yard 0.9.27 → 0.9.35

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d0e3a62dcbb66515f56fe9a2cb919aa97881dced6e7cf052a7ce0201ff9222cf
-  data.tar.gz: 06714cb7f3e754d10fb2e784c0a0d49a5fee20aaee75778565daea8b61c453c1
+  metadata.gz: c5ff0ce7fb0e2d8ecc443968bc650be669b354e264b468ed73110367f8e18a8f
+  data.tar.gz: 57f2052210346c9492bb9d80bd15200cc3410e358f4d169e09a148cd258fc65c
 SHA512:
-  metadata.gz: 4a993609ba381fdc0419ac8332605b10a3995ff818626c20e64095f4f845e28297d38a81c890aa95a187ca8fd7d8e7d9f291d7251ac96ba1bee7a5a249f2db3d
-  data.tar.gz: f71cc60bc0fbe36419f8f142e07bbee5fd19b9e539099256bb644f1f61f57e9fa61c96ff95e879d584bdb48b3f988d5e945277acbc6e0f083cf1a6c8584c45df
+  metadata.gz: 01c9c77f83fc7c2e8ccfe5cd21c16c51506ececa875a9e24793eb2d0d29376c69d8686f2ab8d0a11caefd77f5bf70424b40ea9e4c83d4afebd070b2c7c4d6132
+  data.tar.gz: d3e49a80ac5be583a158011351cbca068d4f78179ce02f88e43a3d02cac1a10ce7a02bd4b20fa9a44ce6dd519e02e2ede8acca8b5ed62a21341149de71c0a825

data/CHANGELOG.md

@@ -1,6 +1,64 @@
 # main
 
-# 0.9.27 - November 29th, 2021
+# [0.9.35] - February 28th, 2024
+
+[0.9.35]: https://github.com/lsegal/yard/compare/v0.9.34...v0.9.35
+
+- Fix possible XSS on generated YARD frameset pages (thanks to @RedYetiDev for finding and patching) (2069e2b).
+- Fix errors when using `@option` on non-method objects (#1508)
+- Support Ruby 3.3 changes in Ripper parser (#1510)
+
+# [0.9.34] - April 12nd, 2023
+
+[0.9.34]: https://github.com/lsegal/yard/compare/v0.9.33...v0.9.34
+
+- Add changelog to yard.gemspec
+- Fix fork behavior in `yard server --fork`
+
+# [0.9.33] - April 11st, 2023
+
+[0.9.33]: https://github.com/lsegal/yard/compare/v0.9.32...v0.9.33
+
+- Ensure .yardopts is present in gem package (internal YARD documentation change)
+
+# 0.9.32 - April 9th, 2023
+
+[0.9.32]: https://github.com/lsegal/yard/compare/v0.9.31...v0.9.32
+
+- Fix issue with custom Rack::Request attributes in `yard server`
+
+# [0.9.31] - April 9th, 2023
+
+[0.9.31]: https://github.com/lsegal/yard/compare/v0.9.30...v0.9.31
+
+- Remove dependency on webrick in YARD::Server::Commands::StaticFileHelpers
+
+# [0.9.30] - April 9th, 2023
+
+[0.9.30]: https://github.com/lsegal/yard/compare/v0.9.29...v0.9.30
+
+- Hot release fix to correct issue with gem packaging missing templates (#1490)
+
+# [0.9.29] - April 8th, 2023
+
+[0.9.29]: https://github.com/lsegal/yard/compare/v0.9.28...v0.9.29
+
+- Enable table support for CommonMarker (#1443)
+- Parser performance improvements (#1452, #1453, #1454, #1455)
+- Fix autoload of RipperParser (#1460)
+- Remove dependency on webrick for better Ruby 3.1+ support
+- Improvements for mixin resolution (#1467, #1468)
+
+# [0.9.28] - June 1st, 2022
+
+[0.9.28]: https://github.com/lsegal/yard/compare/v0.9.27...v0.9.28
+
+- Safe load config YAML files (#1385)
+- Handle empty string constants (#1415)
+- Pre-emptively support removal of `Object#taint` in Ruby 3.2 (#1419)
+- Fix Ruby 3.1 forward args Ripper change (#1431)
+
+# [0.9.27] - November 29th, 2021
 
