view_component 4.13.0 → 4.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aaf81704d1bb151178b288ef446a657e2d8ac0158768ffee8db3c3e2c530aa29
-  data.tar.gz: 4e2192552574c18ff0dfc4613d797204abe98cd26b6343712c7edb7a4cba65bd
+  metadata.gz: 83cf2f7914c64ec4ca156f19d975d79d311619024fb550fde59c0e6f807ca02c
+  data.tar.gz: 918cc12667440e6a50793addc531431050e06bda525f348c8522487ea0208439
 SHA512:
-  metadata.gz: c06fd1d045b7c78a32cc66d1db448df80b1c2543d6cf9e44ab5bfa4e92c5cfe3d6151f80b24b345168e62dde6b8b400dfb7c28006716494b9e33366376f8cb9d
-  data.tar.gz: ddf8a61600fb66a0e2ae8ce4095e1d9398355ff2c5b19a16e79d8adeaff3da896dc4ecd948c4a13eaac8683df811fb0b578147486e7bfc609773f41532964466
+  metadata.gz: fa5696a0ca7c945fa3ed682fb8f679fd75c462ddb0651b8926e64448392507a5616dcee97218e0a74c3eb4f4d384a89ff2f26fd08d89c9ff86ca961fd6cd410d
+  data.tar.gz: f1ced2760c93c93d46e2ed508ec234abbe498100ccb80d1ef83f6d7c1b17e79b7ecbd44f26745e36a7fef74426da49867bbdef038885b954b04982d788e4c322

data/docs/CHANGELOG.md

@@ -10,6 +10,20 @@ nav_order: 6
 
 ## main
 
+## 4.14.0
+
+* Freeze `ReusedInstanceError::MESSAGE` and update `test_renders_component_with_asset_url` to build a fresh `AssetComponent` per render, fixing CI regressions introduced by the GHSA-8qw7-6phv-7q6p remediation.
+
+    *Joel Hawksley*
+
+* [Security] Fix incomplete remediation for CVE-2026-54497 (GHSA-8qw7-6phv-7q6p): reused ViewComponent instances could still leak `with_content` and `renders_one`/`renders_many` slot content from an earlier render into a later render because slot state and content set via `with_content` are populated by the caller before `render_in` runs and were not cleared by the previous per-render reset. Reinstate the `ViewComponent::ReusedInstanceError` guard that raises when a component instance is rendered more than once. Rebuild collection child components per render and dup collection spacer components before each render so that legitimate re-rendering of `Collection`/spacer objects continues to work.
+
+    *Yazan Balawneh, Cystack.ps*
+
+* Update GitHub Actions workflows to use `actions/checkout` v7.
+
+    *Richard Macklin*
+
 ## 4.13.0
 
 * Add support for Turbo-streaming ViewComponents.

data/lib/view_component/base.rb

@@ -106,6 +106,7 @@ module ViewComponent
     def render_in(view_context, **, &block)
       self.class.__vc_compile(raise_errors: true) unless self.class.__vc_compiled?
 
+      __vc_check_reused_instance!
       __vc_reset_render_state!
 
       @view_context = view_context
@@ -180,6 +181,7 @@ module ViewComponent
     ensure
       view_context.instance_variable_set(:@virtual_path, @old_virtual_path)
       @current_template = old_current_template
+      @__vc_rendered = true
     end
 
     # Subclass components that call `super` inside their template code will cause a
@@ -468,7 +470,9 @@ module ViewComponent
     # state from a previous render. Slot state (`@__vc_set_slots`,
     # `@__vc_content_set_by_with_content`) is intentionally preserved because it
     # is populated by callers _before_ `render_in` runs (e.g. via `with_*`
-    # slot setters or `with_content`).
+    # slot setters or `with_content`); reuse of an instance that has slot or
+    # `with_content` state is guarded against separately by
+    # `__vc_check_reused_instance!`.
     RENDER_STATE_IVARS = %i[
       @__vc_controller
       @__vc_helpers
@@ -481,6 +485,17 @@ module ViewComponent
       end
     end
 
+    # Raises when a component instance is rendered more than once.
+    # Reusing a component instance across renders can leak request-scoped state
+    # (controller, helpers, request, view_flow, slot content, `with_content`)
+    # from an earlier render into a later one. See
+    # `ViewComponent::ReusedInstanceError` and GHSA-8qw7-6phv-7q6p.
+    def __vc_check_reused_instance!
+      return unless defined?(@__vc_rendered) && @__vc_rendered
+
+      raise ReusedInstanceError.new(self.class.name)
+    end
+
     # Configuration for generators.
     #
     # All options under this namespace default to `false` unless otherwise

data/lib/view_component/collection.rb

@@ -72,11 +72,16 @@ module ViewComponent
     end
 
     # Render the spacer through a fresh `dup` so a collection rendered multiple
-    # times always gets a clean spacer instance.
+    # times does not reuse (and trip the single-render guard on) the spacer
+    # instance passed by the caller.
     def rendered_spacer(view_context)
       return "" unless @spacer_component
 
-      @spacer_component.dup.render_in(view_context)
+      spacer = @spacer_component.dup
+      if spacer.instance_variable_defined?(:@__vc_rendered)
+        spacer.remove_instance_variable(:@__vc_rendered)
+      end
+      spacer.render_in(view_context)
     end
   end
 end

data/lib/view_component/errors.rb

@@ -179,6 +179,19 @@ module ViewComponent
       "To fix this issue, pass a value.".freeze
   end
 
+  class ReusedInstanceError < StandardError
+    MESSAGE =
+      "ViewComponent instances are single-use; a COMPONENT instance was rendered more than once.\n\n" \
+      "Reusing a component instance across renders can leak request-scoped state " \
+      "(controller, helpers, request, view_flow, slot content, `with_content`) from an earlier render " \
+      "into a later one, which has security and correctness implications (GHSA-8qw7-6phv-7q6p).\n\n" \
+      "To fix this issue, create a new component instance per render.".freeze
+
+    def initialize(klass_name)
+      super(MESSAGE.gsub("COMPONENT", klass_name.to_s))
+    end
+  end
+
   class TranslateCalledBeforeRenderError < BaseError
     MESSAGE =
       "`#translate` can't be used before rendering as it depends " \

data/lib/view_component/version.rb

@@ -3,7 +3,7 @@
 module ViewComponent
   module VERSION
     MAJOR = 4
-    MINOR = 13
+    MINOR = 14
     PATCH = 0
     PRE = nil
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: view_component
 version: !ruby/object:Gem::Version
-  version: 4.13.0
+  version: 4.14.0
 platform: ruby
 authors:
 - ViewComponent Team