Commit Graph

2461 Commits

Author SHA1 Message Date
Jack McCracken a20fbf9bc5
Check that request is same-origin prior to including CSRF token in XHRs
[CVE-2020-8167]
2020-05-15 16:15:00 -07:00
Ryuta Kamizono 1165401ee9 Remove unused `require "active_support/core_ext/kernel/singleton_class"`
`singleton_class` is in Ruby 1.9.2, and there is no use singleton class
eval in the files.
2020-05-10 03:20:02 +09:00
John Hawthorn 342f2f0b51
Merge pull request #39164 from jhawthorn/deprecate_dots_take_two
Deprecate rendering templates with . in the name
2020-05-06 09:37:04 -07:00
Ryuta Kamizono 46a22ceaff
Merge pull request #39162 from kamipo/dogfooding_symbol_starts_ends_with
Dogfooding "active_support/core_ext/symbol/starts_ends_with"
2020-05-06 17:19:19 +09:00
John Hawthorn dd9991bac5 Deprecate rendering templates with . in the name
Allowing templates with "." introduces some ambiguity. Is index.html.erb
a template named "index" with format "html", or is it a template named
"index.html" without a format? We know it's probably the former, but if
we asked ActionView to render "index.html" we would currently get some
combination of the two: a Template with index.html as the name and
virtual path, but with html as the format.

This deprecates having "." anywhere in the template's name, we should
reserve this character for specifying formats. I think in 99% of cases
this will be people specifying `index.html` instead of simply `index`.

This was actually once deprecated in the 3.x series (removed in
6c57177f2c) but I don't think we can rely
on nobody having introduced this in the past 8 years.
2020-05-05 23:21:17 -07:00
John Hawthorn 92d3afe475
Merge pull request #39068 from jhawthorn/dependency_tracker_interpolation
Ignore interpolated strings in DependencyTracker
2020-05-05 23:21:00 -07:00
Ryuta Kamizono 98a1405f07 Dogfooding "active_support/core_ext/symbol/starts_ends_with"
Any missing thing would be found such like #39159.
2020-05-06 14:19:25 +09:00
Godfrey Chan f4538aa586
Merge pull request #38999 from zvkemp/action-view-instrument-layout
add additional instrumentation block for ActionView layout rendering
2020-05-05 11:50:24 -07:00
Ryuta Kamizono 6a4395f466 Deprecate `starts_with?` and `ends_with?` for String core extensions
In the past, we sometimes hit missing `Symbol#start_with?` and
`Symbol#end_with?`.

63256bc5d7
a8e812964d

So I proposed `Symbol#start_with?` and `Symbol#end_with?` to allow duck
typing that methods for String and Symbol, then now it is available in
Ruby 2.7.

https://bugs.ruby-lang.org/issues/16348

Using `String#starts_with?` and `String#ends_with?` could not be gained
that conveniency, so it is preferable to not use these in the future.
2020-05-05 15:51:24 +09:00
Ryuta Kamizono 4642ca9640 Fix actionview tests for missing helper 2020-05-03 06:06:09 +09:00
zvkemp 6380aee182 add additional instrumentation block for ActionView layout rendering 2020-05-01 19:15:54 -07:00
John Hawthorn 1e25f02135 Ignore interpolated strings in DependencyTracker
ActionView::DependencyTracker looks through ERB templates using a regex
to find render calls. Previously this would incorrectly pick up
interpolated strings, like `render "foo/#{bar}"`.

This does not attempt to completely correct DependencyTracker, we can't
parse Ruby accurately with a regex, but should avoid a relatively common
case that previously was generating warnings.
2020-04-27 10:10:45 -07:00
Ryuta Kamizono 977ba0e321 Revert "Update actionview CHANGELOG"
This reverts commit 960ceb237a.

Ref #39012, #38858.

