1 files changed, 28 insertions, 19 deletions

diff --git a/actionview/lib/action_view/template.rb b/actionview/lib/action_view/template.rb
index 169ee55fdc..c01dd1c028 100644
--- a/actionview/lib/action_view/template.rb
+++ b/actionview/lib/action_view/template.rb
@@ -1,6 +1,7 @@
-require 'active_support/core_ext/object/try'
-require 'active_support/core_ext/kernel/singleton_class'
-require 'thread'
+require "active_support/core_ext/object/try"
+require "active_support/core_ext/kernel/singleton_class"
+require "active_support/core_ext/module/delegation"
+require "thread"
 
 module ActionView
   # = Action View Template
@@ -65,8 +66,7 @@ module ActionView
     # If you want to provide an alternate mechanism for
     # specifying encodings (like ERB does via <%# encoding: ... %>),
     # you may indicate that you will handle encodings yourself
-    # by implementing <tt>self.handles_encoding?</tt>
-    # on your handler.
+    # by implementing <tt>handles_encoding?</tt> on your handler.
     #
     # If you do, Rails will not try to encode the String
     # into the default_internal, passing you the unaltered
@@ -153,7 +153,7 @@ module ActionView
     # we use a bang in this instrumentation because you don't want to
     # consume this in production. This is only slow if it's being listened to.
     def render(view, locals, buffer=nil, &block)
-      instrument("!render_template".freeze) do
+      instrument_render_template do
         compile!(view)
         view.send(method_name, locals, buffer, &block)
       end
@@ -180,12 +180,12 @@ module ActionView
       name    = pieces.pop
       partial = !!name.sub!(/^_/, "")
       lookup.disable_cache do
-        lookup.find_template(name, [ pieces.join('/') ], partial, @locals)
+        lookup.find_template(name, [ pieces.join("/") ], partial, @locals)
       end
     end
 
     def inspect
-      @inspect ||= defined?(Rails.root) ? identifier.sub("#{Rails.root}/", ''.freeze) : identifier
+      @inspect ||= defined?(Rails.root) ? identifier.sub("#{Rails.root}/", "".freeze) : identifier
     end
 
     # This method is responsible for properly setting the encoding of the
@@ -204,7 +204,7 @@ module ActionView
       # Look for # encoding: *. If we find one, we'll encode the
       # String in that encoding, otherwise, we'll use the
       # default external encoding.
-      if source.sub!(/\A#{ENCODING_FLAG}/, '')
+      if source.sub!(/\A#{ENCODING_FLAG}/, "")
         encoding = magic_encoding = $1
       else
         encoding = Encoding.default_external
@@ -325,30 +325,39 @@ module ActionView
       end
 
       def locals_code #:nodoc:
+        # Only locals with valid variable names get set directly. Others will
+        # still be available in local_assigns.
+        locals = @locals.to_set - Module::DELEGATION_RESERVED_METHOD_NAMES
+        locals = locals.grep(/\A(?![A-Z0-9])(?:[[:alnum:]_]|[^\0-\177])+\z/)
+
         # Double assign to suppress the dreaded 'assigned but unused variable' warning
-        @locals.each_with_object('') { |key, code| code << "#{key} = #{key} = local_assigns[:#{key}];" }
+        locals.each_with_object("") { |key, code| code << "#{key} = #{key} = local_assigns[:#{key}];" }
       end
 
       def method_name #:nodoc:
         @method_name ||= begin
           m = "_#{identifier_method_name}__#{@identifier.hash}_#{__id__}"
-          m.tr!('-'.freeze, '_'.freeze)
+          m.tr!("-".freeze, "_".freeze)
           m
         end
       end
 
       def identifier_method_name #:nodoc:
-        inspect.tr('^a-z_'.freeze, '_'.freeze)
+        inspect.tr("^a-z_".freeze, "_".freeze)
       end
 
       def instrument(action, &block)
-        payload = { virtual_path: @virtual_path, identifier: @identifier }
-        case action
-        when "!render_template".freeze
-          ActiveSupport::Notifications.instrument("!render_template.action_view".freeze, payload, &block)
-        else
-          ActiveSupport::Notifications.instrument("#{action}.action_view".freeze, payload, &block)
-        end
+        ActiveSupport::Notifications.instrument("#{action}.action_view".freeze, instrument_payload, &block)
+      end
+
+    private
+
+      def instrument_render_template(&block)
+        ActiveSupport::Notifications.instrument("!render_template.action_view".freeze, instrument_payload, &block)
+      end
+
+      def instrument_payload
+        { virtual_path: @virtual_path, identifier: @identifier }
       end
   end
 end