Module: Phlex::SGML::Attributes

Extended by:
Attributes
Included in:
Attributes
Defined in:
lib/phlex/sgml/attributes.rb

Constant Summary collapse

UNSAFE_ATTRIBUTES = 
Set.new(%w[srcdoc sandbox http-equiv]).freeze
REF_ATTRIBUTES = 
Set.new(%w[href src action formaction lowsrc dynsrc background ping xlinkhref]).freeze
NAMED_CHARACTER_REFERENCES = 
{
	"colon" => ":",
	"tab" => "\t",
	"newline" => "\n",
}.freeze
UNSAFE_ATTRIBUTE_NAME_CHARS = 
%r([<>&"'/=\s\x00])

Instance Method Summary collapse

Instance Method Details

#decode_html_character_references(value) ⇒ Object 



171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
 
# File 'lib/phlex/sgml/attributes.rb', line 171

def decode_html_character_references(value)
	value
		.gsub(/&#x([0-9a-f]+);?/i) {
			begin
				[$1.to_i(16)].pack("U*")
			rescue
				""
			end
		}
		.gsub(/&#(\d+);?/) {
			begin
				[$1.to_i].pack("U*")
			rescue
				""
			end
		}
		.gsub(/&([a-z][a-z0-9]+);?/i) {
			NAMED_CHARACTER_REFERENCES[$1.downcase] || ""
		}
end

#generate_attributes(attributes, buffer = +"")) ⇒ Object 



15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
 
# File 'lib/phlex/sgml/attributes.rb', line 15

def generate_attributes(attributes, buffer = +"")
	attributes.each do |k, v|
		next unless v

		name = case k
			when String then k
			when Symbol then k.name.tr("_", "-")
			else raise Phlex::ArgumentError.new("Attribute keys should be Strings or Symbols.")
		end

		value = case v
		when true
			true
		when String
			v.gsub('"', "&quot;")
		when Symbol
			v.name.tr("_", "-").gsub('"', "&quot;")
		when Integer, Float
			v.to_s
		when Date
			v.iso8601
		when Time
			v.respond_to?(:iso8601) ? v.iso8601 : v.strftime("%Y-%m-%dT%H:%M:%S%:z")
		when Hash
			case k
			when :style
				generate_styles(v).gsub('"', "&quot;")
			else
				generate_nested_attributes(v, "#{name}-", buffer)
			end
		when Array
			case k
			when :style
				generate_styles(v).gsub('"', "&quot;")
			else
				generate_nested_tokens(v)
			end
		when Set
			case k
			when :style
				generate_styles(v).gsub('"', "&quot;")
			else
				generate_nested_tokens(v.to_a)
			end
		when Phlex::SGML::SafeObject
			v.to_s.gsub('"', "&quot;")
		else
			if v.respond_to?(:to_h)
				generate_nested_attributes(v.to_h, "#{name}-", buffer)
			else
				raise Phlex::ArgumentError.new("Invalid attribute value for #{k}: #{v.inspect}.")
			end
		end

		lower_name = name.downcase

		unless Phlex::SGML::SafeObject === v
			normalized_name = lower_name.delete("^a-z-")

			if value != true && REF_ATTRIBUTES.include?(normalized_name)
				case value
				when String
					decoded_value = decode_html_character_references(value)

					if decoded_value.downcase.delete("^a-z:").start_with?("javascript:")
						# We just ignore these because they were likely not specified by the developer.
						next
					end
				else
					raise Phlex::ArgumentError.new("Invalid attribute value for #{k}: #{v.inspect}.")
				end
			end

			if normalized_name.bytesize > 2 && normalized_name.start_with?("on") && !normalized_name.include?("-")
				raise Phlex::ArgumentError.new("Unsafe attribute name detected: #{k}.")
			end

			if UNSAFE_ATTRIBUTES.include?(normalized_name)
				raise Phlex::ArgumentError.new("Unsafe attribute name detected: #{k}.")
			end
		end

		if name.match?(UNSAFE_ATTRIBUTE_NAME_CHARS)
			raise Phlex::ArgumentError.new("Unsafe attribute name detected: #{k}.")
		end

		if lower_name.to_sym == :id && k != :id
			raise Phlex::ArgumentError.new(":id attribute should only be passed as a lowercase symbol.")
		end

		case value
		when true
			buffer << " " << name
		when String
			buffer << " " << name << '="' << value << '"'
		end
	end

	buffer
end

#generate_nested_attributes(attributes, base_name, buffer = +"")) ⇒ Object

Provides the nested-attributes case for serializing out attributes. This allows us to skip many of the checks the __attributes__ method must perform.



