yard 0.9.34 → 0.9.35

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7531850cba319c703685684605433173f6b55d2d39df481c65492772fe31bc86
-  data.tar.gz: 61cbee634cd9292024ca7f126f867abbe9b8f9e6087c90f75ea18e87991cd4f2
+  metadata.gz: c5ff0ce7fb0e2d8ecc443968bc650be669b354e264b468ed73110367f8e18a8f
+  data.tar.gz: 57f2052210346c9492bb9d80bd15200cc3410e358f4d169e09a148cd258fc65c
 SHA512:
-  metadata.gz: 98abb79648eec38f9b035138e664f251b10530d7b1f38e70f6307749a224fc8237a8a4217be9a8792b4593a8938e199d760ff3b5d73a340cb91c8b3ffb63ba70
-  data.tar.gz: 7b691f28627be2337780cadd32d4212f9dfe13b5d4c2493ee8720ce7e9d80c28135e96257f46527c10c3924fd8474bd23f0da84558f76060e5a15ab924507c08
+  metadata.gz: 01c9c77f83fc7c2e8ccfe5cd21c16c51506ececa875a9e24793eb2d0d29376c69d8686f2ab8d0a11caefd77f5bf70424b40ea9e4c83d4afebd070b2c7c4d6132
+  data.tar.gz: d3e49a80ac5be583a158011351cbca068d4f78179ce02f88e43a3d02cac1a10ce7a02bd4b20fa9a44ce6dd519e02e2ede8acca8b5ed62a21341149de71c0a825

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # main
 
+# [0.9.35] - February 28th, 2024
+
+[0.9.35]: https://github.com/lsegal/yard/compare/v0.9.34...v0.9.35
+
+- Fix possible XSS on generated YARD frameset pages (thanks to @RedYetiDev for finding and patching) (2069e2b).
+- Fix errors when using `@option` on non-method objects (#1508)
+- Support Ruby 3.3 changes in Ripper parser (#1510)
+
 # [0.9.34] - April 12nd, 2023
 
 [0.9.34]: https://github.com/lsegal/yard/compare/v0.9.33...v0.9.34

data/lib/yard/code_objects/base.rb

@@ -303,6 +303,7 @@ module YARD
       # definitions with docstrings first.
       #
       # @return [String] a filename
+      # @return [nil] if there is no file associated with the object
       def file
         @files.first ? @files.first[0] : nil
       end

data/lib/yard/parser/source_parser.rb

@@ -476,9 +476,8 @@ module YARD
           content.force_encoding('binary')
           ENCODING_BYTE_ORDER_MARKS.each do |encoding, bom|
             bom.force_encoding('binary')
-            if content[0, bom.size] == bom
-              content.force_encoding(encoding)
-              return content
+            if content.start_with?(bom)
+              return content.sub(bom, '').force_encoding(encoding)
             end
           end
           content.force_encoding('utf-8') # UTF-8 is default encoding

data/lib/yard/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module YARD
-  VERSION = '0.9.34'
+  VERSION = '0.9.35'
 end

data/templates/default/fulldoc/html/frames.erb

@@ -5,10 +5,10 @@
 	<title><%= options.title %></title>
 </head>
 <script type="text/javascript">
-  var match = unescape(window.location.hash).match(/^#!(.+)/);
+  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
   var name = match ? match[1] : '<%= url_for_main %>';
-  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
-  window.top.location = name;
+  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
+  window.top.location.replace(name)
 </script>
 <noscript>
   <h1>Oops!</h1>

data/templates/default/tags/html/option.erb

@@ -1,4 +1,4 @@
-<% if object.has_tag?(:option) %>
+<% if object.has_tag?(:option) && object.respond_to?(:parameters) %>
   <% object.parameters.each do |param, default| %>
     <% tags = object.tags(:option).select {|x| x.name.to_s == param.to_s.sub(/^\*+|:$/, '') } %>
     <% next if tags.empty? %>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: yard
 version: !ruby/object:Gem::Version
-  version: 0.9.34
+  version: 0.9.35
 platform: ruby
 authors:
 - Loren Segal
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-04-12 00:00:00.000000000 Z
+date: 2024-02-28 00:00:00.000000000 Z
 dependencies: []
 description: |2
       YARD is a documentation generation tool for the Ruby programming language.