view_component 3.26.0 → 3.27.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7646c2f512d91517ac31ba0f2f039ef7c486ce4e5eec74d1fe5ca742a24f48b5
-  data.tar.gz: 548a7e762a5e2b2970a79d7debba10747adffe62c1a946eb12eb689d0bbb04de
+  metadata.gz: ea3b7eaa6244e04ffa83e7c9d4aeafca18230bedcce0fb160b1001b0441270b0
+  data.tar.gz: aa605998a6e975f74c307faca61ec6d10b837cdee83c48fe2424e5b6421daf8a
 SHA512:
-  metadata.gz: c880684d390ecb0c5a8b62ed329fe2883623bea9e61371666ba5e7aa1eca31f92af9d2e6558a728e195cd756a3390b4154cb024b1d613fd47a111f7b5452f60f
-  data.tar.gz: be6a18ae9ed76ed5c2f71641e43b56fb32d67f8655f044d15f02e36da168539155e2de84e1ee6f2e1f195247832e1b6e11fc9d5bc75b1d02ec3cf92bfa8ce266
+  metadata.gz: a3ec820b42851cb62062972e1473ebb508798e0acd63bfff6e6fda1087c62776806c0199a9e11d6b13bd2914330bf0ad1cb899511c55f62af1538be7a9292a13
+  data.tar.gz: 748b43b70dec2efc5319bec3379f6b7cf115789f731e3a32af789c304644d20f14d62c9bc727ab88baa4a52dbeba806f8f403dcee1bcf1bc9a6df6ee73f0d412

data/docs/CHANGELOG.md

@@ -10,6 +10,12 @@ nav_order: 6
 
 ## main
 
+## 3.27.0
+
+* [Security] Fix incomplete remediation for CVE-2026-54497 (GHSA-8qw7-6phv-7q6p): reused ViewComponent instances could still leak `with_content` and `renders_one`/`renders_many` slot content from an earlier render into a later render because slot state and content set via `with_content` are populated by the caller before `render_in` runs and were not cleared by the previous per-render reset. Reinstate the `ViewComponent::ReusedInstanceError` guard that raises when a component instance is rendered more than once. Rebuild collection child components per render and dup collection spacer components before each render so that legitimate re-rendering of `Collection`/spacer objects continues to work.
+
+    *Yazan Balawneh, Cystack.ps*
+
 ## 3.26.0
 
 * Fix rendering partials from components rendered as a collection when the original view context is explicitly stashed as `nil`.

data/lib/view_component/base.rb

@@ -83,6 +83,7 @@ module ViewComponent
     def render_in(view_context, **options, &block)
       self.class.compile(raise_errors: true)
 
+      __vc_check_reused_instance!
       __vc_reset_render_state!
 
       @view_context = view_context
@@ -137,6 +138,7 @@ module ViewComponent
       end
     ensure
       @current_template = old_current_template
+      @__vc_rendered = true
     end
 
     # Subclass components that call `super` inside their template code will cause a
@@ -410,7 +412,9 @@ module ViewComponent
     # state from a previous render. Slot state (`@__vc_set_slots`,
     # `@__vc_content_set_by_with_content`) is intentionally preserved because it
     # is populated by callers _before_ `render_in` runs (e.g. via `with_*`
-    # slot setters or `with_content`).
+    # slot setters or `with_content`); reuse of an instance that has slot or
+    # `with_content` state is guarded against separately by
+    # `__vc_check_reused_instance!`.
     def __vc_reset_render_state!
       %i[
         @__vc_controller
@@ -422,6 +426,17 @@ module ViewComponent
       end
     end
 
+    # Raises when a component instance is rendered more than once.
+    # Reusing a component instance across renders can leak request-scoped state
+    # (controller, helpers, request, view_flow, slot content, `with_content`)
+    # from an earlier render into a later one. See
+    # `ViewComponent::ReusedInstanceError` and GHSA-8qw7-6phv-7q6p.
+    def __vc_check_reused_instance!
+      return unless defined?(@__vc_rendered) && @__vc_rendered
+
+      raise ReusedInstanceError.new(self.class.name)
+    end
+
     # Configuration for generators.
     #
     # All options under this namespace default to `false` unless otherwise

data/lib/view_component/collection.rb

@@ -72,13 +72,18 @@ module ViewComponent
       @options.merge(item_options)
     end
 
+    # Render the spacer through a fresh `dup` so a collection rendered multiple
+    # times does not reuse (and trip the single-render guard on) the spacer
+    # instance passed by the caller.
     def rendered_spacer(view_context)
-      if @spacer_component
-        @spacer_component.set_original_view_context(__vc_original_view_context) if @spacer_component.respond_to?(:set_original_view_context)
-        @spacer_component.render_in(view_context)
-      else
-        ""
+      return "" unless @spacer_component
+
+      spacer = @spacer_component.dup
+      if spacer.instance_variable_defined?(:@__vc_rendered)
+        spacer.remove_instance_variable(:@__vc_rendered)
       end
+      spacer.set_original_view_context(__vc_original_view_context) if spacer.respond_to?(:set_original_view_context)
+      spacer.render_in(view_context)
     end
   end
 end

data/lib/view_component/errors.rb

@@ -175,6 +175,19 @@ module ViewComponent
       "To fix this issue, pass a value."
   end
 
+  class ReusedInstanceError < StandardError
+    MESSAGE =
+      "ViewComponent instances are single-use; a COMPONENT instance was rendered more than once.\n\n" \
+      "Reusing a component instance across renders can leak request-scoped state " \
+      "(controller, helpers, request, view_flow, slot content, `with_content`) from an earlier render " \
+      "into a later one, which has security and correctness implications (GHSA-8qw7-6phv-7q6p).\n\n" \
+      "To fix this issue, create a new component instance per render."
+
+    def initialize(klass_name)
+      super(MESSAGE.gsub("COMPONENT", klass_name.to_s))
+    end
+  end
+
   class TranslateCalledBeforeRenderError < BaseError
     MESSAGE =
       "`#translate` can't be used before rendering as it depends " \

data/lib/view_component/version.rb

@@ -3,7 +3,7 @@
 module ViewComponent
   module VERSION
     MAJOR = 3
-    MINOR = 26
+    MINOR = 27
     PATCH = 0
     PRE = nil
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: view_component
 version: !ruby/object:Gem::Version
-  version: 3.26.0
+  version: 3.27.0
 platform: ruby
 authors:
 - ViewComponent Team