods(false).include?(:render_template_for)
+        if method_defined?(:render_template_for, false)
           vc_ancestor_calls = defined?(@__vc_ancestor_calls) ? @__vc_ancestor_calls.dup : []
 
           vc_ancestor_calls.unshift(instance_method(:render_template_for))
@@ -611,6 +670,16 @@ module ViewComponent
         __vc_compiler.compiled?
       end
 
+      # Hook called by the compiler after a component is compiled.
+      #
+      # Extensions can override this class method to run logic after
+      # compilation (e.g., generate helpers, register metadata, etc.).
+      #
+      # By default, this is a no-op.
+      def after_compile
+        # no-op by default
+      end
+
       # @private
       def __vc_ensure_compiled
         __vc_compile unless __vc_compiled?

data/lib/view_component/collection.rb

@@ -1,25 +1,29 @@
 # frozen_string_literal: true
 
 require "action_view/renderer/collection_renderer"
+require "action_view/helpers/output_safety_helper"
 
 module ViewComponent
   class Collection
     include Enumerable
+    include ActionView::Helpers::OutputSafetyHelper
+
     attr_reader :component
 
     delegate :size, to: :@collection
 
-    def render_in(view_context, &block)
-      components.map do |component|
+    def render_in(view_context, **_, &block)
+      rendered = components.map do |component|
         component.render_in(view_context, &block)
-      end.join(rendered_spacer(view_context)).html_safe
+      end
+      safe_join(rendered, rendered_spacer(view_context))
     end
 
     def each(&block)
       components.each(&block)
     end
 
-    if Rails::VERSION::MAJOR == 7 && Rails::VERSION::MINOR == 1
+    if defined?(Rails::VERSION) && Rails::VERSION::MAJOR == 7 && Rails::VERSION::MINOR == 1
       # Rails expects us to define `format` on all renderables,
       # but we do not know the `format` of a ViewComponent until runtime.
       def format
@@ -29,15 +33,15 @@ module ViewComponent
 
     private
 
+    # Always rebuild child component instances per render to avoid leaking
+    # request-scoped state from a previous render into a later one (GHSA).
     def components
-      return @components if defined? @components
-
       iterator = ActionView::PartialIteration.new(@collection.size)
 
       component.__vc_validate_collection_parameter!(validate_default: true)
 
-      @components = @collection.map do |item|
-        component.new(**component_options(item, iterator)).tap do |component|
+      @collection.map do |item|
+        component.new(**component_options(item, iterator)).tap do |_|
           iterator.iterate!
         end
       end
@@ -66,12 +70,12 @@ module ViewComponent
       @options.merge(item_options)
     end
 
+    # Render the spacer through a fresh `dup` so a collection rendered multiple
+    # times always gets a clean spacer instance.
     def rendered_spacer(view_context)
-      if @spacer_component
-        @spacer_component.render_in(view_context)
-      else
-        ""
-      end
+      return "" unless @spacer_component
+
+      @spacer_component.dup.render_in(view_context)
     end
   end
 end

data/lib/view_component/compiler.rb

@@ -52,12 +52,14 @@ module ViewComponent
         @component.__vc_build_i18n_backend
 
         CompileCache.register(@component)
+
+        @component.after_compile
       end
     end
 
-    # @return all matching compiled templates, in priority order based on the requested details from LookupContext
+    # @param requested_details [ActionView::TemplateDetails::Requested] i.e. locales, formats, variants
     #
-    # @param [ActionView::TemplateDetails::Requested] requested_details i.e. locales, formats, variants
+    # @return all matching compiled templates, in priority order based on the requested details from LookupContext
     def find_templates_for(requested_details)
       filtered_templates = @templates.select do |template|
         template.details.matches?(requested_details)
@@ -113,11 +115,11 @@ module ViewComponent
           .tally
           .select { |_, count| count > 1 }
           .each do |tally|
-          variant, this_format = tally.first
+            variant, this_format = tally.first
 
-          variant_string = " for variant `#{variant}`" if variant.present?
+            variant_string = " for variant `#{variant}`" if variant.present?
 
-          errors << "More than one #{this_format.upcase} template found#{variant_string} for #{@component}. "
+            errors << "More than one #{this_format.upcase} template found#{variant_string} for #{@component}. "
         end
 
         default_template_types = @templates.each_with_object(Set.new) do |template, memo|
@@ -188,11 +190,11 @@ module ViewComponent
           ).flat_map { |ancestor| ancestor.instance_methods(false).grep(/^call(_|$)/) }
             .uniq
             .each do |method_name|
-            templates << Template::InlineCall.new(
-              component: @component,
-              method_name: method_name,
-              defined_on_self: component_instance_methods_on_self.include?(method_name)
-            )
+              templates << Template::InlineCall.new(
+                component: @component,
+                method_name: method_name,
+                defined_on_self: component_instance_methods_on_self.include?(method_name)
+              )
           end
 
           templates

data/lib/view_component/config.rb

@@ -19,6 +19,7 @@ module ViewComponent
       end
 
       # @!attribute generate
+      #
       # @return [ActiveSupport::OrderedOptions]
       # The subset of configuration options relating to generators.
       #
@@ -95,6 +96,7 @@ module ViewComponent
       # in `spec/views/components/` rather than the default `spec/components/`.
 