118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
 
# File 'lib/phlex/sgml/attributes.rb', line 118

def generate_nested_attributes(attributes, base_name, buffer = +"")
	attributes.each do |k, v|
		next unless v

		if (root_key = (:_ == k))
			name = ""
			original_base_name = base_name
			base_name = base_name.delete_suffix("-")
		else
			name = case k
				when String then k
				when Symbol then k.name.tr("_", "-")
				else raise Phlex::ArgumentError.new("Attribute keys should be Strings or Symbols")
			end

			if name.match?(UNSAFE_ATTRIBUTE_NAME_CHARS)
				raise Phlex::ArgumentError.new("Unsafe attribute name detected: #{k}.")
			end
		end

		case v
		when true
			buffer << " " << base_name << name
		when String
			buffer << " " << base_name << name << '="' << v.gsub('"', "&quot;") << '"'
		when Symbol
			buffer << " " << base_name << name << '="' << v.name.tr("_", "-").gsub('"', "&quot;") << '"'
		when Integer, Float
			buffer << " " << base_name << name << '="' << v.to_s << '"'
		when Hash
			generate_nested_attributes(v, "#{base_name}#{name}-", buffer)
		when Array
			if (value = generate_nested_tokens(v))
				buffer << " " << base_name << name << '="' << value << '"'
			end
		when Set
			if (value = generate_nested_tokens(v.to_a))
				buffer << " " << base_name << name << '="' << value << '"'
			end
		when Phlex::SGML::SafeObject
			buffer << " " << base_name << name << '="' << v.to_s.gsub('"', "&quot;") << '"'
		else
			raise Phlex::ArgumentError.new("Invalid attribute value #{v.inspect}.")
		end

		if root_key
			base_name = original_base_name
		end

		buffer
	end
end

#generate_nested_tokens(tokens, sep = " ", gsub_from = nil, gsub_to = "") ⇒ Object 



192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
 
# File 'lib/phlex/sgml/attributes.rb', line 192

def generate_nested_tokens(tokens, sep = " ", gsub_from = nil, gsub_to	= "")
	buffer = +""

	i, length = 0, tokens.length

	while i < length
		token = tokens[i]

		case token
		when String
			token = token.gsub(gsub_from, gsub_to) if gsub_from
			if i > 0
				buffer << sep << token
			else
				buffer << token
			end
		when Symbol
			if i > 0
				buffer << sep << token.name.tr("_", "-")
			else
				buffer << token.name.tr("_", "-")
			end
		when Integer, Float, Phlex::SGML::SafeObject
			if i > 0
				buffer << sep << token.to_s
			else
				buffer << token.to_s
			end
		when Array
			if token.length > 0 && (value = generate_nested_tokens(token, sep, gsub_from, gsub_to))
				if i > 0
					buffer << sep << value
				else
					buffer << value
				end
			end
		when Set
			if token.length > 0 && (value = generate_nested_tokens(token.to_a, sep, gsub_from, gsub_to))
				if i > 0
					buffer << sep << value
				else
					buffer << value
				end
			end
		when nil
			# Do nothing
		else
			raise Phlex::ArgumentError.new("Invalid token type: #{token.class}.")
		end

		i += 1
	end

	return if buffer.empty?

	buffer.gsub('"', "&quot;")
end

#generate_styles(styles) ⇒ Object

The result is unsafe so should be escaped.



251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
 
# File 'lib/phlex/sgml/attributes.rb', line 251

def generate_styles(styles)
	case styles
	when Array, Set
		styles.filter_map do |s|
			case s
			when String
				if s == "" || s.end_with?(";")
					s
				else
					"#{s};"
				end
			when Phlex::SGML::SafeObject
				value = s.to_s
				value.end_with?(";") ? value : "#{value};"
			when Hash
				next generate_styles(s)
			when nil
				next nil
			else
				raise Phlex::ArgumentError.new("Invalid style: #{s.inspect}.")
			end
		end.join(" ")
	when Hash
		buffer = +""
		i = 0
		styles.each do |k, v|
			prop = case k
			when String
				k
			when Symbol
				k.name.tr("_", "-")
			else
				raise Phlex::ArgumentError.new("Style keys should be Strings or Symbols.")
			end

			value = case v
			when String
				v
			when Symbol
				v.name.tr("_", "-")
			when Integer, Float, Phlex::SGML::SafeObject
				v.to_s
			when nil
				nil
			else
				raise Phlex::ArgumentError.new("Invalid style value: #{v.inspect}")
			end

			if value
				if i == 0
					buffer << prop << ": " << value << ";"
				else
					buffer << " " << prop << ": " << value << ";"
				end
			end

			i += 1
		end

		buffer
	end
end