 [0.9.27]: https://github.com/lsegal/yard/compare/v0.9.26...v0.9.27
 
@@ -16,14 +74,14 @@
 - Fix `@!scope` maintaining state in lone comment blocks (#1411)
 - Remove support for Travis CI
 
-# 0.9.26 - December 26th, 2020
+# [0.9.26] - December 26th, 2020
 
 [0.9.26]: https://github.com/lsegal/yard/compare/v0.9.25...v0.9.26
 
 - Add support for Ruby 3.0 and fix tests
 - Fix support for `frozen_string_literal: false` magic comments (#1363)
 
-# 0.9.25 - May 3rd, 2020
+# [0.9.25] - May 3rd, 2020
 
 [0.9.25]: https://github.com/lsegal/yard/compare/v0.9.24...v0.9.25
 
@@ -38,7 +96,7 @@
 - Omit spec files in gem package (#1307)
 - README updates (#1322)
 
-# 0.9.24 - January 8th, 2020
+# [0.9.24] - January 8th, 2020
 
 [0.9.24]: https://github.com/lsegal/yard/compare/v0.9.23...v0.9.24
 
@@ -46,20 +104,20 @@
   cache is changed.
 - Fix issue where Registry fails to resolve first-time lookups on instance methods.
 
-# 0.9.23 - January 5th, 2020
+# [0.9.23] - January 5th, 2020
 
 [0.9.23]: https://github.com/lsegal/yard/compare/v0.9.22...v0.9.23
 
 - Fix issues with double encoded code blocks when highlighted from an extra
   file.
 
-# 0.9.22 - December 31st, 2019
+# [0.9.22] - December 31st, 2019
 
 [0.9.22]: https://github.com/lsegal/yard/compare/v0.9.21...v0.9.22
 
 - Revert jquery update in last release since it requires more changes. (#1298)
 
-# 0.9.21 - December 31st, 2019
+# [0.9.21] - December 31st, 2019
 
 [0.9.21]: https://github.com/lsegal/yard/compare/v0.9.20...v0.9.21
 
@@ -75,7 +133,7 @@
 - Update jquery to 3.4.1 (#1294)
 - Test fixes (#1244)
 
-# 0.9.20 - June 27th, 2019
+# [0.9.20] - June 27th, 2019
 
 [0.9.20]: https://github.com/lsegal/yard/compare/v0.9.19...v0.9.20
 
@@ -85,7 +143,7 @@
   `yard server` host under certain conditions. Thanks to CuongMX from
   Viettel Cyber Security for discovering this vulnerability.
 
-# 0.9.19 - April 2nd, 2019
+# [0.9.19] - April 2nd, 2019
 
 [0.9.19]: https://github.com/lsegal/yard/compare/v0.9.16...v0.9.19
 

data/LEGAL

@@ -4,7 +4,7 @@ LEGAL NOTICE INFORMATION
 All the files in this distribution are covered under either the MIT
 license (see the file LICENSE) except some files mentioned below.
 
-lib/parser/ruby/legacy/ruby_lex.rb:
+lib/yard/parser/ruby/legacy/ruby_lex.rb:
 
   This file is under the Ruby license. YARD uses a modified version of it.
 
@@ -64,3 +64,31 @@ lib/parser/ruby/legacy/ruby_lex.rb:
          IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
          WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
          PURPOSE.
+
+lib/yard/server/http_utils.rb:
+
+   This file is vendored and slightly modified from WEBrick because it was
+   removed from Ruby core in Ruby 3.x.
+
+      Copyright (C) 1993-2013 Yukihiro Matsumoto. All rights reserved.
+
+      Redistribution and use in source and binary forms, with or without
+      modification, are permitted provided that the following conditions
+      are met:
+      1. Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+      2. Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+
+      THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+      ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+      IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+      ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+      FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+      DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+      OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+      HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+      LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+      OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+      SUCH DAMAGE.