       # @!attribute previews
+      #
       # @return [ActiveSupport::OrderedOptions]
       # The subset of configuration options relating to previews.
       #
@@ -124,6 +126,7 @@ module ViewComponent
       #
 
       # @!attribute instrumentation_enabled
+      #
       # @return [Boolean]
       # Whether ActiveSupport notifications are enabled.
       # Defaults to `false`.
@@ -163,7 +166,7 @@ module ViewComponent
         options = ActiveSupport::OrderedOptions.new
         options.controller = "ViewComponentsController"
         options.route = "/rails/view_components"
-        options.enabled = Rails.env.development? || Rails.env.test?
+        options.enabled = defined?(Rails.env) && (Rails.env.development? || Rails.env.test?)
         options.default_layout = nil
         options.paths = default_preview_paths
         options
@@ -171,6 +174,7 @@ module ViewComponent
     end
 
     # @!attribute current
+    #
     # @return [ViewComponent::Config]
     # Returns the current ViewComponent::Config. This is persisted against this
     # class so that config options remain accessible before the rest of

data/lib/view_component/configurable.rb

@@ -4,14 +4,30 @@ module ViewComponent
   module Configurable
     extend ActiveSupport::Concern
 
+    class_methods do
+      def config
+        @_config ||= if respond_to?(:superclass) && superclass.respond_to?(:config)
+          superclass.config.inheritable_copy
+        else
+          ActiveSupport::OrderedOptions.new
+        end
+      end
+
+      def configure
+        yield config
+      end
+    end
+
     included do
       next if respond_to?(:config) && config.respond_to?(:view_component) && config.respond_to_missing?(:instrumentation_enabled)
 
-      include ActiveSupport::Configurable
-
       configure do |config|
         config.view_component ||= ActiveSupport::InheritableOptions.new
       end
+
+      def config
+        self.class.config
+      end
     end
   end
 end

data/lib/view_component/engine.rb

@@ -50,11 +50,13 @@ module ViewComponent
       end
     end
 
-    config.after_initialize do |app|
+    config.after_routes_loaded do
       ActiveSupport.on_load(:view_component) do
         if defined?(Sprockets::Rails)
           include Sprockets::Rails::Helper
 
+          app = Rails.application
+
           # Copy relevant config to VC context
           # See: https://github.com/rails/sprockets-rails/blob/266ec49f3c7c96018dd75f9dc4f9b62fe3f7eecf/lib/sprockets/railtie.rb#L245
           self.debug_assets = app.config.assets.debug
@@ -77,7 +79,15 @@ module ViewComponent
 
     initializer "view_component.eager_load_actions" do
       ActiveSupport.on_load(:after_initialize) do
-        ViewComponent::Base.descendants.each(&:__vc_compile) if Rails.application.config.eager_load
+        if Rails.application.config.eager_load
+          ActiveSupport::Notifications.instrument("compile.view_component") do
+            ViewComponent::Base.descendants.each do |component|
+              next if component.anonymous?
+
+              component.__vc_compile
+            end
+          end
+        end
       end
     end
 

data/lib/view_component/inline_template.rb

@@ -3,6 +3,7 @@
 module ViewComponent # :nodoc:
   module InlineTemplate
     extend ActiveSupport::Concern
+
     Template = Struct.new(:source, :language, :path, :lineno)
 
     class_methods do

data/lib/view_component/instrumentation.rb

@@ -8,18 +8,31 @@ module ViewComponent # :nodoc:
       mod.prepend(self) unless self <= ViewComponent::Instrumentation
     end
 
-    def render_in(view_context, &block)
+    def render_in(view_context, **_, &block)
       return super if !Rails.application.config.view_component.instrumentation_enabled.present?
 
