yard 0.9.41 → 0.9.42

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b498d65eea07bb8fc6b7f6e43b210a66d2a7b37ff19159ca4312d254b006ff36
-  data.tar.gz: be2ebd8ff2e23d88afd7adebeb7520b4ece385c3faac5a564c91eb7137185034
+  metadata.gz: 60d3b726173ec326d88ee6b893b7a4f83776601ad52686c3ddcf2c7dd40522ea
+  data.tar.gz: 2d5d0b74bbb12f6c01556c5cd774876e997d777c5ec5c8dd2b5fc5763b03c250
 SHA512:
-  metadata.gz: 40cb9115aafad9eb4b31dbc4f80d6bb3afe77d0935e4a52c435895a679730cccc1d0f53c2c2c54a908881e7bcf96c2585d1c638d8738d1b75834c164b3c2e825
-  data.tar.gz: 363ac81a03972f3e3d86f917d3db3db8beb50ae813a52f80104fcc9d57073d9717c203b0b885d34218bdc0739f20fc1f9b7ad5fd390f7672c6f0fb1e890b9a0a
+  metadata.gz: af71bc2ead0fcc45dcf67c4e8da45eeeff4159c8d9b4d83aba8b23ddfe328fd57f1c75b908ae2c96566bb2d882a936ebac09729cd90f73265c321a86b5a3966b
+  data.tar.gz: 518398b298dba0a9250434e426e14cd84642dee10d5fc4a769f11492783f7e5392933bbd451613a4f1d4b0e0cbf3b8f2541c85e9dcbb3d06c1f7ff47944231eb

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # main
 
+# [0.9.42] - April 16th, 2026
+
+[0.9.42]: https://github.com/lsegal/yard/compare/v0.9.41...v0.9.42
+
+- Fix alternating rows when loading a module in default HTML templates with subelements in the nav frame
+- Fix reliability of keypresses and copy/paste in search box (#1174)
+- Fix regression in `yard server` search box styling
+- Fix possible path traversal with document_root (`--docroot`) set in `yard server` ([GHSA-xfhh-rx56-rxcr](https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr))
+
 # [0.9.41] - April 14th, 2026
 
 [0.9.41]: https://github.com/lsegal/yard/compare/v0.9.40...v0.9.41
@@ -7,6 +16,7 @@
 - Add support for `rdoc-image:...` syntax in HybridMarkup (#1676)
 - Add support for colon suffix code blocks in HybridMarkup (rdoc compatibility)
 - Fix responsiveness and state issues with nav frame links in `yard server`
+
 # [0.9.40] - April 12th, 2026
 
 [0.9.40]: https://github.com/lsegal/yard/compare/v0.9.39...v0.9.40

data/docs/Parser.md

@@ -55,49 +55,10 @@ You can also provide the parser type explicitly as the second argument:
 Note that these two methods are aliased as {YARD.parse} and {YARD.parse_string} for
 convenience.
 
-## Implementing and Registering a Custom Parser
-
-To implement a custom parser, subclass {YARD::Parser::Base}. Documentation on which
-abstract methods should be implemented are documented in that class. After the class
-is implemented, it is registered with the {YARD::Parser::SourceParser} factory class
-to be called when a file of the right extension needs to be parsed, or when a user
-selects that parser type explicitly. To register your new parser class, call the
-method {YARD::Parser::SourceParser.register_parser_type}:
-
-    SourceParser.register_parser_type(:my_parser, MyParser, 'my_parser_ext')
-
-The last argument can be a single extension, a list of extensions (Array), a single Regexp, or a
-list of Regexps. Do not include the '.' in the extension.
-
-
-## The Two Ruby Parser Types
-
-When parsing Ruby, the SourceParser can either instantiate the new {YARD::Parser::Ruby::RubyParser}
-class or the {YARD::Parser::Ruby::Legacy::StatementList} class. The first of the
-two, although faster, more robust and more efficient, is only available for
-Ruby 1.9. The legacy parser parser is available in both 1.8.x and 1.9, if
-compatibility is required. The choice of parser will affect which handlers
-ultimately get used, since new handlers can only use the new parser and the
-same requirement applies to the legacy parser & handlers.
-
-## Switching to Legacy Parser
-
-By default, running YARD under Ruby 1.9 will automatically select the new parser
-and new handlers by extension. Although YARD supports both handler styles, plugins
-may choose to only implement one of the two (though this is not recommended). If
-only the legacy handlers are implemented, the `SourceParser` class should force
-the use of the legacy parser by setting the `parser_type` attribute as such:
+## RubyParser
 
-    YARD::Parser::SourceParser.parser_type = :ruby18
-
-The default value is `:ruby`. Note that this cannot be forced the other way around,
-a parser type of `:ruby` cannot be set under Ruby 1.8.x as the new parser is not
-supported under 1.8.
-
-## RubyParser (the New Parser)
-
-The new Ruby parser uses the Ripper library that is packaged as part of stdlib
-in Ruby 1.9. Because of this, it can generate an AST from a string of Ruby input
+The Ruby parser uses the Ripper library that is packaged as part of stdlib.
+Because of this, it can generate an AST from a string of Ruby input
 that is similar to the style of other sexp libraries (such as ParseTree). Each
 node generated in the tree is of the base type {YARD::Parser::Ruby::AstNode},
 which has some subclasses for common node types.
@@ -163,6 +124,20 @@ to quickly get at a node of a specific type in such a situation:
 Multiple types can be searched for at once. If none are found, the original root
 node is returned so that it may be chained.
 
