1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Commit graph

17 commits

Author SHA1 Message Date
Aaron Patterson
033a738817
Fix possible XSS vector in JS escape helper
This commit escapes dollar signs and backticks to prevent JS XSS issues
when using the `j` or `javascript_escape` helper

CVE-2020-5267
2020-03-19 09:48:08 -07:00
Sharang Dashputre
771973c13d url -> URL where apt except inside actionpack/ 2019-04-01 22:56:35 +05:30
yuuji.yaginuma
1b86d90136 Enable Performance/UnfreezeString cop
In Ruby 2.3 or later, `String#+@` is available and `+@` is faster than `dup`.

```ruby
# frozen_string_literal: true

require "bundler/inline"

gemfile(true) do
  source "https://rubygems.org"

  gem "benchmark-ips"
end

Benchmark.ips do |x|
  x.report('+@') { +"" }
  x.report('dup') { "".dup }
  x.compare!
end
```

```
$ ruby -v benchmark.rb
ruby 2.5.1p57 (2018-03-29 revision 63029) [x86_64-linux]
Warming up --------------------------------------
                  +@   282.289k i/100ms
                 dup   187.638k i/100ms
Calculating -------------------------------------
                  +@      6.775M (± 3.6%) i/s -     33.875M in   5.006253s
                 dup      3.320M (± 2.2%) i/s -     16.700M in   5.032125s

Comparison:
                  +@:  6775299.3 i/s
                 dup:  3320400.7 i/s - 2.04x  slower

```
2018-09-23 08:56:55 +09:00
Andrew Vit
dd0cfb03b2 Let escape_javascript handle conversion to string
This brings `escape_javascript` in line with the behavior of `json_escape` and
allows other value types to be output without needing explicit casting in the
view template.

Example:

    <%= javascript_tag do %>
      var locale = '<%== j I18n.locale %>'; // locale is a symbol
    <% end %>
2018-09-21 12:30:40 -07:00
eileencodes
59a02fb7bc Implement H2 Early Hints for Rails
When puma/puma#1403 is merged Puma will support the Early Hints status
code for sending assets before a request has finished.

While the Early Hints spec is still in draft, this PR prepares Rails to
allowing this status code.

If the proxy server supports Early Hints, it will send H2 pushes to the
client.

This PR adds a method for setting Early Hints Link headers via Rails,
and also automatically sends Early Hints if supported from the
`stylesheet_link_tag` and the `javascript_include_tag`.

Once puma supports Early Hints the `--early-hints` argument can be
passed to the server to enable this or set in the puma config with
`early_hints(true)`. Note that for Early Hints to work
in the browser the requirements are 1) a proxy that can handle H2,
and 2) HTTPS.

To start the server with Early Hints enabled pass `--early-hints` to
`rails s`.

This has been verified to work with h2o, Puma, and Rails with Chrome.

The commit adds a new option to the rails server to enable early hints
for Puma.

Early Hints spec:
https://tools.ietf.org/html/draft-ietf-httpbis-early-hints-04

[Eileen M. Uchitelle, Aaron Patterson]
2017-10-04 09:17:21 -04:00
Kir Shatrov
424117281e Use frozen string literal in actionview/ 2017-07-24 11:53:43 +03:00
Matthew Draper
87b3e226d6 Revert "Merge pull request #29540 from kirs/rubocop-frozen-string"
This reverts commit 3420a14590, reversing
changes made to afb66a5a59.
2017-07-02 02:15:17 +09:30
Matthew Draper
3420a14590 Merge pull request #29540 from kirs/rubocop-frozen-string
Enforce frozen string in Rubocop
2017-07-02 01:11:50 +09:30
Kir Shatrov
cfade1ec7e Enforce frozen string in Rubocop 2017-07-01 02:11:03 +03:00
Pat Allan
3d453b409d Make ActionView frozen string literal friendly.
Plus a couple of related ActionPack patches.
2017-06-20 22:20:04 +10:00
Rafael Mendonça França
fe1f4b2ad5
Add more rubocop rules about whitespaces 2016-10-29 01:17:49 -02:00
Xavier Noria
63fff600ac modernizes hash syntax in actionview 2016-08-06 19:36:34 +02:00
Xavier Noria
4b6c68dfb8 applies new string literal convention in actionview/test
The current code base is not uniform. After some discussion,
we have chosen to go with double quotes by default.
2016-08-06 18:50:17 +02:00
Thiago Pradi
56a7f156af Cleaning JavaScriptHelperTest 2015-03-14 16:37:42 -03:00
Zuhao Wan
0da1c80a99 Avoid hard-coded value in test setup and teardown. 2014-06-14 16:12:44 +08:00
Nathan Stitt
0855f041df Add "extname" option to javascript_include_tag
ActionView::Helpers.asset_path is where the logic for
javascript_include_tag resides.  It takes an extname option for
specifying the extension or false to not append it.  This exposes that
option to javascript_include_tag.

Without the option files that didn't end with ".js" would get the
extension appended to them.  This broke JST templates and other file
types that should be interpreted as JavaScript but who's file extension
isn't ".js"
2013-08-03 09:30:06 -05:00
Piotr Sarnacki
eb23754ebb Move template tests from actionpack to actionview 2013-06-20 17:23:16 +02:00
Renamed from actionpack/test/template/javascript_helper_test.rb (Browse further)