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2007-2018 Loren Segal
+Copyright (c) 2007-2022 Loren Segal
 
 Permission is hereby granted, free of charge, to any person
 obtaining a copy of this software and associated documentation

data/docs/WhatsNew.md

@@ -92,7 +92,7 @@ methods are defined dynamically and not associated with any code.
 #### New `@!parse` directive to parse Ruby code
 
 A new {tag:!parse} directive was added that allows a developer to have
-YARD parse code that might not necessarily be parseable in its original
+YARD parse code that might not necessarily be parsable in its original
 form. This is useful when using `instance_eval` and other dynamic
 meta-programming techniques to define methods or perform functionality.
 For instance, a common case of the "self.included" callback in module
@@ -1204,7 +1204,7 @@ that is actually being employed. Here's an example:
       # @overload def to_html(html, autolink = true)
       #   This docstring describes the specific overload only.
       #   @param [String] html the HTML
-      #   @param [Boolean] autolink whether or not to atuomatically link
+      #   @param [Boolean] autolink whether or not to automatically link
       #     URL references
       # @overload def to_html(html, opts = {})
       #   @param [String] html the HTML

data/lib/yard/autoload.rb

@@ -170,7 +170,6 @@ module YARD
 
     module Ruby # Ruby parsing components.
       module Legacy # Handles Ruby parsing in Ruby 1.8.
-        autoload :RipperParser,   __p('parser/ruby/legacy/ruby_parser')
         autoload :RubyParser,     __p('parser/ruby/legacy/ruby_parser')
         autoload :RubyToken,      __p('parser/ruby/legacy/ruby_lex')
         autoload :Statement,      __p('parser/ruby/legacy/statement')
@@ -180,6 +179,7 @@ module YARD
 
       autoload :AstNode,           __p('parser/ruby/ast_node')
       autoload :RubyParser,        __p('parser/ruby/ruby_parser')
+      autoload :RipperParser,      __p('parser/ruby/ruby_parser')
       autoload :TokenResolver,     __p('parser/ruby/token_resolver')
     end
 
@@ -236,6 +236,7 @@ module YARD
     autoload :FinishRequest,          __p('server/adapter')
     autoload :LibraryVersion,         __p('server/library_version')
     autoload :NotFoundError,          __p('server/adapter')
+    autoload :HTTPUtils,              __p('server/http_utils')
     autoload :RackAdapter,            __p('server/rack_adapter')
     autoload :RackMiddleware,         __p('server/rack_adapter')
     autoload :Router,                 __p('server/router')

data/lib/yard/cli/command.rb

@@ -70,7 +70,7 @@ module YARD
         load(file)
       rescue LoadError => load_exception
         log.error "The file `#{file}' could not be loaded:\n#{load_exception}"
-        exit
+        exit 1
       end
 
       # Callback when an unrecognize option is parsed

data/lib/yard/cli/stats.rb

@@ -225,7 +225,8 @@ module YARD
         end
 
         opts.on('--query QUERY', "Only includes objects that match a specific query") do |query|
-          options[:verifier].add_expressions(query.taint)
+          query.taint if query.respond_to?(:taint)
+          options[:verifier].add_expressions(query)
         end
       end
     end

data/lib/yard/cli/yardoc.rb

@@ -334,7 +334,7 @@ module YARD
       private
 
       # Generates output for objects
-      # @param [Hash, nil] checksums if supplied, a list of checkums for files.
+      # @param [Hash, nil] checksums if supplied, a list of checksums for files.
       # @return [void]
       # @since 0.5.1
       def run_generate(checksums)
@@ -650,7 +650,8 @@ module YARD
 