[ci skip]
2020-04-27 14:15:00 +09:00
Godfrey Chan 1064c51609 Fix typos [ci skip]
I wrote this shell script to find words from the Rails repo,
so I can paste them into https://www.horsepaste.com/ for
the [codenames game](https://en.m.wikipedia.org/wiki/Codenames_(board_game)).

```bash
git grep -Il '' | \
  grep -v -E "CHANGELOG|Gemfile|gemspec|package\.json|yarn\.lock" | \
  xargs cat | \
  sed '/[^ ]\{10,\}/d' | \
  sed 's/\([A-Z]\)/ \1/g' | \
  tr 'A-Z' 'a-z' | \
  tr -c -s 'a-z' '\n' | \
  sed '/^.\{0,3\}$/d' | \
  sort | \
  uniq | \
  tr '\n' ',' | \
  pbcopy
```

You can see the result in https://www.horsepaste.com/rails-fixed.
Click "Next game" to cycle the words.

Found some typos in the codebase from this 😂

This is how I generated the list of possible typos:

```bash
git grep -Il '' | \
  grep -v -E "CHANGELOG|Gemfile|gemspec|package\.json|yarn\.lock" | \
  xargs cat | \
  sed '/[^ ]\{10,\}/d' | \
  sed 's/\([A-Z]\)/ \1/g' | \
  tr 'A-Z' 'a-z' | \
  tr -c -s 'a-z' '\n' | \
  sed '/^.\{0,3\}$/d' | \
  sort | \
  uniq | \
  aspell --ignore-case list
```

I manually reviewed the list and made the corrections
in this commit. The rest on the list are either:

* Bugs in my script: it split things like "doesn't" into
  "doesn" and "t", if find things like `#ffffff` and
  extracts "ffffff" as a word, etc
* British spelling: honour, optimised
* Foreign words: bonjour, espanol
* Names: nginx, hanekawa
* Technical words: mutex, xhtml
* Portmanteau words: autosave, nodelist
* Invented words: camelize, coachee
* Shortened words: attrs, repo
* Deliberate typos: hllo, hillo (used in code examples, etc)
* Lorem ipsum words: arcu, euismod

This is the [output](https://gist.github.com/chancancode/eb0b573d667dc31906f33f1fb0b22313)
of the script *after* fixing the typos included in this
commit. In theory, someone can run that command again in
the future and compare the output to catch new typos (i.e.
using my list to filter out known typos).

Limitations: the aspell dictionary could be wrong, I
could have miss things, and my script ignores words that
are less than 3 characters or longer than 10 characters.
2020-04-22 21:43:37 -07:00
Jonathan Hefner e158a34d49 Realign cache key diagram in method doc [ci skip]
Follow-up to #37669.
2020-04-21 23:38:16 -05:00
David Heinemeier Hansson 876cc27609
Revert "Deprecate rendering templates with . in the name" (#39012) 2020-04-21 15:59:46 -07:00
Rafael França 673685cdc8
Merge pull request #38950 from joelhawksley/annotations-error-line
Raise template errors on correct line with annotations enabled
2020-04-14 18:39:25 -04:00
Joel Hawksley ab8ea48111 Raise errors on correct line with annotations enabled
Co-authored-by: Aaron Patterson <tenderlove@github.com>
2020-04-14 15:26:26 -06:00
Joel Hawksley dee5d7d23c Pass preamble/postamble to Erubi, reducing coupling 2020-04-14 15:12:21 -06:00
John Hawthorn 5658a43c0c
Merge pull request #38857 from jhawthorn/avoid_instrumentation_indirection
Avoid ActionView rendering instrumentation indirection
2020-04-14 11:57:06 -07:00
Joel Hawksley 3b28486e93 `ActionView::Base.annotate_template_file_names` only annotates HTML output.
In testing https://github.com/rails/rails/pull/38848 in the
GitHub monolith, we realized that we probably should only
be annotating HTML output with these comments, at least
in their current format. By passing `format` to
`erb_implementation`, we set ourselves up to eventually
support annotations for other formats as well.
2020-04-08 15:22:22 -06:00
John Hawthorn 960ceb237a Update actionview CHANGELOG 2020-04-07 19:23:13 -07:00
John Hawthorn 32b059beb6 Merge pull request #38858 from jhawthorn/deprecate_dots
Deprecate rendering templates with . in the name
2020-04-07 18:39:25 -07:00
Abhay Nikam bdfffd1355 Update the Rails mailing list URLs to new discuss discourse URL [ci skip] 2020-04-02 22:00:28 +05:30
John Hawthorn f84773a587 Deprecate rendering templates with . in the name
Allowing templates with "." introduces some ambiguity. Is index.html.erb
a template named "index" with format "html", or is it a template named
"index.html" without a format? We know it's probably the former, but if
we asked ActionView to render "index.html" we would currently get some
combination of the two: a Template with index.html as the name and
virtual path, but with html as the format.