+## Implementing and Registering a Custom Parser
+
+To implement a custom parser, subclass {YARD::Parser::Base}. Documentation on which
+abstract methods should be implemented are documented in that class. After the class
+is implemented, it is registered with the {YARD::Parser::SourceParser} factory class
+to be called when a file of the right extension needs to be parsed, or when a user
+selects that parser type explicitly. To register your new parser class, call the
+method {YARD::Parser::SourceParser.register_parser_type}:
+
+    SourceParser.register_parser_type(:my_parser, MyParser, 'my_parser_ext')
+
+The last argument can be a single extension, a list of extensions (Array), a single Regexp, or a
+list of Regexps. Do not include the '.' in the extension.
+
 ## The Legacy Parser
 
 The goal of the legacy parser is much the same as the new parser, but it is far

data/lib/yard/server/commands/base.rb

@@ -88,7 +88,7 @@ module YARD
         #   of status, headers, and body wrapped in an array.
         def call(request)
           self.request = request
-          self.path ||= request.path_info[1..-1]
+          self.path ||= File.cleanpath(request.path_info[1..-1])
           self.headers = {'Content-Type' => 'text/html'}
           self.body = ''
           self.status = 200

data/lib/yard/server/templates/default/fulldoc/html/css/custom.css

@@ -1,96 +1,30 @@
-#search_results h1 { margin-bottom: 0; }
-#search_results p { margin-top: 0; margin-bottom: 25px; }
-#search_results ul { list-style-position: inside; padding-left: 0; list-style: none; }
-#search_results ul li { padding: 7px 15px; font-size: 1.1em; }
-
-form.search {
-  z-index: 8000;
-  position: absolute;
-  color: #fff;
-  border: 1px solid #99f; width: 210px; background: #05a;
-  border-radius: 4px; border-top-left-radius: 0; border-top-right-radius: 0;
-}
-form.search input {
-  height: 25px;
-  padding: 0;
-  padding-left: 4px;
-  margin: 4px;
-  margin-right: 0;
-  width: 202px;
-  border: 1px solid #99f;
-  border-radius: 3px;
-  font-size: 1.1em;
-  box-sizing: border-box;
-  -webkit-appearance: none;
-}
-
-@media (max-width: 920px) {
-  form.search {
-    position: absolute;
-    color: #fff;
-    width: 100%;
-    margin-top: 0;
-    background: #05a;
-    border-radius: 0;
-    border: 0;
-    margin-bottom: 10px;
-    left: 0;
-    top: 0;
-  }
-  form.search input {
-    margin-top: 9px;
-    margin-bottom: 11px;
-    margin-left: 12px;
-    padding-left: 6px;
-    border: 1px solid #eaf0ff;
-  }
-  #menu { margin-top: 41px; }
-  #search a {
-    border-top-left-radius: 3px; border-top-right-radius: 3px;
-    background: none;
-    border: 0;
-    box-shadow: none;
-    margin-top: 4px;
-    padding-bottom: 5px;
-    color: #eaf0ff; fill: #eaf0ff;
-  }
-  #search a.active {
-    background: #048; border: 0;
-  }
-}
-
-@media (min-width: 920px) {
-  form.search { right: 12px; top: 0; }
-}
-
-#menu { padding-top: 5px; }
-#content h1 { margin-top: 15px; border-top: 0; }
-
-#content.error { font-size: 1.2em; }
-#content.error p tt { font-size: 1.2em; }
-#content.error .note { padding: 12px; }
-
-.signature .permalink { float: right; font-size: 0.9em; }
-
 /* autocomplete */
 .ac_results {
 	padding: 0px;
-	border: 1px solid black;
-	width: 500px;
+	position: absolute;
+	top: calc(100% - 1px);
+	left: 4px;
+	right: 4px;
+	border: 1px solid #0a4f8a;
+	width: auto;
 	overflow: hidden;
 	z-index: 99999;
+	background: #f7fbff;
+	box-shadow: 0 10px 28px rgba(0, 0, 0, 0.18);
+	border-radius: 0 0 4px 4px;
+	color: #123;
 }
 
 .ac_results ul {
 	width: 100%;
-	list-style-position: outside;
 	list-style: none;
+	list-style-position: outside;
 	padding: 0;
 	margin: 0;
 }
 
 .ac_results li {
-  cursor: pointer;
+	cursor: pointer;
 	margin: 0px;
 	padding: 3px;
 	display: block;
@@ -98,30 +32,176 @@ form.search input {
 	font-size: 12px;
 	line-height: 16px;
 	overflow: hidden;
+	color: #123;
+}
 
