class Brakeman::HamlTemplateProcessor
Processes HAML templates.
Constants
- ATTRIBUTE_BUILDER
- COFFEE_FILTER
- ESCAPE_METHODS
- HAMLOUT
- HAML_BUFFER
- HAML_HELPERS
- HAML_HELPERS2
- JAVASCRIPT_FILTER
- PRESERVE_METHODS
Public Class Methods
new(*args)
click to toggle source
Calls superclass method
Brakeman::TemplateProcessor::new
# File lib/brakeman/processors/haml_template_processor.rb, line 13 def initialize *args super @javascript = false end
Public Instance Methods
buffer_append?(exp)
click to toggle source
_haml_out.buffer << …
# File lib/brakeman/processors/haml_template_processor.rb, line 31 def buffer_append? exp call? exp and exp.target == HAML_BUFFER and exp.method == :<< end
build_output_from_push_text(exp, default = :output)
click to toggle source
HAML likes to put interpolated values into _hamlout.push_text but we want to handle those individually
# File lib/brakeman/processors/haml_template_processor.rb, line 64 def build_output_from_push_text exp, default = :output if string_interp? exp exp.map! do |e| if sexp? e if node_type? e, :evstr and e[1] e = e.value end get_pushed_value e, default else e end end end end
find_and_preserve?(exp)
click to toggle source
# File lib/brakeman/processors/haml_template_processor.rb, line 39 def find_and_preserve? exp call? exp and PRESERVE_METHODS.include?(exp.method) and exp.first_arg end
fix_textareas?(exp)
click to toggle source
# File lib/brakeman/processors/haml_template_processor.rb, line 166 def fix_textareas? exp call? exp and exp.target == HAMLOUT and exp.method == :fix_textareas! end
get_pushed_value(exp, default = :output)
click to toggle source
# File lib/brakeman/processors/haml_template_processor.rb, line 87 def get_pushed_value exp, default = :output return exp unless sexp? exp case exp.node_type when :format exp.node_type = :output @current_template.add_output exp exp when :format_escaped exp.node_type = :escaped_output @current_template.add_output exp exp when :str, :ignore, :output, :escaped_output exp when :block, :rlist exp.map! { |e| get_pushed_value(e, default) } when :dstr build_output_from_push_text(exp, default) when :if clauses = [get_pushed_value(exp.then_clause, default), get_pushed_value(exp.else_clause, default)].compact if clauses.length > 1 s(:or, *clauses).line(exp.line) else clauses.first end when :call if exp.method == :to_s or exp.method == :strip get_pushed_value(exp.target, default) elsif haml_helpers? exp.target and ESCAPE_METHODS.include? exp.method get_pushed_value(exp.first_arg, :escaped_output) elsif @javascript and (exp.method == :j or exp.method == :escape_javascript) # TODO: Remove - this is not safe get_pushed_value(exp.first_arg, :escaped_output) elsif find_and_preserve? exp or fix_textareas? exp get_pushed_value(exp.first_arg, default) elsif raw? exp get_pushed_value(exp.first_arg, :output) elsif hamlout_attributes? exp ignore # ignore _hamlout.attributes calls elsif exp.target.nil? and exp.method == :render #Process call to render() exp.arglist = process exp.arglist make_render_in_view exp elsif exp.method == :render_with_options if exp.target == JAVASCRIPT_FILTER or exp.target == COFFEE_FILTER @javascript = true end get_pushed_value(exp.first_arg, default) @javascript = false elsif haml_attribute_builder? exp ignore # probably safe... seems escaped by default? else add_output exp, default end else add_output exp, default end end
haml_attribute_builder?(exp)
click to toggle source
# File lib/brakeman/processors/haml_template_processor.rb, line 160 def haml_attribute_builder? exp call? exp and exp.target == ATTRIBUTE_BUILDER and exp.method == :build end
haml_helpers?(exp)
click to toggle source
# File lib/brakeman/processors/haml_template_processor.rb, line 147 def haml_helpers? exp # Sometimes its Haml::Helpers and # sometimes its ::Haml::Helpers exp == HAML_HELPERS or exp == HAML_HELPERS2 end
hamlout_attributes?(exp)
click to toggle source
# File lib/brakeman/processors/haml_template_processor.rb, line 154 def hamlout_attributes? exp call? exp and exp.target == HAMLOUT and exp.method == :attributes end
process_block(exp)
click to toggle source
If inside an output stream, only return the final expression
# File lib/brakeman/processors/haml_template_processor.rb, line 46 def process_block exp exp = exp.dup exp.shift exp.map! do |e| res = process e if res.empty? nil else res end end Sexp.new(:rlist).concat(exp).compact end
process_call(exp)
click to toggle source
Processes call, looking for template output
# File lib/brakeman/processors/haml_template_processor.rb, line 19 def process_call exp exp = process_default exp if buffer_append? exp output = normalize_output(exp.first_arg) res = get_pushed_value(output) end res or exp end
raw?(exp)
click to toggle source
# File lib/brakeman/processors/haml_template_processor.rb, line 172 def raw? exp call? exp and exp.method == :raw end