aboutsummaryrefslogtreecommitdiffstats
path: root/actionview/test/template
Commit message (Collapse)AuthorAgeFilesLines
* Fix checking for template variants when using the ActionView::FixtureResolverEdward Rudd2019-04-031-0/+10
|
* Always reject files external to appJohn Hawthorn2019-04-032-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, when using `render file:`, it was possible to render files not only at an absolute path or relative to the current directory, but relative to ANY view paths. This was probably done for absolutely maximum compatibility when addressing CVE-2016-0752, but I think is unlikely to be used in practice. Tihs commit removes the ability to `render file:` with a path relative to a non-fallback view path. Make FallbackResolver.new private To ensure nobody is making FallbackResolvers other than "/" and "". Make reject_files_external_... no-op for fallbacks Because there are only two values used for path: "" and "/", and File.join("", "") == File.join("/", "") == "/", this method was only testing that the absolute paths started at "/" (which of course all do). This commit doesn't change any behaviour, but it makes it explicit that the FallbackFileSystemResolver works this way. Remove outside_app_allowed argument Deprecate find_all_anywhere This is now equivalent to find_all Remove outside_app argument Deprecate find_file for find Both LookupContext#find_file and PathSet#find_file are now equivalent to their respective #find methods.
* url -> URL where apt except inside actionpack/Sharang Dashputre2019-04-011-1/+1
|
* Merge pull request #35688 from jhawthorn/render_file_rfcAaron Patterson2019-03-303-16/+37
|\ | | | | RFC: Introduce Template::File
| * Introduce Template::File as new render file:John Hawthorn2019-03-273-16/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The previous behaviour of render file: was essentially the same as render template:, except that templates can be specified as an absolute path on the filesystem. This makes sense for historic reasons, but now render file: is almost exclusively used to render raw files (not .erb) like public/404.html. In addition to complicating the code in template/resolver.rb, I think the current behaviour is surprising to developers. This commit deprecates the existing "lookup a template from anywhere" behaviour and replaces it with "render this file exactly as it is on disk". Handlers will no longer be used (it will render the same as if the :raw handler was used), but formats (.html, .xml, etc) will still be detected (and will default to :plain). The existing render file: behaviour was the path through which Rails apps were vulnerable in the recent CVE-2019-5418. Although the vulnerability has been patched in a fully backwards-compatible way, I think it's a strong hint that we should drop the existing previously-vulnerable behaviour if it isn't a benefit to developers.
* | Fix annotated typoPrathamesh Sonpatki2019-03-291-4/+4
| |
* | Merge pull request #35308 from ↵Rafael França2019-03-281-0/+6
|\ \ | |/ |/| | | | | erose/better-error-reporting-for-syntax-errors-in-templates Display a more helpful error message when an ERB template has a Ruby syntax error.
| * Add handling and tests.Eli Rose2019-02-171-0/+6
| |
* | Deprecate custom patterns for PathResolverJohn Hawthorn2019-03-261-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Custom glob patterns tie the implementation (Using Dir.glob) to the API we provide. It also doesn't really work. extract_handler_and_format_and_variant expects the handler, format, and variant to be at the end of the template path, and in the same order as they are in the default pattern. This deprecates specifying a custom path for FileSystemResolver and removes the pattern argument of OptimizedFileSystemResolver#initialize, which does not work with a custom pattern.
* | Prefer render template: in testsJohn Hawthorn2019-03-214-39/+40
| | | | | | | | | | | | | | | | | | | | | | | | Many tests were using `render file:`, but were only testing the behaviour of `render template:` (file: just allows more paths/ is less secure then template:). The reason for so many `render file:` is probably that they were the old default. This commit replaces `render file:` with `render template:` anywhere the test wasn't specifically interested in using `render file:`.
