view_component 4.8.0 → 4.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cd32d6d38604882019810f1213145bafb749c66b57d4edcee32902092f436ab
-  data.tar.gz: c29d17a4f72223b7e342e5f224fc39505d3bc50cb1a8174db6371c6d6b8ded6b
+  metadata.gz: bd12f6e6a2acbb991781956cb7677076cc652b7f90519649d6d5503073feb364
+  data.tar.gz: bd5b8a5ef52c8f88c718c534f75626a208cba7a77f2bbced2cf22fcde70a226d
 SHA512:
-  metadata.gz: aecaee657c788ae3395994d2234711101fc58f5439f9488993e9b928cb103abba5f5add66d53719259c4f6069a661b7e0a2c3a96ce3c990ca1191fa92b2933fd
-  data.tar.gz: 87688cbcfeb6a50be556a435b97e0ff6541fdb4383589b24971c7a6c0caee61d506acee766da36b76345d780cdb0877a6ebff3fb4965c1cb7d1b2878f65e4aab
+  metadata.gz: d580739f741633eb2db4f16a45a21ad0b23118021383395fb4435ff63a381b2fb08b800a1acb2b997f7d6e7f6d28f654e55d6a14cd261944b8820787b988751c
+  data.tar.gz: 40592ea9f341b2cd8c11971028825e6456bf5092799f69d7cfc753443c5c6672208c102522c3ec47cfbbdf282049251800f14a8dfc6a7895c3c4e8a4b275be75

data/app/controllers/view_components_system_test_controller.rb

@@ -8,18 +8,27 @@ class ViewComponentsSystemTestController < ActionController::Base # :nodoc:
       @_tmpdir ||= FileUtils.mkdir_p("./tmp/view_components/").first
     end
 
+    rescue_from ViewComponent::SystemTestControllerNefariousPathError, with: :render_not_found
+
     def system_test_entrypoint
       render file: @path
     end
 
     private
 
+    def render_not_found
+      head :not_found
+    end
+
     # Ensure that the file path is valid and doesn't target files outside
     # the expected directory (e.g. via a path traversal or symlink attack)
     def validate_file_path
       base_path = ::File.realpath(self.class.temp_dir)
       @path = ::File.realpath(params.permit(:file)[:file], base_path)
-      raise ViewComponent::SystemTestControllerNefariousPathError unless @path.start_with?(base_path)
+      allowed_prefix = "#{base_path}#{::File::SEPARATOR}"
+      unless @path == base_path || @path.start_with?(allowed_prefix)
+        raise ViewComponent::SystemTestControllerNefariousPathError
+      end
     end
   end
 end

data/docs/CHANGELOG.md

@@ -10,6 +10,20 @@ nav_order: 6
 
 ## main
 
+## 4.9.0
+
+* Fix path traversal vulnerability in `ViewComponentsSystemTestController` where sibling directories sharing a string prefix with the allowed temp directory could bypass the path containment check. The `start_with?` check has been replaced with a separator-aware prefix check, and nefarious path errors now return a 404 instead of an unhandled exception.
+
+    *Joel Hawksley*
+
+* Fix preview route vulnerability where inherited methods on `ViewComponent::Preview` (such as `render_with_template`) could be invoked via the preview URL, allowing arbitrary internal Rails templates to be rendered with attacker-controlled locals and request parameters. `render_args` now raises `AbstractController::ActionNotFound` for any example not explicitly declared on the preview subclass.
+
+    *Joel Hawksley*
+
+* Add `yard-lint` to CI.
+
+    *Joel Hawksley*
+
 ## 4.8.0
 
 * Add `compile.view_component` ActiveSupport::Notifications event for eager compilation at boot time.