         opts.on('--query QUERY', "Only show objects that match a specific query") do |query|
           next if YARD::Config.options[:safe_mode]
-          options.verifier.add_expressions(query.taint)
+          query.taint if query.respond_to?(:taint)
+          options.verifier.add_expressions(query)
         end
 
         opts.on('--title TITLE', 'Add a specific title to HTML documents') do |title|

data/lib/yard/code_objects/base.rb

@@ -303,6 +303,7 @@ module YARD
       # definitions with docstrings first.
       #
       # @return [String] a filename
+      # @return [nil] if there is no file associated with the object
       def file
         @files.first ? @files.first[0] : nil
       end
@@ -434,7 +435,10 @@ module YARD
       #
       # @return [Symbol] the type of code object this represents
       def type
-        self.class.name.split('::').last.gsub(/Object$/, '').downcase.to_sym
+        obj_name = self.class.name.split('::').last
+        obj_name.gsub!(/Object$/, '')
+        obj_name.downcase!
+        obj_name.to_sym
       end
 
       # Represents the unique path of the object. The default implementation

data/lib/yard/config.rb

@@ -236,7 +236,11 @@ module YARD
     def self.read_config_file
       if File.file?(CONFIG_FILE)
         require 'yaml'
-        YAML.load_file(CONFIG_FILE)
+        if YAML.respond_to?(:safe_load_file)
+          YAML.safe_load_file(CONFIG_FILE, permitted_classes: [SymbolHash, Symbol])
+        else
+          YAML.load_file(CONFIG_FILE)
+        end
       else
         {}
       end

data/lib/yard/docstring_parser.rb

@@ -8,7 +8,7 @@ module YARD
   #
   # == Subclassing Notes
   #
-  # The DocstringParser can be subclassed and subtituted during parsing by
+  # The DocstringParser can be subclassed and substituted during parsing by
   # setting the {Docstring.default_parser} attribute with the name of the
   # subclass. This allows developers to change the way docstrings are
   # parsed, allowing for completely different docstring syntaxes.

data/lib/yard/handlers/ruby/attribute_handler.rb

@@ -52,7 +52,7 @@ class YARD::Handlers::Ruby::AttributeHandler < YARD::Handlers::Ruby::Base
           register(o)
           o.docstring = doc if o.docstring.blank?(false)
 
-          # Regsiter the object explicitly
+          # Register the object explicitly
           namespace.attributes[scope][name][type] = o
         else
           obj = namespace.children.find {|other| other.name == meth.to_sym && other.scope == scope }

data/lib/yard/handlers/ruby/legacy/attribute_handler.rb

@@ -51,7 +51,7 @@ class YARD::Handlers::Ruby::Legacy::AttributeHandler < YARD::Handlers::Ruby::Leg
           register(o)
           o.docstring = doc if o.docstring.blank?(false)
 
-          # Regsiter the object explicitly
+          # Register the object explicitly
           namespace.attributes[scope][name][type] = o
         else
           obj = namespace.children.find {|other| other.name == meth.to_sym && other.scope == scope }

data/lib/yard/handlers/ruby/method_handler.rb

@@ -97,7 +97,7 @@ class YARD::Handlers::Ruby::MethodHandler < YARD::Handlers::Ruby::Base
       params << ['**' + args.double_splat_param.source, nil]
     end
 
-    params << ['&' + args.block_param.source, nil] if args.block_param
+    params << ['&' + args.block_param.source, nil] if args.block_param && !args.args_forward
 
     params
   end

data/lib/yard/handlers/ruby/mixin_handler.rb

@@ -26,22 +26,29 @@ class YARD::Handlers::Ruby::MixinHandler < YARD::Handlers::Ruby::Base
     raise YARD::Parser::UndocumentableError unless mixin.ref?
     raise YARD::Parser::UndocumentableError if mixin.first.type == :ident
 