* | Merge pull request #35661 from jhawthorn/lookup_context_validationEileen M. Uchitelle2019-03-201-1/+9
|\ \ | | | | | | Validate types assigned to LookupContext#formats=
| * | Don't compact formatsJohn Hawthorn2019-03-191-5/+0
| | |
| * | Improve "raises on invalid format assignment" testJohn Hawthorn2019-03-181-2/+2
| | |
| * | Raise in LookupContext#formats= on invalid formatJohn Hawthorn2019-03-181-0/+8
| | | | | | | | | | | | | | | | | | This is a developer quality of life improvement, to ensure that unknown formats aren't assigned (which it would previously accept, but wouldn't work 100% correctly due to caching).
| * | Make uniq in LookupContext#formats=John Hawthorn2019-03-181-1/+1
| | | | | | | | | | | | | | | Having a format listed twice had no effect. This is mostly helpful to avoid an extra format when assigning [:html, "*/*"]
| * | Ignore nil in LookupContext#formats=John Hawthorn2019-03-181-0/+5
| | | | | | | | | | | | | | | This also removes the mutation we were performing on the values being passed in.
* | | Merge pull request #35662 from jhawthorn/fallback_resolver_no_virtual_pathAaron Patterson2019-03-191-0/+16
|\ \ \ | | | | | | | | Remove virtual_path from fallback templates
| * | | Remove virtual_path from fallback templatesJohn Hawthorn2019-03-181-0/+16
| |/ /
* | | Merge pull request #35604 from jhawthorn/validate_mime_typesEileen M. Uchitelle2019-03-191-2/+2
|\ \ \ | |/ / |/| | Raise exception when building invalid mime type
| * | Raise exception when building invalid mime typeJohn Hawthorn2019-03-141-2/+2
| | | | | | | | | | | | | | | | | | | | | This allows mime types in the form text/html, text/*, or */* This required a few minor test/code changes where previously nil was used as a mime string.
* | | Make Template::Resolver always cacheJohn Hawthorn2019-03-152-50/+2
|/ / | | | | | | | | | | | | | | | | | | | | | | All actionview caches are already cleared at the start of each request (when Resolver.caching is false) by PerExecutionDigestCacheExpiry, which calls LookupContext::DetailsKey.clear (which clears all caches). Because caches are always cleared per-request in dev, we shouldn't need this extra logic to compare mtimes and conditionally reload templates. This should make templates slightly faster in development (particularly multiple renders of the same template)
* | Remove query_format argument from resolverJohn Hawthorn2019-02-261-1/+1
| |
* | Create templates with format=nilJohn Hawthorn2019-02-263-4/+4
| |
* | Merge pull request #35411 from rails/pass-locals-to-templateAaron Patterson2019-02-261-9/+7
|\ \ | | | | | | Pass locals in to the template object on construction
| * | Expand key word args for ActionView::TemplateAaron Patterson2019-02-251-1/+1
| | |
| * | Pass locals in to the template object on constructionAaron Patterson2019-02-251-8/+6
| | | | | | | | | | | | | | | | | | | | | This commit ensures that locals are passed in to the template objects when they are constructed, then removes the `locals=` mutator on the template object. This means we don't need to mutate Template objects with locals in the `decorate` method.
* | | [ci skip] Renamed formats -> format in test after #35406Abhay Nikam2019-02-261-1/+1
|/ /
* | Improve Template#inspect output (#35407)John Hawthorn2019-02-251-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | * Don't call inspect from identifier_method_name * Add locals Template#inspect Handler, formats, and variant are usually obvious from looking at the identifier. However it's not uncommon to have different locals for the same template so we should make that obvious in inspect. * Add tests for short_identifier and inspect [John Hawthorn + Rafael Mendonça França]
* | Templates have one formatAaron Patterson2019-02-257-9/+9
| | | | | | | | | | | | | | Templates only have one format. Before this commit, templates would be constructed with a single element array that contained the format. This commit eliminates the single element array and just implements a `format` method. This saves one array allocation per template.
* | Always pass a format to the ActionView::Template constructorAaron Patterson2019-02-251-2/+4
| | | | | | | | | | This means we can eliminate nil checks and remove some mutations from the `decorate` method.
* | Prefer I18n.with_localeGeorge Claghorn2019-02-212-52/+37
| |
* | Deprecate ActionView::PathSet as argument to ActionView::Base.newCliff Pruitt2019-02-201-0/+4
| | | | | | | | Currently, `ActionView::Base.new` will raise a `NotImplementedError` when given an instance of `ActionView::PathSet` on initialization. This commit prevents the raised error in favor of a deprecation warning.