This deprecates having "." anywhere in the template's name, we should
reserve this character for specifying formats. I think in 99% of cases
this will be people specifying `index.html` instead of simply `index`.

This was actually once deprecated in the 3.x series (removed in
6c57177f2c) but I don't think we can rely
on nobody having introduced this in the past 8 years.
2020-03-31 21:55:19 -07:00
John Hawthorn 006bf78b69 Remove AbstractRenderer#instrument 2020-03-31 21:51:51 -07:00
John Hawthorn f4014f738c Call AS::Notifications.instrument directly in AV
The instrument helper we had here would allocate a new string object for
the key each time it was called and also added two stack frames. The
interpolated strings are also _slightly_ slower to hash since they
aren't fstrings.

Though this was shorter before, I think this is a little more preferable
as a code style since the subscribed keys are now greppable. After this,
there's still one other place this pattern is used (in ActiveSupport
cache).
2020-03-31 21:51:44 -07:00
Joel Hawksley a59e1de26a .annotate_template_file_names annotates HTML output with template file names
As a developer, when looking at a page in my web browser, it's sometimes
difficult to figure out which template(s) are being used to render the page.

config.action_view.annotate_template_file_names adds HTML comments to the
rendered output indicating where each template begins and ends.

Co-authored-by: Aaron Patterson <tenderlove@github.com>
2020-03-30 14:50:01 -06:00
Josua Schmid 835cf76572
[ci skip] Fix API documentation for link_to_if 2020-03-27 08:08:47 +01:00
Aaron Patterson fc4ef77d47
Merge pull request #38594 from rails/collection-refactor
Refactoring PartialRenderer
2020-03-23 17:41:20 -07:00
Aaron Patterson d7bd84bc11
Remove out-of-date comments 2020-03-23 17:21:04 -07:00
Aaron Patterson 033a738817
Fix possible XSS vector in JS escape helper
This commit escapes dollar signs and backticks to prevent JS XSS issues
when using the `j` or `javascript_escape` helper

