view_component 4.11.0 → 4.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 13c7279c5aed2ac93503d70cfddae8b183b91c8a4ca0770a237d0b5aa081036c
-  data.tar.gz: 5fd930eb6b28a01da1152fd7d4a09e8019de0902f0508e4ea6aa0f23d6c584bd
+  metadata.gz: b2f1a7d34956fc9ae629c0f0e710f4a7335b33ebc99f1c3eccafc41d19713524
+  data.tar.gz: efd4bec7d2425da171f89f28fbc1bfaf9f2cba94fd0f2a9cbce674830281938e
 SHA512:
-  metadata.gz: d691402cf227340f287c804e6a0ce639928ca2d409dd745701eae63dba20abdae2d3b876fb6d2c81d8b63f3a4ba9b0af7aa4268da5faf37c2fff5f3f7aa9b7ee
-  data.tar.gz: f9a554a6d53d75875c9863a1dedba3e6a51efd134e35dd43f5eb2883e446d5cab2ecba06f9a1fddd7e81d8e046aa5d0383585d9563f12897b4530606e225906c
+  metadata.gz: 5d0f5024d419a56b5e178f0cce3d77ac4a1ae2d4d3efc0ac5334e7b55a4dcb6cc7460aa4d60a47bce63918b0a452b53c5425297ef03da2ce074793407acef570
+  data.tar.gz: be1d649efec64995de234eb70998001d42cd9b0197bdce00ec5011d68cb2a2784925abf283b3f51c3986a55a446db3ba0c17cedf406c919e31b178ece2be6b51

data/docs/CHANGELOG.md

@@ -10,6 +10,16 @@ nav_order: 6
 
 ## main
 
+## 4.12.0
+
+* Fix stale render context on reused component instances. A `ViewComponent::Base` instance memoized its controller, helpers, request, view context, lookup context, view flow, and requested format details on first render via `||=`. Rendering the same instance a second time (intentionally or via aliasing) reused that stale context, which could leak data across requests, sessions, or users. `#render_in` now resets these ivars on every call so each render derives its context from the current view.
+
+    *Joel Hawksley*
+
+* Fix HTML-safety bypass in `around_render`. `ViewComponent::Base#around_render` could return HTML-unsafe strings that bypassed the escaping applied to normal `#call` return values, creating an XSS risk. The vulnerability was amplified in `ViewComponent::Collection#render_in`, which joined per-item results and unconditionally marked the output `html_safe`. HTML-unsafe strings returned from `around_render` are now escaped (with a warning) and `Collection#render_in` now uses `safe_join` so unsafe per-item output is escaped instead of laundered into a `SafeBuffer`.
+
+    *Joel Hawksley*
+
 ## 4.11.0
 
 * Update `render_in` signature to accept `**_` for compatibility with Rails [#50623](https://github.com/rails/rails/pull/50623).

data/lib/view_component/base.rb

@@ -106,22 +106,24 @@ module ViewComponent
     def render_in(view_context, **_, &block)
       self.class.__vc_compile(raise_errors: true)
 
+      __vc_reset_render_state!
+
       @view_context = view_context
       @old_virtual_path = view_context.instance_variable_get(:@virtual_path)
-      self.__vc_original_view_context ||= view_context
+      self.__vc_original_view_context = view_context
 
       @output_buffer = view_context.output_buffer
 
-      @lookup_context ||= view_context.lookup_context
+      @lookup_context = view_context.lookup_context
 
       # For content_for
-      @view_flow ||= view_context.view_flow
+      @view_flow = view_context.view_flow
 
       # For i18n
       @virtual_path ||= virtual_path
 
       # Describes the inferred request constraints (locales, formats, variants)
-      @__vc_requested_details ||= @lookup_context.vc_requested_details
+      @__vc_requested_details = @lookup_context.vc_requested_details
 
       # For caching, such as #cache_if
       @current_template = nil unless defined?(@current_template)
@@ -142,10 +144,21 @@ module ViewComponent
         value = nil
 