* | Deprecate LookupContext#rendered_formatAaron Patterson2019-02-191-0/+10
| | | | | | | | | | We no longer depend on `rendered_format` side effects, so we can remove this method now. 🎉
* | Move inline rendering content-type test to a controller testAaron Patterson2019-02-191-5/+0
| | | | | | | | | | | | This commit is to remove direct access to the "rendered_format" attribute on the lookup context. "rendered_format" is an implementation detail that we shouldn't test directly.
* | Add a test that writes to the collection cacheAaron Patterson2019-02-191-1/+8
| |
* | Merge pull request #35293 from rails/remove-rendered-format-from-cacheAaron Patterson2019-02-192-13/+14
|\ \ | | | | | | Pass the template format to the digestor
| * | Pass the template format to the digestorAaron Patterson2019-02-152-13/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit passes the template format to the digestor in order to come up with a key. Before this commit, the digestor would depend on the side effect of the template renderer setting the rendered_format on the lookup context. I would like to remove that mutation, so I've changed this to pass the template format in to the digestor. I've introduced a new instance variable that will be alive during a template render. When the template is being rendered, it pushes the current template on to a stack, setting `@current_template` to the template currently being rendered. When the cache helper asks the digestor for a key, it uses the format of the template currently on the stack.
* | | Merge pull request #35281 from ↵Aaron Patterson2019-02-151-0/+7
|\ \ \ | | | | | | | | | | | | | | | | y-yagi/show_deprecated_message_instead_of_raise_exception Show deprecated message instead of raise exception in `compiled_method_container` method
| * | | Show deprecated message instead of raise exception in ↵yuuji.yaginuma2019-02-161-0/+7
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `compiled_method_container` method Since #35036, the subclasses of `ActionView::Base` requires the `compiled_method_container`. This is incompatible. For example, `web-console` use view class that subclass of `ActionView::Base`, and does not work it now cause of this. Actually, since it seems that it is only `ActionView::Base` that `compiled_method_container` is necessary, modified the condition that emits a warning.
* / / Allow to pass options to `csp_meta_tag`yuuji.yaginuma2019-02-161-0/+4
|/ / | | | | | | | | | | | | | | | | | | | | | | Currently `csp_meta_tag` generates `name` attribute only. However, in libraries like `Material-UI` and `JSS`, expect that the meta tag that contains the nonce with `property` attribute. https://material-ui.com/css-in-js/advanced/#how-does-one-implement-csp https://github.com/cssinjs/jss/blob/master/docs/csp.md This patch allows `csp_meta_tag` to specify arbitrary options and allows `nonce` to be passed to those libraries.
* / Add test for `csp_meta_tag`yuuji.yaginuma2019-02-141-0/+31
|/
* Merge pull request #35253 from rails/cached-collections-must-have-a-templateAaron Patterson2019-02-131-0/+11
|\ | | | | Cached collections only work if there is one template
| * Cached collections only work if there is one templateAaron Patterson2019-02-131-0/+11
| | | | | | | | | | Cached collections only work if there is one template. If there are more than one templates, the caching mechanism doesn't have a key.
* | Turn lookup context in to a stack, push and pop if formats changeAaron Patterson2019-02-112-4/+6
| | | | | | | | | | | | | | | | | | | | | | This commit keeps a stack of lookup contexts on the ActionView::Base instance. If a format is passed to render, we instantiate a new lookup context and push it on the stack, that way any child calls to "render" will use the same format information as the parent. This also isolates "sibling" calls to render (multiple calls to render in the same template). Fixes #35222 #34138
* | Adding another failing test caseAaron Patterson2019-02-111-1/+10
| |
* | Add a failing test for #35222Aaron Patterson2019-02-111-0/+6
|/
* Always call superAaron Patterson2019-02-082-2/+1
|
* Teach DetailsKey how to clear the template cacheAaron Patterson2019-02-083-10/+9
| | | | | This commit exposes all system wide view paths so that we can clear their caches.
* Split digest cache from details identity cacheAaron Patterson2019-02-082-0/+5
| | | | | This commit splits the digest cache from the "details identity" cache. Now both caches can be managed independently.
* Fix deprecation warnings and call superAaron Patterson2019-02-061-2/+2
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-26 03:36:25 +0000