CVE-2020-5267
2020-03-19 09:48:08 -07:00
Joel Hawksley c82a9193df
Document view components support (#38656) 2020-03-13 23:52:49 +01:00
Ryuta Kamizono 1ef8c60dfc Avoid extra string allocation in the methods generated by eval 2020-03-10 17:43:35 +09:00
Eugene Kenny d3599d8aff Use index_by and index_with wherever possible
Using `index_by` or `index_with` is more concise than `each_with_object`
and more performant than `map { ... }.to_h` or `Hash[map { ... }]`.
2020-03-05 01:24:14 +00:00
Aaron Patterson a15339ff65
remove usless attr_reader 2020-02-28 09:25:25 -08:00
Aaron Patterson 49adb7f4c6
pull preloading behavior in to the collection renderer 2020-02-28 09:23:22 -08:00
Aaron Patterson 72e0d04a4b
Fix issue in ActionText
ActionText was using `render` in a way that ActionView didn't have tests
for.  This is a fix for it.
2020-02-27 16:54:50 -08:00
Aaron Patterson 232372bfd1
Merge branch 'master' into collection-refactor
* master:
  Add a regression test that ActionText caught
  [ci skip] Use yml extension for locale files
  Fix `helper_method` in `ActionView::TestCase` to allow keyword arguments
  Fix `delegate_missing_to` to allow keyword arguments
  Dump the schema or structure of a database when calling db:migrate:name
  Reset the `ActiveRecord::Base` connection after `rails db:migrate:name`
  Fix `unscope` when an `eq` node which has no arel attribute
  Remove unused argument
  Disallow calling `connected_to` on subclasses of `ActiveRecord::Base`
  More less and lazy allocation for `assign_attributes` and `_assign_attributes`
  Tweak contributing_to_ruby_on_rails.md [ci skip]
  Clarify the difference between (old) `spec_name` and `connection_specification_name`
  Remove duplicate part from deprecation warning
  Fix deprecation warnings in connection_handlers_sharding_db_test.rb
  Fixup CHANGELOGs [ci skip]
  `reset_column_information` does not reset @predicate_builder
  Simplify FixtureResolver to reuse filtering logic
  Mostly remove bad test
  Use type attribute in ActionView::Helpers::JavaScriptHelper#javascript_tag example
  Update some references to finder options [ci skip]
2020-02-27 16:48:15 -08:00
Aaron Patterson 5f596e299e
Add a regression test that ActionText caught
ActionText is using ActionView in a way that ActionView doesn't have in
it's test suite.  This is just a regression test to hit that same use
case.
2020-02-27 16:47:22 -08:00
Aaron Patterson 4a4a8be064
make the cops happy 2020-02-27 15:38:20 -08:00
Aaron Patterson 8d539bde7b
Move around local variable derivation
This reduces object allocations in collection rendering
2020-02-27 15:01:52 -08:00
Aaron Patterson 374c1b2940
fix require 2020-02-27 14:12:09 -08:00
Aaron Patterson 78a28b7c47
always lookup template from path cache 2020-02-27 13:52:53 -08:00
Aaron Patterson 7c0dea18ce
Reduce iterations for non-homogeneous collections
We only need to iterate over the paths twice (this was doing it 3 times)
2020-02-27 13:20:34 -08:00
Aaron Patterson 266e34973e
Remove conditional
Only one case can possibly be missing a partial.  We can move the cache
check to that branch and eliminate the conditional
2020-02-27 13:15:56 -08:00
Aaron Patterson 76ea105ca1
remove collection ivar 2020-02-27 13:14:09 -08:00
Aaron Patterson a85494dc0c
Move renderers in to their own files
We don't need to keep all of these in the partial renderer file
2020-02-27 12:55:04 -08:00
Aaron Patterson 665a355ed8
We don't need this private method 2020-02-27 12:50:02 -08:00
Aaron Patterson dbd8860096
move object specific stuff in to the object processing code 2020-02-27 12:49:53 -08:00
Ryuta Kamizono 4d641a3363 Fix `helper_method` in `ActionView::TestCase` to allow keyword arguments 2020-02-28 04:46:05 +09:00
Aaron Patterson f0429dbc30
Make extracting details cheaper
Details are only used if the user specifies a format or local, etc when
rendering a template.  This is a fairly uncommon thing to do, so lets
make it cheaper when there are no details specified
