Class: BetterHtml::BetterErb::ValidatedOutputBuffer::Context

Inherits:
Object
  • Object
show all
Defined in:
lib/better_html/better_erb/validated_output_buffer.rb

Instance Method Summary collapse

Constructor Details

#initialize(output, context, code, auto_escape) ⇒ Context

Returns a new instance of Context.



9
10
11
12
13
14
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 9

def initialize(output, context, code, auto_escape)
  @output = output
  @context = context
  @code = code
  @auto_escape = auto_escape
end

Instance Method Details

#safe_after_attribute_name_append=(value) ⇒ Object 



53
54
55
56
57
58
59
60
61
62
63
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 53

def safe_after_attribute_name_append=(value)
  return if value.nil?

  unless value.is_a?(BetterHtml::HtmlAttributes)
    raise DontInterpolateHere, "Do not interpolate #{value.class} in a tag. "\
      "Instead of <#{@context[:tag_name]} <%=#{@code}%>> please "\
      "try <#{@context[:tag_name]} <%= html_attributes(attr: value) %>>."
  end

  @output.safe_append= value.to_s
end

#safe_after_equal_append=(value) ⇒ Object

Raises:



65
66
67
68
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 65

def safe_after_equal_append=(value)
  raise DontInterpolateHere, "Do not interpolate without quotes after "\
    "attribute around '#{@context[:attribute_name]}=<%=#{@code}%>'."
end

#safe_attribute_name_append=(value) ⇒ Object 



41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 41

def safe_attribute_name_append=(value)
  return if value.nil?
  value = value.to_s

  unless value =~ /\A[a-z0-9\-]*\z/
    raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
      "into a attribute name around '#{@context[:attribute_name]}<%=#{@code}%>'."
  end

  @output.safe_append= value
end

#safe_comment_append=(value) ⇒ Object 



114
115
116
117
118
119
120
121
122
123
124
125
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 114

def safe_comment_append=(value)
  return if value.nil?
  value = properly_escaped(value)

  # in a <!-- ...here --> we disallow -->
  if value =~ /-->/
    raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
      "into a html comment around: <!--#{@context[:comment_text]}<%=#{@code}%>."
  end

  @output.safe_append= value
end

#safe_none_append=(value) ⇒ Object 



127
128
129
130
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 127

def safe_none_append=(value)
  return if value.nil?
  @output.safe_append= properly_escaped(value)
end

#safe_quoted_value_append=(value) ⇒ Object 



16
17
18
19
20
21
22
23
24
25
26
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 16

def safe_quoted_value_append=(value)
  return if value.nil?
  value = properly_escaped(value)

  if value.include?(@context[:quote_character])
    raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
      "into a quoted attribute value. The value cannot contain the character #{@context[:quote_character]}."
  end

  @output.safe_append= value
end

#safe_rawtext_append=(value) ⇒ Object 



94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 94

def safe_rawtext_append=(value)
  return if value.nil?

  value = properly_escaped(value)

  if @context[:tag_name].downcase == 'script' &&
      (value =~ /<script/i || value =~ /<\/script/i)
    # https://www.w3.org/TR/html5/scripting-1.html#restrictions-for-contents-of-script-elements
    raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
      "into a script tag around: <#{@context[:tag_name]}>#{@context[:rawtext_text]}<%=#{@code}%>. "\
      "A script tag cannot contain <script or </script anywhere inside of it."
  elsif value =~ /<#{Regexp.escape(@context[:tag_name].downcase)}/i ||
      value =~ /<\/#{Regexp.escape(@context[:tag_name].downcase)}/i
    raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
      "into a #{@context[:tag_name].downcase} tag around: <#{@context[:tag_name]}>#{@context[:rawtext_text]}<%=#{@code}%>."
  end

  @output.safe_append= value
end

#safe_space_after_attribute_append=(value) ⇒ Object

Raises:



35
36
37
38
39
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 35

def safe_space_after_attribute_append=(value)
  raise DontInterpolateHere, "Add a space after this attribute value. Instead of "\
    "<#{@context[:tag_name]} #{@context[:attribute_name]}=\"#{@context[:attribute_value]}\"<%=#{@code}%>> "\
    "try <#{@context[:tag_name]} #{@context[:attribute_name]}=\"#{@context[:attribute_value]}\" <%=#{@code}%>>."
end

#safe_tag_append=(value) ⇒ Object 



70
71
72
73
74
75
76
77
78
79
80
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 70

def safe_tag_append=(value)
  return if value.nil?

  unless value.is_a?(BetterHtml::HtmlAttributes)
    raise DontInterpolateHere, "Do not interpolate #{value.class} in a tag. "\
      "Instead of <#{@context[:tag_name]} <%=#{@code}%>> please "\
      "try <#{@context[:tag_name]} <%= html_attributes(attr: value) %>>."
  end

  @output.safe_append= value.to_s
end

#safe_tag_name_append=(value) ⇒ Object 



82
83
84
85
86
87
88
89
90
91
92
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 82

def safe_tag_name_append=(value)
  return if value.nil?
  value = value.to_s

  unless value =~ /\A[a-z0-9\:\-]*\z/
    raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
      "into a tag name around: <#{@context[:tag_name]}<%=#{@code}%>>."
  end

  @output.safe_append= value
end

#safe_unquoted_value_append=(value) ⇒ Object

Raises:



28
29
30
31
32
33
 
# File 'lib/better_html/better_erb/validated_output_buffer.rb', line 28

def safe_unquoted_value_append=(value)
  raise DontInterpolateHere, "Do not interpolate without quotes around this "\
    "attribute value. Instead of "\
    "<#{@context[:tag_name]} #{@context[:attribute_name]}=#{@context[:attribute_value]}<%=#{@code}%>> "\
    "try <#{@context[:tag_name]} #{@context[:attribute_name]}=\"#{@context[:attribute_value]}<%=#{@code}%>\">."
end