view_component 4.8.0 → 4.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cd32d6d38604882019810f1213145bafb749c66b57d4edcee32902092f436ab
-  data.tar.gz: c29d17a4f72223b7e342e5f224fc39505d3bc50cb1a8174db6371c6d6b8ded6b
+  metadata.gz: af6c301478d5448d3784a0dd502e0baee242ee766a48aa0a9615aa1612bd9ceb
+  data.tar.gz: e58be6763cb626c356f002a87d354297471eed752a912315b5fcd885f66b5652
 SHA512:
-  metadata.gz: aecaee657c788ae3395994d2234711101fc58f5439f9488993e9b928cb103abba5f5add66d53719259c4f6069a661b7e0a2c3a96ce3c990ca1191fa92b2933fd
-  data.tar.gz: 87688cbcfeb6a50be556a435b97e0ff6541fdb4383589b24971c7a6c0caee61d506acee766da36b76345d780cdb0877a6ebff3fb4965c1cb7d1b2878f65e4aab
+  metadata.gz: 58728c661bc715b65307ecce22fcd97552be486e788be3e3fedd7f308c214ab318d5a92fdf71c43330f376b134c0c6ae4f3588f1e3685eb0796aa7fead47da8e
+  data.tar.gz: 845b3ffbd2fcfe4732f0970867568de978152a2fc3360b8b8b0d2038ee3dc03df0b7e0784e3cefc9b96c5cc57672fe56e5917ce7f072efd4f68c218cd843cc6d

data/app/controllers/view_components_system_test_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "view_component/errors"
+
 class ViewComponentsSystemTestController < ActionController::Base # :nodoc:
   if Rails.env.test?
     before_action :validate_file_path
@@ -8,18 +10,27 @@ class ViewComponentsSystemTestController < ActionController::Base # :nodoc:
       @_tmpdir ||= FileUtils.mkdir_p("./tmp/view_components/").first
     end
 
+    rescue_from ViewComponent::SystemTestControllerNefariousPathError, with: :render_not_found
+
     def system_test_entrypoint
       render file: @path
     end
 
     private
 
+    def render_not_found
+      head :not_found
+    end
+
     # Ensure that the file path is valid and doesn't target files outside
     # the expected directory (e.g. via a path traversal or symlink attack)
     def validate_file_path
       base_path = ::File.realpath(self.class.temp_dir)
       @path = ::File.realpath(params.permit(:file)[:file], base_path)
-      raise ViewComponent::SystemTestControllerNefariousPathError unless @path.start_with?(base_path)
+      allowed_prefix = "#{base_path}#{::File::SEPARATOR}"
+      unless @path == base_path || @path.start_with?(allowed_prefix)
+        raise ViewComponent::SystemTestControllerNefariousPathError
+      end
     end
   end
 end

data/docs/CHANGELOG.md

@@ -10,6 +10,30 @@ nav_order: 6
 
 ## main
 
+## 4.10.0
+
+* Fix `NameError: uninitialized constant ViewComponent::SystemTestControllerNefariousPathError` when booting in the test environment with `eager_load = true`.
+
+    *Joel Hawksley*
+
+* Fix yielded content rendered at wrong location when using form helpers.
+
+    *Joel Hawksley*, *Markus*
+
+## 4.9.0
+
+* Fix path traversal vulnerability in `ViewComponentsSystemTestController` where sibling directories sharing a string prefix with the allowed temp directory could bypass the path containment check. The `start_with?` check has been replaced with a separator-aware prefix check, and nefarious path errors now return a 404 instead of an unhandled exception.
+
+    *Joel Hawksley*
+
+* Fix preview route vulnerability where inherited methods on `ViewComponent::Preview` (such as `render_with_template`) could be invoked via the preview URL, allowing arbitrary internal Rails templates to be rendered with attacker-controlled locals and request parameters. `render_args` now raises `AbstractController::ActionNotFound` for any example not explicitly declared on the preview subclass.
+
+    *Joel Hawksley*
+
+* Add `yard-lint` to CI.
+
+    *Joel Hawksley*
+
 ## 4.8.0
 
 * Add `compile.view_component` ActiveSupport::Notifications event for eager compilation at boot time.

data/lib/view_component/base.rb

@@ -82,6 +82,7 @@ module ViewComponent
     # so helpers, etc work as expected.
     #
     # @param view_context [ActionView::Base] The original view context.
+    #
     # @return [void]
     def set_original_view_context(view_context)
       # noop
@@ -278,6 +279,22 @@ module ViewComponent
       end
     end
 
+    # Sync @output_buffer with the view context's current output buffer before
+    # capturing. Form helpers create builders with @template_object pointing to
+    # the component. When those builders later call capture inside a partial
+    # (whose _run allocated a fresh OutputBuffer on the view context), the
+    # component's stale @output_buffer would capture from the wrong buffer.
+    # Temporarily switching to the view context's buffer keeps both in sync.
+    #
+    # @private
+    def capture(...)
+      old_output_buffer = @output_buffer
+      @output_buffer = view_context.output_buffer if view_context
+      super
+    ensure
+      @output_buffer = old_output_buffer
+    end
+
     # The current controller. Use sparingly as doing so introduces coupling
     # that inhibits encapsulation & reuse, often making testing difficult.
     #

data/lib/view_component/compiler.rb

@@ -57,9 +57,9 @@ module ViewComponent
       end
     end
 
-    # @return all matching compiled templates, in priority order based on the requested details from LookupContext
+    # @param requested_details [ActionView::TemplateDetails::Requested] i.e. locales, formats, variants
     #
-    # @param [ActionView::TemplateDetails::Requested] requested_details i.e. locales, formats, variants
+    # @return all matching compiled templates, in priority order based on the requested details from LookupContext
     def find_templates_for(requested_details)
       filtered_templates = @templates.select do |template|
         template.details.matches?(requested_details)

data/lib/view_component/config.rb

@@ -19,6 +19,7 @@ module ViewComponent
       end
 
       # @!attribute generate
+      #
       # @return [ActiveSupport::OrderedOptions]
       # The subset of configuration options relating to generators.
       #
@@ -95,6 +96,7 @@ module ViewComponent
       # in `spec/views/components/` rather than the default `spec/components/`.
 
