view_component 4.10.0 → 4.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: af6c301478d5448d3784a0dd502e0baee242ee766a48aa0a9615aa1612bd9ceb
-  data.tar.gz: e58be6763cb626c356f002a87d354297471eed752a912315b5fcd885f66b5652
+  metadata.gz: b2f1a7d34956fc9ae629c0f0e710f4a7335b33ebc99f1c3eccafc41d19713524
+  data.tar.gz: efd4bec7d2425da171f89f28fbc1bfaf9f2cba94fd0f2a9cbce674830281938e
 SHA512:
-  metadata.gz: 58728c661bc715b65307ecce22fcd97552be486e788be3e3fedd7f308c214ab318d5a92fdf71c43330f376b134c0c6ae4f3588f1e3685eb0796aa7fead47da8e
-  data.tar.gz: 845b3ffbd2fcfe4732f0970867568de978152a2fc3360b8b8b0d2038ee3dc03df0b7e0784e3cefc9b96c5cc57672fe56e5917ce7f072efd4f68c218cd843cc6d
+  metadata.gz: 5d0f5024d419a56b5e178f0cce3d77ac4a1ae2d4d3efc0ac5334e7b55a4dcb6cc7460aa4d60a47bce63918b0a452b53c5425297ef03da2ce074793407acef570
+  data.tar.gz: be1d649efec64995de234eb70998001d42cd9b0197bdce00ec5011d68cb2a2784925abf283b3f51c3986a55a446db3ba0c17cedf406c919e31b178ece2be6b51

data/docs/CHANGELOG.md

@@ -10,6 +10,26 @@ nav_order: 6
 
 ## main
 
+## 4.12.0
+
+* Fix stale render context on reused component instances. A `ViewComponent::Base` instance memoized its controller, helpers, request, view context, lookup context, view flow, and requested format details on first render via `||=`. Rendering the same instance a second time (intentionally or via aliasing) reused that stale context, which could leak data across requests, sessions, or users. `#render_in` now resets these ivars on every call so each render derives its context from the current view.
+
+    *Joel Hawksley*
+
+* Fix HTML-safety bypass in `around_render`. `ViewComponent::Base#around_render` could return HTML-unsafe strings that bypassed the escaping applied to normal `#call` return values, creating an XSS risk. The vulnerability was amplified in `ViewComponent::Collection#render_in`, which joined per-item results and unconditionally marked the output `html_safe`. HTML-unsafe strings returned from `around_render` are now escaped (with a warning) and `Collection#render_in` now uses `safe_join` so unsafe per-item output is escaped instead of laundered into a `SafeBuffer`.
+
+    *Joel Hawksley*
+
+## 4.11.0
+
+* Update `render_in` signature to accept `**_` for compatibility with Rails [#50623](https://github.com/rails/rails/pull/50623).
+
+    *Joel Hawksley*
+
+* Fix translation scope resolution in nested lambda-backed slots. Relative `t(".key")` calls inside lambda-backed slots were resolving against an intermediate component's scope instead of the original partial's scope where the block was defined.
+
+    *Artin Boghosian*
+
 ## 4.10.0
 
 * Fix `NameError: uninitialized constant ViewComponent::SystemTestControllerNefariousPathError` when booting in the test environment with `eager_load = true`.

data/lib/view_component/base.rb

@@ -103,25 +103,27 @@ module ViewComponent
     # Returns HTML that has been escaped by the respective template handler.
     #
     # @return [String]
-    def render_in(view_context, &block)
+    def render_in(view_context, **_, &block)
       self.class.__vc_compile(raise_errors: true)
 
+      __vc_reset_render_state!
+
       @view_context = view_context
       @old_virtual_path = view_context.instance_variable_get(:@virtual_path)
-      self.__vc_original_view_context ||= view_context
+      self.__vc_original_view_context = view_context
 
       @output_buffer = view_context.output_buffer
 
-      @lookup_context ||= view_context.lookup_context
+      @lookup_context = view_context.lookup_context
 
       # For content_for
-      @view_flow ||= view_context.view_flow
+      @view_flow = view_context.view_flow
 
       # For i18n
       @virtual_path ||= virtual_path
 
       # Describes the inferred request constraints (locales, formats, variants)
-      @__vc_requested_details ||= @lookup_context.vc_requested_details
+      @__vc_requested_details = @lookup_context.vc_requested_details
 
       # For caching, such as #cache_if
       @current_template = nil unless defined?(@current_template)
@@ -142,10 +144,21 @@ module ViewComponent
         value = nil
 
         @output_buffer.with_buffer do
-          rendered_template =
-            around_render do
-              render_template_for(@__vc_requested_details).to_s
-            end
+          inner_rendered_template = nil
+          around_rendered_template = around_render do
+            inner_rendered_template = render_template_for(@__vc_requested_details).to_s
+          end
+
+          # If `around_render` returned the same object the block yielded, the inner
+          # template's escaping is authoritative and we can trust the result. If the
+          # user replaced/wrapped the value, re-check HTML safety to prevent
+          # bypassing the escaping applied to normal `#call` return values
+          # (GHSA-97jw-64cj-jc58).
+          rendered_template = if around_rendered_template.equal?(inner_rendered_template)
+            around_rendered_template
+          else
+            __vc_safe_around_render_output(around_rendered_template)
+          end
 
