class BetterHtml::BetterErb::ValidatedOutputBuffer::Context
Public Class Methods
new(output, context, code, auto_escape)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 9 def initialize(output, context, code, auto_escape) @output = output @context = context @code = code @auto_escape = auto_escape end
Public Instance Methods
safe_after_attribute_name_append=(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 53 def safe_after_attribute_name_append=(value) return if value.nil? unless value.is_a?(BetterHtml::HtmlAttributes) raise DontInterpolateHere, "Do not interpolate #{value.class} in a tag. "\ "Instead of <#{@context[:tag_name]} <%=#{@code}%>> please "\ "try <#{@context[:tag_name]} <%= html_attributes(attr: value) %>>." end @output.safe_append= value.to_s end
safe_after_equal_append=(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 65 def safe_after_equal_append=(value) raise DontInterpolateHere, "Do not interpolate without quotes after "\ "attribute around '#{@context[:attribute_name]}=<%=#{@code}%>'." end
safe_attribute_name_append=(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 41 def safe_attribute_name_append=(value) return if value.nil? value = value.to_s unless value =~ /\A[a-z0-9\-]*\z/ raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\ "into a attribute name around '#{@context[:attribute_name]}<%=#{@code}%>'." end @output.safe_append= value end
safe_comment_append=(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 114 def safe_comment_append=(value) return if value.nil? value = properly_escaped(value) # in a <!-- ...here --> we disallow --> if value =~ /-->/ raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\ "into a html comment around: <!--#{@context[:comment_text]}<%=#{@code}%>." end @output.safe_append= value end
safe_none_append=(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 127 def safe_none_append=(value) return if value.nil? @output.safe_append= properly_escaped(value) end
safe_quoted_value_append=(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 16 def safe_quoted_value_append=(value) return if value.nil? value = properly_escaped(value) if value.include?(@context[:quote_character]) raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\ "into a quoted attribute value. The value cannot contain the character #{@context[:quote_character]}." end @output.safe_append= value end
safe_rawtext_append=(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 94 def safe_rawtext_append=(value) return if value.nil? value = properly_escaped(value) if @context[:tag_name].downcase == 'script' && (value =~ /<script/i || value =~ /<\/script/i) # https://www.w3.org/TR/html5/scripting-1.html#restrictions-for-contents-of-script-elements raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\ "into a script tag around: <#{@context[:tag_name]}>#{@context[:rawtext_text]}<%=#{@code}%>. "\ "A script tag cannot contain <script or </script anywhere inside of it." elsif value =~ /<#{Regexp.escape(@context[:tag_name].downcase)}/i || value =~ /<\/#{Regexp.escape(@context[:tag_name].downcase)}/i raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\ "into a #{@context[:tag_name].downcase} tag around: <#{@context[:tag_name]}>#{@context[:rawtext_text]}<%=#{@code}%>." end @output.safe_append= value end
safe_space_after_attribute_append=(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 35 def safe_space_after_attribute_append=(value) raise DontInterpolateHere, "Add a space after this attribute value. Instead of "\ "<#{@context[:tag_name]} #{@context[:attribute_name]}=\"#{@context[:attribute_value]}\"<%=#{@code}%>> "\ "try <#{@context[:tag_name]} #{@context[:attribute_name]}=\"#{@context[:attribute_value]}\" <%=#{@code}%>>." end
safe_tag_append=(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 70 def safe_tag_append=(value) return if value.nil? unless value.is_a?(BetterHtml::HtmlAttributes) raise DontInterpolateHere, "Do not interpolate #{value.class} in a tag. "\ "Instead of <#{@context[:tag_name]} <%=#{@code}%>> please "\ "try <#{@context[:tag_name]} <%= html_attributes(attr: value) %>>." end @output.safe_append= value.to_s end
safe_tag_name_append=(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 82 def safe_tag_name_append=(value) return if value.nil? value = value.to_s unless value =~ /\A[a-z0-9\:\-]*\z/ raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\ "into a tag name around: <#{@context[:tag_name]}<%=#{@code}%>>." end @output.safe_append= value end
safe_unquoted_value_append=(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 28 def safe_unquoted_value_append=(value) raise DontInterpolateHere, "Do not interpolate without quotes around this "\ "attribute value. Instead of "\ "<#{@context[:tag_name]} #{@context[:attribute_name]}=#{@context[:attribute_value]}<%=#{@code}%>> "\ "try <#{@context[:tag_name]} #{@context[:attribute_name]}=\"#{@context[:attribute_value]}<%=#{@code}%>\">." end
Private Instance Methods
auto_escape_html_safe_value(arg)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 148 def auto_escape_html_safe_value(arg) arg.html_safe? ? arg : CGI.escapeHTML(arg).html_safe end
properly_escaped(value)
click to toggle source
# File lib/better_html/better_erb/validated_output_buffer.rb, line 134 def properly_escaped(value) if value.is_a?(ValidatedOutputBuffer) # in html context, never escape a ValidatedOutputBuffer value.to_s else # in html context, follow auto_escape rule if @auto_escape auto_escape_html_safe_value(value.to_s) else value.to_s end end end