       # @!attribute previews
+      #
       # @return [ActiveSupport::OrderedOptions]
       # The subset of configuration options relating to previews.
       #
@@ -124,6 +126,7 @@ module ViewComponent
       #
 
       # @!attribute instrumentation_enabled
+      #
       # @return [Boolean]
       # Whether ActiveSupport notifications are enabled.
       # Defaults to `false`.
@@ -171,6 +174,7 @@ module ViewComponent
     end
 
     # @!attribute current
+    #
     # @return [ViewComponent::Config]
     # Returns the current ViewComponent::Config. This is persisted against this
     # class so that config options remain accessible before the rest of

data/lib/view_component/engine.rb

@@ -81,7 +81,11 @@ module ViewComponent
       ActiveSupport.on_load(:after_initialize) do
         if Rails.application.config.eager_load
           ActiveSupport::Notifications.instrument("compile.view_component") do
-            ViewComponent::Base.descendants.each(&:__vc_compile)
+            ViewComponent::Base.descendants.each do |component|
+              next if component.anonymous?
+
+              component.__vc_compile
+            end
           end
         end
       end

data/lib/view_component/preview.rb

@@ -40,6 +40,8 @@ module ViewComponent # :nodoc:
 
       # Returns the arguments for rendering of the component in its layout
       def render_args(example, params: {})
+        raise AbstractController::ActionNotFound, "#{example} is not a valid preview example" unless examples.include?(example.to_s)
+
         example_params_names = instance_method(example).parameters.map(&:last)
         provided_params = params.slice(*example_params_names).to_h.symbolize_keys
         result = provided_params.empty? ? new.public_send(example) : new.public_send(example, **provided_params)

data/lib/view_component/slot.rb

@@ -96,7 +96,6 @@ module ViewComponent
     #     end
     #   end
     # end
-    #
     def method_missing(symbol, *args, **kwargs, &block)
       @__vc_component_instance.public_send(symbol, *args, **kwargs, &block)
     end

data/lib/view_component/system_test_helpers.rb

@@ -7,6 +7,7 @@ module ViewComponent
     # Returns a block that can be used to visit the path of the inline rendered component.
     # @param fragment [Nokogiri::Fragment] The fragment returned from `render_inline`.
     # @param layout [String] The (optional) layout to use.
+    #
     # @return [Proc] A block that can be used to visit the path of the inline rendered component.
     def with_rendered_component_path(fragment, layout: false, &block)
       file = Tempfile.new(

data/lib/view_component/test_helpers.rb

@@ -35,6 +35,7 @@ module ViewComponent
     # ```
     #
     # @param component [ViewComponent::Base, ViewComponent::Collection] The instance of the component to be rendered.
+    #
     # @return [Nokogiri::HTML5]
     def render_inline(component, **args, &block)
       @page = nil
@@ -71,17 +72,18 @@ module ViewComponent
     # assert_text("Hello, World!")
     # ```
     #
-    # Note: `#rendered_preview` expects a preview to be defined with the same class
-    # name as the calling test, but with `Test` replaced with `Preview`:
-    #
-    # MyComponentTest -> MyComponentPreview etc.
-    #
-    # In RSpec, `Preview` is appended to `described_class`.
-    #
     # @param name [String] The name of the preview to be rendered.
     # @param from [ViewComponent::Preview] The class of the preview to be rendered.
     # @param params [Hash] Parameters to be passed to the preview.
+    #
     # @return [Nokogiri::HTML5]
+    #
+    # @note `#rendered_preview` expects a preview to be defined with the same class
+    #   name as the calling test, but with `Test` replaced with `Preview`:
+    #
+    #   MyComponentTest -> MyComponentPreview etc.
+    #
+    #   In RSpec, `Preview` is appended to `described_class`.
     def render_preview(name, from: __vc_test_helpers_preview_class, params: {})
       previews_controller = __vc_test_helpers_build_controller(Rails.application.config.view_component.previews.controller.constantize)
 
@@ -125,7 +127,7 @@ module ViewComponent
     # end
     # ```
     #
-    # @param variants [Symbol[]] The variants to be set for the provided block.
+    # @param variants [Array<Symbol>] The variants to be set for the provided block.
     def with_variant(*variants)
       old_variants = vc_test_controller.view_context.lookup_context.variants
 
@@ -162,7 +164,7 @@ module ViewComponent
     # end
     # ```
     #
-    # @param formats [Symbol[]] The format(s) to be set for the provided block.
+    # @param formats [Array<Symbol>] The format(s) to be set for the provided block.
     def with_format(*formats)
       old_formats = vc_test_controller.view_context.lookup_context.formats
 

data/lib/view_component/version.rb

@@ -3,7 +3,7 @@
 module ViewComponent
   module VERSION
     MAJOR = 4
-    MINOR = 8
+    MINOR = 10
     PATCH = 0
     PRE = nil
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: view_component
 version: !ruby/object:Gem::Version
-  version: 4.8.0
+  version: 4.10.0
 platform: ruby
 authors:
 - ViewComponent Team