+      payload = {
+        name: self.class.name,
+        identifier: self.class.identifier,
+        view_identifier: nil
+      }
+
       ActiveSupport::Notifications.instrument(
         "render.view_component",
-        {
-          name: self.class.name,
-          identifier: self.class.identifier
-        }
+        payload
       ) do
-        super
+        result = super
+        payload[:view_identifier] = @__vc_instrumentation_view_identifier
+        result
       end
+    ensure
+      @__vc_instrumentation_view_identifier = nil
+    end
+
+    def around_render
+      result = super
+      @__vc_instrumentation_view_identifier = current_template&.path
+      result
     end
   end
 end

data/lib/view_component/preview.rb

@@ -40,6 +40,8 @@ module ViewComponent # :nodoc:
 
       # Returns the arguments for rendering of the component in its layout
       def render_args(example, params: {})
+        raise AbstractController::ActionNotFound, "#{example} is not a valid preview example" unless examples.include?(example.to_s)
+
         example_params_names = instance_method(example).parameters.map(&:last)
         provided_params = params.slice(*example_params_names).to_h.symbolize_keys
         result = provided_params.empty? ? new.public_send(example) : new.public_send(example, **provided_params)
@@ -95,7 +97,7 @@ module ViewComponent # :nodoc:
       # @private
       def __vc_load_previews
         Array(preview_paths).each do |preview_path|
-          Dir["#{preview_path}/**/*preview.rb"].sort.each { |file| require_dependency file }
+          Dir["#{preview_path}/**/*preview.rb"].sort.each { |file| require file }
         end
       end
 

data/lib/view_component/slot.rb

@@ -6,7 +6,7 @@ module ViewComponent
   class Slot
     include ViewComponent::WithContentHelper
 
-    attr_writer :__vc_component_instance, :__vc_content_block, :__vc_content
+    attr_writer :__vc_component_instance, :__vc_content_block, :__vc_content, :__vc_content_block_virtual_path
 
     def initialize(parent)
       @parent = parent
@@ -58,7 +58,7 @@ module ViewComponent
           if defined?(@__vc_content_block)
             # render_in is faster than `parent.render`
             @__vc_component_instance.render_in(view_context) do |*args|
-              @parent.with_original_virtual_path do
+              @parent.with_captured_virtual_path(@__vc_content_block_virtual_path) do
                 @__vc_content_block.call(*args)
               end
             end
@@ -68,7 +68,7 @@ module ViewComponent
         elsif defined?(@__vc_content)
           @__vc_content
         elsif defined?(@__vc_content_block)
-          @parent.with_original_virtual_path do
+          @parent.with_captured_virtual_path(@__vc_content_block_virtual_path) do
             view_context.capture(&@__vc_content_block)
           end
         elsif defined?(@__vc_content_set_by_with_content)
@@ -96,7 +96,6 @@ module ViewComponent
     #     end
     #   end
     # end
-    #
     def method_missing(symbol, *args, **kwargs, &block)
       @__vc_component_instance.public_send(symbol, *args, **kwargs, &block)
     end

data/lib/view_component/slotable.rb

@@ -259,7 +259,7 @@ module ViewComponent
 
           setter_method_name = :"with_#{poly_slot_name}"
 
-          if instance_methods.include?(setter_method_name)
+          if method_defined?(setter_method_name)
             raise AlreadyDefinedPolymorphicSlotSetterError.new(setter_method_name, poly_slot_name)
           end
 
@@ -380,6 +380,7 @@ module ViewComponent
     def __vc_set_slot(slot_name, slot_definition = nil, *args, **kwargs, &block)
       slot_definition ||= self.class.registered_slots[slot_name]
       slot = Slot.new(self)
+      captured_block_virtual_path = nil
 
       # Passing the block to the sub-component wrapper like this has two
       # benefits:
@@ -390,7 +391,13 @@ module ViewComponent
       # 2. Since we have to pass block content to components when calling
       # `render`, evaluating the block here would require us to call
       # `view_context.capture` twice, which is slower
-      slot.__vc_content_block = block if block
+      if block
+        slot.__vc_content_block = block
+        # Capture the virtual path at the time the block is defined, so that
+        # translations resolve relative to where the block was created, not where it's rendered
+        captured_block_virtual_path = view_context.instance_variable_get(:@virtual_path)
+        slot.__vc_content_block_virtual_path = captured_block_virtual_path
+      end
 
       # If class
       if slot_definition[:renderable]
@@ -408,7 +415,9 @@ module ViewComponent
         renderable_value =
           if block
             renderable_function.call(*args, **kwargs) do |*rargs|
-              view_context.capture(*rargs, &block)
+              with_captured_virtual_path(captured_block_virtual_path) do
+                view_context.capture(*rargs, &block)
+              end
             end
           else
             renderable_function.call(*args, **kwargs)

data/lib/view_component/system_test_helpers.rb

@@ -7,6 +7,7 @@ module ViewComponent
     # Returns a block that can be used to visit the path of the inline rendered component.
     # @param fragment [Nokogiri::Fragment] The fragment returned from `render_inline`.
     # @param layout [String] The (optional) layout to use.
+    #
     # @return [Proc] A block that can be used to visit the path of the inline rendered component.
     def with_rendered_component_path(fragment, layout: false, &block)
       file = Tempfile.new(