2020-02-26 17:14:37 -08:00
Aaron Patterson 2105fec017
Merging path prefixes is only done in object / collection rendering 2020-02-26 17:14:18 -08:00
Aaron Patterson 51f50a923e
path ivar is not required 2020-02-26 16:44:35 -08:00
Aaron Patterson 17fb6f0503
Move `partial_path` to ObjectRendering
Partial paths are only required for deriving template info for rendering
objects, which is only the case for the object renderer and the
collection renderer
2020-02-26 16:42:42 -08:00
Aaron Patterson 7210adb7ec
move locals and details ivar set in to initialize 2020-02-26 16:35:03 -08:00
Aaron Patterson ef6e03d5b1
Move options ivar assignment in to the superclass 2020-02-26 16:33:27 -08:00
Aaron Patterson f3dfd28821
remove extra ivar set 2020-02-26 16:19:19 -08:00
Aaron Patterson f8f2f9ce32
remove the as_variable method 2020-02-26 16:17:49 -08:00
Aaron Patterson f0a1548433
as: doesn't make sense without an object parameter
The local variable name in `as:` may not be a valid local variable name,
but if there is no object specified to be assigned to the parameter,
then why supply the `as:`?  This commit adds an object for the as param
2020-02-26 16:13:12 -08:00
Aaron Patterson 9187f7482c
partial renderer is specialized for rendering partials now 2020-02-26 15:57:59 -08:00
Aaron Patterson feec68436c
remove has_object ivar 2020-02-26 15:39:57 -08:00
Aaron Patterson 8b6c5850a5
introduce an object renderer 2020-02-26 15:37:45 -08:00
Aaron Patterson 844568c231
remove at ivar again 2020-02-26 15:06:29 -08:00
Aaron Patterson 10f7201fc5
remove more collection references from the superclass 2020-02-26 15:04:18 -08:00
Aaron Patterson 974ddb035c
remove collection references from the superclass 2020-02-26 14:59:33 -08:00
Aaron Patterson 0c1fbc7e04
collection rendering has its own class 2020-02-26 14:51:31 -08:00
Aaron Patterson 0c1d14a810
a collection is never rendered with an object 2020-02-26 08:34:03 -08:00
Aaron Patterson 6539657a3c
pull iterator allocation in to a factory method 2020-02-26 08:18:47 -08:00
Aaron Patterson 347094856c
Only iterate over collections once when a path is provided
We'll later reuse this object to speed up the case when a relation is
passed in.
2020-02-25 16:07:36 -08:00
Aaron Patterson 638cc381b1
rely less on the collection ivar 2020-02-25 15:17:05 -08:00
John Hawthorn 22d9b3e83e
Merge pull request #38569 from jhawthorn/simplify_fixture_resolver
Simplify fixture resolver
2020-02-25 14:54:17 -08:00
Aaron Patterson 5fa2c69e4b
Don't to_a things when we don't need to.
If the partial renderer is passed a relation or collection proxy, it
will be good for us to resolve that relation or collection proxy as late
as possible.
2020-02-25 14:42:52 -08:00
Aaron Patterson c52fa675b8
Find the layout earlier
Remove duplication in finding a layout.  Remove `@as` ivar.
2020-02-25 14:12:38 -08:00
Aaron Patterson 67b1a7942e
remove useless conditional 2020-02-25 13:52:45 -08:00
Aaron Patterson 7a9c90184a
variable ivar is not needed anymore 2020-02-25 13:42:05 -08:00
Aaron Patterson 99d74cac99
Don't rely on the collection ivar
We're going to turn this in to a more complex iterator
2020-02-25 13:33:41 -08:00
Aaron Patterson 64b3bcb0b9
block does not need to be an ivar 2020-02-25 10:26:43 -08:00
Aaron Patterson 867c4c2e60
collection with/without template are the same 2020-02-25 10:25:41 -08:00
Aaron Patterson 96f89fbf5d
collection with/without template are more similar 2020-02-25 10:05:42 -08:00
Aaron Patterson dc1633090e
extract template keys to a method 2020-02-24 19:43:28 -08:00
Aaron Patterson 7e872091e1
pull template keys up 2020-02-24 19:17:38 -08:00
John Hawthorn c3c1c32f4b Simplify FixtureResolver to reuse filtering logic
Previously FixtureResolver had a copy-pasted version of the filtering
already done by OptimizedFileSystemResolver. This PR replaces this by
extracting the two places actual filesystem operations into separate
methods and overriding those.

