Class: XssShieldERB::Compiler

Inherits:
ERB::Compiler
  • Object
show all
Defined in:
lib/xss_shield/erb_hacks.rb

Instance Method Summary collapse

Instance Method Details

#compile(s) ⇒ Object 



5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
 
# File 'lib/xss_shield/erb_hacks.rb', line 5

def compile(s)
  out = Buffer.new(self)

  content = ''
  scanner = make_scanner(s)
  scanner.scan do |token|
    if scanner.stag.nil?
      case token
      when PercentLine
        out.push("#{@put_cmd} #{content.dump}") if content.size > 0
        content = ''
        out.push(token.to_s)
        out.cr
      when :cr
        out.cr
      when '<%', '<%=', '<%#'
        scanner.stag = token
        out.push("#{@put_cmd} #{content.dump}") if content.size > 0
        content = ''
      when "\n"
        content << "\n"
        out.push("#{@put_cmd} #{content.dump}")
        out.cr
        content = ''
      when '<%%'
        content << '<%'
      else
        content << token
      end
    else
      case token
      when '%>'
        case scanner.stag
        when '<%'
          if content[-1] == ?\n
            content.chop!
            out.push(content)
            out.cr
          else
            out.push(content)
          end
        when '<%='
          # NOTE: Changed lines

          # Don't escape yield statements (they should already be safe)
          if content =~ /^[ \t]*yield[ |\(]/
            to_string = 'to_s'
          else
            to_string = 'to_xss_safe'
          end
          out.push("#{@insert_cmd}((#{content}).#{to_string})")

          # NOTE: End changed lines
        when '<%#'
          # out.push("# #{content.dump}")
        end
        scanner.stag = nil
        content = ''
      when '%%>'
        content << '%>'
      else
        content << token
      end
    end
  end
  out.push("#{@put_cmd} #{content.dump}") if content.size > 0
  out.close
  out.script
end