-    case obj = Proxy.new(namespace, mixin.source)
-    when ConstantObject # If a constant is included, use its value as the real object
-      obj = Proxy.new(namespace, obj.value, :module)
+    if mixin.type == :var_ref && mixin[0] == s(:kw, "self")
+      obj = namespace
     else
-      obj = Proxy.new(namespace, mixin.source, :module)
+      case obj = Proxy.new(namespace, mixin.source)
+      when ConstantObject # If a constant is included, use its value as the real object
+        obj = Proxy.new(namespace, obj.value, :module)
+      else
+        obj = Proxy.new(namespace, mixin.source, :module)
+      end
     end
 
     rec = recipient(mixin)
-    return if rec.nil? || rec.mixins(scope).include?(obj)
+    return if rec.nil?
+
+    ensure_loaded!(rec)
+    return if rec.mixins(scope).include?(obj)
 
     shift = statement.method_name(true) == :include ? :unshift : :push
     rec.mixins(scope).send(shift, obj)
   end
 
   def recipient(mixin)
-    if statement[0].type == :const_path_ref
+    if statement[0].type == :const_path_ref || statement[0].type == :top_const_ref
       Proxy.new(namespace, statement[0].source)
     elsif statement[0].type == :var_ref && statement[0][0] != s(:kw, "self")
       statement[0][0].type == :const ?

data/lib/yard/i18n/locale.rb

@@ -57,7 +57,7 @@ module YARD
       end
 
       # @param [String] message the translation target message.
-      # @return [String] translated message. If tarnslation isn't
+      # @return [String] translated message. If translation isn't
       #   registered, the +message+ is returned.
       def translate(message)
         @messages[message] || message

data/lib/yard/i18n/message.rb

@@ -8,7 +8,7 @@ module YARD
     #
     # @since 0.8.1
     class Message
-      # @return [String] the message ID of the trnslation target message.
+      # @return [String] the message ID of the translation target message.
       attr_reader :id
 
       # @return [Set] the set of locations. Location is an array of
@@ -18,7 +18,7 @@ module YARD
       # @return [Set] the set of comments for the messages.
       attr_reader :comments
 
-      # Creates a trasnlate target message for message ID +id+.
+      # Creates a translate target message for message ID +id+.
       #
       # @param [String] id the message ID of the translate target message.
       def initialize(id)

data/lib/yard/i18n/messages.rb

@@ -28,7 +28,7 @@ module YARD
         @messages[id]
       end
 
-      # Registers a {Message}, the mssage ID of which is +id+. If
+      # Registers a {Message}, the message ID of which is +id+. If
       # corresponding +Message+ is already registered, the previously
       # registered object is returned.
       #

data/lib/yard/i18n/pot_generator.rb

@@ -113,7 +113,7 @@ module YARD
       #
       # Locations of the +Message+ are used to generate the reference
       # line that is started with "#: ". +relative_base_path+ passed
-      # when the generater is created is prepended to each path in location.
+      # when the generator is created is prepended to each path in location.
       #
       # Comments of the +Message+ are used to generate the
       # translator-comment line that is started with "# ".

data/lib/yard/options.rb

@@ -94,7 +94,7 @@ module YARD
     #
     # @example Setting an option with Hash syntax
     #   options[:format] = :html # equivalent to: options.format = :html
-    # @param [Symbol, String] key the optin to set
+    # @param [Symbol, String] key the option to set
     # @param [Object] value the value to set for the option
     # @return [Object] the value being set
     def []=(key, value) send("#{key}=", value) end

data/lib/yard/parser/ruby/ast_node.rb

@@ -426,6 +426,13 @@ module YARD
         def block_param
           self[-1] ? self[-1][0] : nil
         end
+
+        def args_forward
+          # shape is (required, optional, rest, more, keyword, keyword_rest, block)
+          # Ruby 3.1 moves :args_forward from rest to keyword_rest
+          args_index = YARD.ruby31? ? -2 : 2
+          self[args_index].type == :args_forward if self[args_index]
+        end
       end
 
       class MethodCallNode < AstNode

data/lib/yard/parser/ruby/ruby_parser.rb

@@ -133,6 +133,12 @@ module YARD
         AST_TOKENS = [:CHAR, :backref, :const, :cvar, :gvar, :heredoc_end, :ident,
           :int, :float, :ivar, :label, :period, :regexp_end, :tstring_content, :backtick]
 