data/lib/view_component/compiler.rb

@@ -57,9 +57,8 @@ module ViewComponent
       end
     end
 
+    # @param requested_details [ActionView::TemplateDetails::Requested] i.e. locales, formats, variants
     # @return all matching compiled templates, in priority order based on the requested details from LookupContext
-    #
-    # @param [ActionView::TemplateDetails::Requested] requested_details i.e. locales, formats, variants
     def find_templates_for(requested_details)
       filtered_templates = @templates.select do |template|
         template.details.matches?(requested_details)

data/lib/view_component/engine.rb

@@ -81,7 +81,11 @@ module ViewComponent
       ActiveSupport.on_load(:after_initialize) do
         if Rails.application.config.eager_load
           ActiveSupport::Notifications.instrument("compile.view_component") do
-            ViewComponent::Base.descendants.each(&:__vc_compile)
+            ViewComponent::Base.descendants.each do |component|
+              next if component.anonymous?
+
+              component.__vc_compile
+            end
           end
         end
       end

data/lib/view_component/preview.rb

@@ -40,6 +40,8 @@ module ViewComponent # :nodoc:
 
       # Returns the arguments for rendering of the component in its layout
       def render_args(example, params: {})
+        raise AbstractController::ActionNotFound, "#{example} is not a valid preview example" unless examples.include?(example.to_s)
+
         example_params_names = instance_method(example).parameters.map(&:last)
         provided_params = params.slice(*example_params_names).to_h.symbolize_keys
         result = provided_params.empty? ? new.public_send(example) : new.public_send(example, **provided_params)

data/lib/view_component/slot.rb

@@ -96,7 +96,6 @@ module ViewComponent
     #     end
     #   end
     # end
-    #
     def method_missing(symbol, *args, **kwargs, &block)
       @__vc_component_instance.public_send(symbol, *args, **kwargs, &block)
     end

data/lib/view_component/test_helpers.rb

@@ -71,17 +71,16 @@ module ViewComponent
     # assert_text("Hello, World!")
     # ```
     #
-    # Note: `#rendered_preview` expects a preview to be defined with the same class
-    # name as the calling test, but with `Test` replaced with `Preview`:
-    #
-    # MyComponentTest -> MyComponentPreview etc.
-    #
-    # In RSpec, `Preview` is appended to `described_class`.
-    #
     # @param name [String] The name of the preview to be rendered.
     # @param from [ViewComponent::Preview] The class of the preview to be rendered.
     # @param params [Hash] Parameters to be passed to the preview.
     # @return [Nokogiri::HTML5]
+    # @note `#rendered_preview` expects a preview to be defined with the same class
+    #   name as the calling test, but with `Test` replaced with `Preview`:
+    #
+    #   MyComponentTest -> MyComponentPreview etc.
+    #
+    #   In RSpec, `Preview` is appended to `described_class`.
     def render_preview(name, from: __vc_test_helpers_preview_class, params: {})
       previews_controller = __vc_test_helpers_build_controller(Rails.application.config.view_component.previews.controller.constantize)
 
@@ -125,7 +124,7 @@ module ViewComponent
     # end
     # ```
     #
-    # @param variants [Symbol[]] The variants to be set for the provided block.
+    # @param variants [Array<Symbol>] The variants to be set for the provided block.
     def with_variant(*variants)
       old_variants = vc_test_controller.view_context.lookup_context.variants
 
@@ -162,7 +161,7 @@ module ViewComponent
     # end
     # ```
     #
-    # @param formats [Symbol[]] The format(s) to be set for the provided block.
+    # @param formats [Array<Symbol>] The format(s) to be set for the provided block.
     def with_format(*formats)
       old_formats = vc_test_controller.view_context.lookup_context.formats
 

data/lib/view_component/version.rb

@@ -3,7 +3,7 @@
 module ViewComponent
   module VERSION
     MAJOR = 4
-    MINOR = 8
+    MINOR = 9
     PATCH = 0
     PRE = nil
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: view_component
 version: !ruby/object:Gem::Version
-  version: 4.8.0
+  version: 4.9.0
 platform: ruby
 authors:
 - ViewComponent Team