         @output_buffer.with_buffer do
-          rendered_template =
-            around_render do
-              render_template_for(@__vc_requested_details).to_s
-            end
+          inner_rendered_template = nil
+          around_rendered_template = around_render do
+            inner_rendered_template = render_template_for(@__vc_requested_details).to_s
+          end
+
+          # If `around_render` returned the same object the block yielded, the inner
+          # template's escaping is authoritative and we can trust the result. If the
+          # user replaced/wrapped the value, re-check HTML safety to prevent
+          # bypassing the escaping applied to normal `#call` return values
+          # (GHSA-97jw-64cj-jc58).
+          rendered_template = if around_rendered_template.equal?(inner_rendered_template)
+            around_rendered_template
+          else
+            __vc_safe_around_render_output(around_rendered_template)
+          end
 
           # Avoid allocating new string when output_preamble and output_postamble are blank
           value = if output_preamble.blank? && output_postamble.blank?
@@ -255,7 +268,7 @@ module ViewComponent
     # @private
     def render(options = {}, args = {}, &block)
       if options.respond_to?(:set_original_view_context)
-        options.set_original_view_context(self.__vc_original_view_context)
+        options.set_original_view_context(__vc_original_view_context)
 
         # We assume options is a component, so there's no need to evaluate the
         # block in the view context as we do below.
@@ -444,6 +457,28 @@ module ViewComponent
       end
     end
 
+    def __vc_safe_around_render_output(output)
+      __vc_maybe_escape_html(output) do
+        Kernel.warn("WARNING: The #{self.class} component's around_render returned an HTML-unsafe string. The output will be automatically escaped, but you may want to investigate.")
+      end
+    end
+
+    # Resets every render-scoped instance variable derived from the calling view
+    # context so a reused instance cannot leak controller/helper/request/format
+    # state from a previous render. Slot state (`@__vc_set_slots`,
+    # `@__vc_content_set_by_with_content`) is intentionally preserved because it
+    # is populated by callers _before_ `render_in` runs (e.g. via `with_*`
+    # slot setters or `with_content`).
+    def __vc_reset_render_state!
+      %i[
+        @__vc_controller
+        @__vc_helpers
+        @__vc_request
+      ].each do |ivar|
+        remove_instance_variable(ivar) if instance_variable_defined?(ivar)
+      end
+    end
+
     # Configuration for generators.
     #
     # All options under this namespace default to `false` unless otherwise

data/lib/view_component/collection.rb

@@ -1,19 +1,22 @@
 # frozen_string_literal: true
 
 require "action_view/renderer/collection_renderer"
+require "action_view/helpers/output_safety_helper"
 
 module ViewComponent
   class Collection
     include Enumerable
+    include ActionView::Helpers::OutputSafetyHelper
 
     attr_reader :component
 
     delegate :size, to: :@collection
 
     def render_in(view_context, **_, &block)
-      components.map do |component|
+      rendered = components.map do |component|
         component.render_in(view_context, &block)
-      end.join(rendered_spacer(view_context)).html_safe
+      end
+      safe_join(rendered, rendered_spacer(view_context))
     end
 
     def each(&block)
@@ -30,15 +33,15 @@ module ViewComponent
 
     private
 
+    # Always rebuild child component instances per render to avoid leaking
+    # request-scoped state from a previous render into a later one (GHSA).
     def components
-      return @components if defined? @components
-
       iterator = ActionView::PartialIteration.new(@collection.size)
 
       component.__vc_validate_collection_parameter!(validate_default: true)
 
-      @components = @collection.map do |item|
-        component.new(**component_options(item, iterator)).tap do |component|
+      @collection.map do |item|
+        component.new(**component_options(item, iterator)).tap do |_|
           iterator.iterate!
         end
       end
@@ -67,12 +70,12 @@ module ViewComponent
       @options.merge(item_options)
     end
 
+    # Render the spacer through a fresh `dup` so a collection rendered multiple
+    # times always gets a clean spacer instance.
     def rendered_spacer(view_context)
-      if @spacer_component
-        @spacer_component.render_in(view_context)
-      else
-        ""
-      end
+      return "" unless @spacer_component
+
+      @spacer_component.dup.render_in(view_context)
     end
   end
 end

data/lib/view_component/version.rb

@@ -3,7 +3,7 @@
 module ViewComponent
   module VERSION
     MAJOR = 4
-    MINOR = 11
+    MINOR = 12
     PATCH = 0
     PRE = nil
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: view_component
 version: !ruby/object:Gem::Version
-  version: 4.11.0
+  version: 4.12.0
 platform: ruby
 authors:
 - ViewComponent Team