It would be nice to not rely on overriding methods at all, and to
extract the actual filtering into a separate, reusable class, but I
don't want to do that until some other changes are made to the
filtering.

This should also make FixtureResolver much more accurate to
OptimizedFileSystemResolver, by also creating and caching the
UnboundTemplate classes, which de-duplicate templates.
2020-02-24 16:22:58 -08:00
John Hawthorn a9e455f484 Mostly remove bad test
This test was attempting to test how cache keys work by modifying the
templates and seeing when that cache was fresh. This doesn't actually
work for real Resolvers, only FixtureResolver, and isn't desirable. We
absolutely want to share templates if they resolve to the same file.

Instead, this simplifies the test to only check that we get the correct
template for the locale we request.
2020-02-24 16:20:33 -08:00
Gannon McGibbon eaa33bbdff Use type attribute in ActionView::Helpers::JavaScriptHelper#javascript_tag example 2020-02-24 18:04:29 -05:00
Steve Thomas ddcc3212c0 Update boolean attributes for actionview tag helper 2020-02-24 10:23:30 -05:00
Eugene Kenny 9e40348645 Enable HashTransformKeys and HashTransformValues cops
Followup to 88fe76e693.

These are new in RuboCop 0.80.0, and enforce a style we already prefer
for performance reasons (see df81f2e5f5).
2020-02-20 22:37:32 +00:00
Joel Hawksley 05a2a939f0 Remove validations from example components
We're moving away from using validations in our
component framework, and feel that it's better
to avoid prescribing their usage in these
example classes, which exist to serve as example
objects that are compatible with the render_in
API.
2020-02-20 09:48:25 -07:00
aminamos 7bb0706f2c update from PR #36222 2020-02-12 13:31:43 -05:00
Stefan Wrobel 8877b5ff16
Fix translate method with default: nil
```ruby
    I18n.translate('missing.translation', default: nil)
    # => nil
    helper.translate('missing.translation', default: nil)
    # Before
    # => "<span class=\"translation_missing\" title=\"translation missing: en.missing.translation\">Translation</span>"
    # After
    # => nil
    ```
2020-02-09 23:22:00 +01:00
Ryuta Kamizono 051e349041 Prefer faster `str.start_with?` over `str.first ==`
```ruby
str = "abc"

Benchmark.ips do |x|
  x.report("start_with?") { str.start_with?("a") }
  x.report("first ==")    { str.first == "a" }
end
```

```
Warming up --------------------------------------
         start_with?   282.381k i/100ms
            first ==   207.305k i/100ms
Calculating -------------------------------------
         start_with?     10.239M (± 2.2%) i/s -     51.393M in   5.022151s
            first ==      4.593M (± 4.5%) i/s -     23.011M in   5.021434s
```
2020-02-05 19:15:33 +09:00
Ryuta Kamizono b803ed012c Make `localize` helper takes keyword arguments the same with `I18n.localize` 2020-02-05 18:49:44 +09:00
Ryuta Kamizono 6c02fee08f Make `translate` helper takes keyword arguments the same with `I18n.translate` 2020-02-05 18:04:27 +09:00
Ryuta Kamizono 5d2789b11b Avoid extra Array allocation for `build_tag_values` 2020-01-16 08:25:38 +09:00
Iago Pimenta e7c3eb11e0 Use default order of PathResolver::EXTENSIONS for sort templates 2020-01-09 12:01:41 -08:00
John Hawthorn cd0fbaea01 Define fake_zones on AS::TimeZone, not singleton
Previously this was incorrectly defining this attribute on the singleton
class, which would end up actually using the class variable from Module.
2020-01-04 17:50:59 -08:00
Ryuta Kamizono 785427b88c Merge pull request #38132
Closes #38132
2020-01-02 17:29:00 +09:00
Josef Šimánek 64f3bd0a8d
Use travel_to to in date_helper_test.rb. 2020-01-02 02:11:33 +01:00
Abhay Nikam d8beb77252 Bump license years from 2019 to 2020 [ci skip] 2020-01-01 15:10:31 +05:30
Rafael França 4fbb393b25
Merge pull request #35023 from hahmed/deprecate-global-rails-command-docs
Remove reference to global rails command in the docs
2019-12-27 16:39:55 -03:00