+#search_results h1 {
+	margin-bottom: 0;
+}
+#search_results p {
+	margin-top: 0;
+	margin-bottom: 25px;
+}
+#search_results ul {
+	list-style: none;
+	list-style-position: inside;
+	padding-left: 0;
+}
+#search_results ul li {
+	padding: 7px 15px;
+	font-size: 1.1em;
+}
+
+form.search {
+	z-index: 8000;
+	position: absolute;
+	color: #fff;
+	border: 1px solid #99f;
+	width: 210px;
+	background: #05a;
+	border-radius: 4px;
+	border-top-left-radius: 0;
+	border-top-right-radius: 0;
+}
+form.search input {
+	height: 25px;
+	padding: 0;
+	padding-left: 4px;
+	margin: 4px;
+	margin-right: 0;
+	width: 202px;
+	border: 1px solid #99f;
+	border-radius: 3px;
+	font-size: 1.1em;
+	box-sizing: border-box;
+	-webkit-appearance: none;
+	color: #123;
+}
+
+@media (max-width: 920px) {
+	form.search {
+		position: absolute;
+		color: #fff;
+		width: 100%;
+		margin-top: 0;
+		background: #05a;
+		border-radius: 0;
+		border: 0;
+		margin-bottom: 10px;
+		left: 0;
+		top: 0;
+	}
+	form.search input {
+		margin-top: 9px;
+		margin-bottom: 11px;
+		margin-left: 12px;
+		padding-left: 6px;
+		border: 1px solid #eaf0ff;
+		background: #fff;
+	}
+	#menu {
+		margin-top: 41px;
+	}
+	#search a {
+		border-top-left-radius: 3px;
+		border-top-right-radius: 3px;
+		background: none;
+		border: 0;
+		box-shadow: none;
+		margin-top: 4px;
+		padding-bottom: 5px;
+		color: #eaf0ff;
+		fill: #eaf0ff;
+	}
+	#search a.active {
+		background: #048;
+		border: 0;
+	}
+}
+
+@media (min-width: 920px) {
+	form.search {
+		right: 12px;
+		top: 0;
+	}
+}
+
+#menu {
+	padding-top: 5px;
+}
+#content h1 {
+	margin-top: 15px;
+	border-top: 0;
+}
+
+#content.error {
+	font-size: 1.2em;
+}
+#content.error p tt {
+	font-size: 1.2em;
+}
+#content.error .note {
+	padding: 12px;
+}
+
+.signature .permalink {
+	float: right;
+	font-size: 0.9em;
 }
 
 .ac_loading {
-	background: white url('/images/processing.gif') right center no-repeat;
+	background: white url("/images/processing.gif") right center no-repeat;
 }
 
 .ac_even {
-  background: #fafafa; border: 1px dotted #fafafa; border-left-width: 0; border-right-width: 0;
+	background: #fafafa;
+	border: 1px dotted #fafafa;
+	border-left-width: 0;
+	border-right-width: 0;
 }
 
 .ac_odd {
-	background: #f0f0f0; border: 1px dotted #f0f0f0; border-left-width: 0; border-right-width: 0;
+	background: #f0f0f0;
+	border: 1px dotted #f0f0f0;
+	border-left-width: 0;
+	border-right-width: 0;
 }
 
 .ac_over {
-  background: #ddd; cursor: pointer; border: 1px dotted #fff; border-left-width: 0; border-right-width: 0;
+	background: #cfe5ff;
+	cursor: pointer;
+	border: 1px dotted #f7fbff;
+	border-left-width: 0;
+	border-right-width: 0;
 }
 
-#fade { display: none; position: absolute; top: 0px; left: 0; background: #eee; z-index: -1; width: 100%; height: 100%; border-top: 1px solid #e0e0e0; }
+#fade {
+	display: none;
+	position: absolute;
+	top: 0px;
+	left: 0;
+	background: #eee;
+	z-index: -1;
+	width: 100%;
+	height: 100%;
+	border-top: 1px solid #e0e0e0;
+}
 #processing {
-  position: absolute; width: 400px; height: 200px; margin: auto; background: #fff; padding: 10px 30px; z-index: 20;
-  -webkit-box-shadow: 0px 0px 20px #444; -moz-box-shadow: 0px 0px 20px #444;
-  -webkit-border-radius: 4px;
-  display: none;
+	position: absolute;
+	width: 400px;
+	height: 200px;
+	margin: auto;
+	background: #fff;
+	padding: 10px 30px;
+	z-index: 20;
+	-webkit-box-shadow: 0px 0px 20px #444;
+	-moz-box-shadow: 0px 0px 20px #444;
+	-webkit-border-radius: 4px;
+	display: none;
+}
+#processing img {
+	display: block;
+	position: absolute;
+	bottom: 30px;
+	left: 44%;
 }
-#processing img { display: block; position: absolute; bottom: 30px; left: 44%; }