+        COMMENT_SKIP_NODE_TYPES = [
+          :comment,
+          :void_stmt,
+          :list
+        ].freeze
+
         MAPPINGS.each do |k, v|
           if Array === v
             v.each {|vv| (REV_MAPPINGS[vv] ||= []) << k }
@@ -144,7 +150,7 @@ module YARD
         PARSER_EVENT_TABLE.each do |event, arity|
           node_class = AstNode.node_class_for(event)
 
-          if /_new\z/ =~ event.to_s && arity == 0
+          if arity == 0 && /_new\z/ =~ event.to_s
             module_eval(<<-eof, __FILE__, __LINE__ + 1)
               def on_#{event}(*args)
                 #{node_class}.new(:list, args, :listchar => charno...charno, :listline => lineno..lineno)
@@ -613,7 +619,7 @@ module YARD
 
         def insert_comments
           root.traverse do |node|
-            next if [:comment, :void_stmt, :list].include?(node.type) || node.parent.type != :list
+            next if COMMENT_SKIP_NODE_TYPES.include?(node.type) || node.parent.type != :list
 
             # never attach comments to if/unless mod nodes
             if node.type == :if_mod || node.type == :unless_mod

data/lib/yard/parser/source_parser.rb

@@ -476,9 +476,8 @@ module YARD
           content.force_encoding('binary')
           ENCODING_BYTE_ORDER_MARKS.each do |encoding, bom|
             bom.force_encoding('binary')
-            if content[0, bom.size] == bom
-              content.force_encoding(encoding)
-              return content
+            if content.start_with?(bom)
+              return content.sub(bom, '').force_encoding(encoding)
             end
           end
           content.force_encoding('utf-8') # UTF-8 is default encoding

data/lib/yard/registry_resolver.rb

@@ -132,7 +132,8 @@ module YARD
 
       path.scan(split_on_separators_match).each do |part, sep|
         cur_obj = nil
-        pos += "#{part}#{sep}".length
+        pos += part.length
+        pos += sep.length
         parsed_end = pos == path.length
 
         if !last_obj || (!parsed_end && !last_obj.is_a?(CodeObjects::NamespaceObject))

data/lib/yard/server/commands/base.rb

@@ -119,7 +119,7 @@ module YARD
         #     def run
         #       self.body = 'ERROR! The System is down!'
         #       self.status = 500
-        #       self.headers['Conten-Type'] = 'text/plain'
+        #       self.headers['Content-Type'] = 'text/plain'
         #     end
         #   end
         #

data/lib/yard/server/commands/library_command.rb

@@ -94,16 +94,16 @@ module YARD
         end
 
         def call_with_fork(request, &block)
-          reader, writer = IO.pipe
+          IO.pipe(:binmode => true) do |reader, writer|
+            fork do
+              log.debug "[pid=#{Process.pid}] fork serving: #{request.path}"
+              reader.close
+              writer.print(Marshal.dump(call_without_fork(request, &block)))
+            end
 
-          fork do
-            log.debug "[pid=#{Process.pid}] fork serving: #{request.path}"
-            reader.close
-            writer.print(Marshal.dump(call_without_fork(request, &block)))
+            writer.close
+            Marshal.load(reader.read)
           end
-
-          writer.close
-          Marshal.load(reader.read)
         end
 
         def can_fork?

data/lib/yard/server/commands/static_file_helpers.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-require 'webrick/httputils'
 
 module YARD
   module Server
@@ -7,7 +6,7 @@ module YARD
       # Include this module to get access to {#static_template_file?}
       # and {favicon?} helpers.
       module StaticFileHelpers
-        include WEBrick::HTTPUtils
+        include Server::HTTPUtils
 
         # Serves an empty favicon.
         # @raise [FinishRequest] finalizes an empty body if the path matches