           # Avoid allocating new string when output_preamble and output_postamble are blank
           value = if output_preamble.blank? && output_postamble.blank?
@@ -255,7 +268,7 @@ module ViewComponent
     # @private
     def render(options = {}, args = {}, &block)
       if options.respond_to?(:set_original_view_context)
-        options.set_original_view_context(self.__vc_original_view_context)
+        options.set_original_view_context(__vc_original_view_context)
 
         # We assume options is a component, so there's no need to evaluate the
         # block in the view context as we do below.
@@ -444,6 +457,28 @@ module ViewComponent
       end
     end
 
+    def __vc_safe_around_render_output(output)
+      __vc_maybe_escape_html(output) do
+        Kernel.warn("WARNING: The #{self.class} component's around_render returned an HTML-unsafe string. The output will be automatically escaped, but you may want to investigate.")
+      end
+    end
+
+    # Resets every render-scoped instance variable derived from the calling view
+    # context so a reused instance cannot leak controller/helper/request/format
+    # state from a previous render. Slot state (`@__vc_set_slots`,
+    # `@__vc_content_set_by_with_content`) is intentionally preserved because it
+    # is populated by callers _before_ `render_in` runs (e.g. via `with_*`
+    # slot setters or `with_content`).
+    def __vc_reset_render_state!
+      %i[
+        @__vc_controller
+        @__vc_helpers
+        @__vc_request
+      ].each do |ivar|
+        remove_instance_variable(ivar) if instance_variable_defined?(ivar)
+      end
+    end
+
     # Configuration for generators.
     #
     # All options under this namespace default to `false` unless otherwise

data/lib/view_component/collection.rb

@@ -1,19 +1,22 @@
 # frozen_string_literal: true
 
 require "action_view/renderer/collection_renderer"
+require "action_view/helpers/output_safety_helper"
 
 module ViewComponent
   class Collection
     include Enumerable
+    include ActionView::Helpers::OutputSafetyHelper
 
     attr_reader :component
 
     delegate :size, to: :@collection
 
-    def render_in(view_context, &block)
-      components.map do |component|
+    def render_in(view_context, **_, &block)
+      rendered = components.map do |component|
         component.render_in(view_context, &block)
-      end.join(rendered_spacer(view_context)).html_safe
+      end
+      safe_join(rendered, rendered_spacer(view_context))
     end
 
     def each(&block)
@@ -30,15 +33,15 @@ module ViewComponent
 
     private
 
+    # Always rebuild child component instances per render to avoid leaking
+    # request-scoped state from a previous render into a later one (GHSA).
     def components
-      return @components if defined? @components
-
       iterator = ActionView::PartialIteration.new(@collection.size)
 
       component.__vc_validate_collection_parameter!(validate_default: true)
 
-      @components = @collection.map do |item|
-        component.new(**component_options(item, iterator)).tap do |component|
+      @collection.map do |item|
+        component.new(**component_options(item, iterator)).tap do |_|
           iterator.iterate!
         end
       end
@@ -67,12 +70,12 @@ module ViewComponent
       @options.merge(item_options)
     end
 
+    # Render the spacer through a fresh `dup` so a collection rendered multiple
+    # times always gets a clean spacer instance.
     def rendered_spacer(view_context)
-      if @spacer_component
-        @spacer_component.render_in(view_context)
-      else
-        ""
-      end
+      return "" unless @spacer_component
+
+      @spacer_component.dup.render_in(view_context)
     end
   end
 end

data/lib/view_component/instrumentation.rb

@@ -8,7 +8,7 @@ module ViewComponent # :nodoc:
       mod.prepend(self) unless self <= ViewComponent::Instrumentation
     end
 
-    def render_in(view_context, &block)
+    def render_in(view_context, **_, &block)
       return super if !Rails.application.config.view_component.instrumentation_enabled.present?
 
       payload = {

data/lib/view_component/slotable.rb

@@ -380,6 +380,7 @@ module ViewComponent
     def __vc_set_slot(slot_name, slot_definition = nil, *args, **kwargs, &block)
       slot_definition ||= self.class.registered_slots[slot_name]
       slot = Slot.new(self)
+      captured_block_virtual_path = nil
 
       # Passing the block to the sub-component wrapper like this has two
       # benefits:
@@ -394,7 +395,8 @@ module ViewComponent
         slot.__vc_content_block = block
         # Capture the virtual path at the time the block is defined, so that
         # translations resolve relative to where the block was created, not where it's rendered
-        slot.__vc_content_block_virtual_path = view_context.instance_variable_get(:@virtual_path)
+        captured_block_virtual_path = view_context.instance_variable_get(:@virtual_path)
+        slot.__vc_content_block_virtual_path = captured_block_virtual_path
       end
 
       # If class
@@ -413,7 +415,7 @@ module ViewComponent
         renderable_value =
           if block
             renderable_function.call(*args, **kwargs) do |*rargs|
-              with_captured_virtual_path(@old_virtual_path) do
+              with_captured_virtual_path(captured_block_virtual_path) do
                 view_context.capture(*rargs, &block)
               end
             end

data/lib/view_component/version.rb

@@ -3,7 +3,7 @@
 module ViewComponent
   module VERSION
     MAJOR = 4
-    MINOR = 10
+    MINOR = 12
     PATCH = 0
     PRE = nil
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: view_component
 version: !ruby/object:Gem::Version
-  version: 4.10.0
+  version: 4.12.0
 platform: ruby
 authors:
 - ViewComponent Team
@@ -135,7 +135,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.10
 specification_version: 4
 summary: A framework for building reusable, testable & encapsulated view components
   in Ruby on Rails.