Don't compile external templates

jherdman · jherdman · commit 05ead3217c74 · 2026-04-01T07:00:21.000-04:00
User's should not be beholden to template errors outside of their
application. When we detect a template not local to the project we use
the fallback ERB implementation.
diff --git a/Gemfile b/Gemfile
@@ -9,6 +9,7 @@ gem "appraisal"
 gem "actionview", "~> 8.1"
 gem "maxitest", "~> 7.0"
 gem "minitest-difftastic"
+gem "mocha", "~> 3.1.0"
 gem "railties", "~> 8.1"
 gem "rake", "~> 13.0"
 gem "readline", "~> 0.0.4"
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -94,6 +94,8 @@ GEM
       prism (~> 1.5)
     minitest-difftastic (0.2.1)
       difftastic (~> 0.6)
+    mocha (3.1.0)
+      ruby2_keywords (>= 0.0.5)
     nokogiri (1.19.1-aarch64-linux-gnu)
       racc (~> 1.4)
     nokogiri (1.19.1-aarch64-linux-musl)
@@ -174,6 +176,7 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
+    ruby2_keywords (0.0.5)
     securerandom (0.4.1)
     stringio (3.2.0)
     thor (1.5.0)
@@ -203,6 +206,7 @@ DEPENDENCIES
   appraisal
   maxitest (~> 7.0)
   minitest-difftastic
+  mocha (~> 3.1.0)
   railties (~> 8.1)
   rake (~> 13.0)
   reactionview!
diff --git a/gemfiles/rails_7_0.gemfile b/gemfiles/rails_7_0.gemfile
@@ -2,10 +2,11 @@
 
 source "https://rubygems.org"
 
-gem "actionview", "~> 7.0.0"
 gem "appraisal"
+gem "actionview", "~> 7.0.0"
 gem "maxitest", "~> 7.0"
 gem "minitest-difftastic"
+gem "mocha", "~> 3.1.0"
 gem "railties", "~> 7.0.0"
 gem "rake", "~> 13.0"
 gem "readline", "~> 0.0.4"
diff --git a/gemfiles/rails_7_0.gemfile.lock b/gemfiles/rails_7_0.gemfile.lock
@@ -85,6 +85,8 @@ GEM
       prism (~> 1.5)
     minitest-difftastic (0.2.1)
       difftastic (~> 0.6)
+    mocha (3.1.0)
+      ruby2_keywords (>= 0.0.5)
     mutex_m (0.3.0)
     nokogiri (1.19.1-aarch64-linux-gnu)
       racc (~> 1.4)
@@ -149,6 +151,7 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
+    ruby2_keywords (0.0.5)
     securerandom (0.4.1)
     thor (1.5.0)
     tsort (0.2.0)
@@ -175,6 +178,7 @@ DEPENDENCIES
   appraisal
   maxitest (~> 7.0)
   minitest-difftastic
+  mocha (~> 3.1.0)
   railties (~> 7.0.0)
   rake (~> 13.0)
   reactionview!
diff --git a/gemfiles/rails_7_1.gemfile b/gemfiles/rails_7_1.gemfile
@@ -2,10 +2,11 @@
 
 source "https://rubygems.org"
 
-gem "actionview", "~> 7.1.0"
 gem "appraisal"
+gem "actionview", "~> 7.1.0"
 gem "maxitest", "~> 7.0"
 gem "minitest-difftastic"
+gem "mocha", "~> 3.1.0"
 gem "railties", "~> 7.1.0"
 gem "rake", "~> 13.0"
 gem "readline", "~> 0.0.4"
diff --git a/gemfiles/rails_7_1.gemfile.lock b/gemfiles/rails_7_1.gemfile.lock
@@ -98,6 +98,8 @@ GEM
       prism (~> 1.5)
     minitest-difftastic (0.2.1)
       difftastic (~> 0.6)
+    mocha (3.1.0)
+      ruby2_keywords (>= 0.0.5)
     mutex_m (0.3.0)
     nokogiri (1.19.1-aarch64-linux-gnu)
       racc (~> 1.4)
@@ -180,6 +182,7 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
+    ruby2_keywords (0.0.5)
     securerandom (0.4.1)
     stringio (3.2.0)
     thor (1.5.0)
@@ -207,6 +210,7 @@ DEPENDENCIES
   appraisal
   maxitest (~> 7.0)
   minitest-difftastic
+  mocha (~> 3.1.0)
   railties (~> 7.1.0)
   rake (~> 13.0)
   reactionview!
diff --git a/gemfiles/rails_7_2.gemfile b/gemfiles/rails_7_2.gemfile
@@ -2,10 +2,11 @@
 
 source "https://rubygems.org"
 
-gem "actionview", "~> 7.2.0"
 gem "appraisal"
+gem "actionview", "~> 7.2.0"
 gem "maxitest", "~> 7.0"
 gem "minitest-difftastic"
+gem "mocha", "~> 3.1.0"
 gem "railties", "~> 7.2.0"
 gem "rake", "~> 13.0"
 gem "readline", "~> 0.0.4"
diff --git a/gemfiles/rails_7_2.gemfile.lock b/gemfiles/rails_7_2.gemfile.lock
@@ -98,6 +98,8 @@ GEM
       prism (~> 1.5)
     minitest-difftastic (0.2.1)
       difftastic (~> 0.6)
+    mocha (3.1.0)
+      ruby2_keywords (>= 0.0.5)
     nokogiri (1.19.1-aarch64-linux-gnu)
       racc (~> 1.4)
     nokogiri (1.19.1-aarch64-linux-musl)
@@ -179,6 +181,7 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
+    ruby2_keywords (0.0.5)
     securerandom (0.4.1)
     stringio (3.2.0)
     thor (1.5.0)
@@ -207,6 +210,7 @@ DEPENDENCIES
   appraisal
   maxitest (~> 7.0)
   minitest-difftastic
+  mocha (~> 3.1.0)
   railties (~> 7.2.0)
   rake (~> 13.0)
   reactionview!
diff --git a/gemfiles/rails_8_0.gemfile b/gemfiles/rails_8_0.gemfile
@@ -2,10 +2,11 @@
 
 source "https://rubygems.org"
 
-gem "actionview", "~> 8.0.0"
 gem "appraisal"
+gem "actionview", "~> 8.0.0"
 gem "maxitest", "~> 7.0"
 gem "minitest-difftastic"
+gem "mocha", "~> 3.1.0"
 gem "railties", "~> 8.0.0"
 gem "rake", "~> 13.0"
 gem "readline", "~> 0.0.4"
diff --git a/gemfiles/rails_8_0.gemfile.lock b/gemfiles/rails_8_0.gemfile.lock
@@ -95,6 +95,8 @@ GEM
       prism (~> 1.5)
     minitest-difftastic (0.2.1)
       difftastic (~> 0.6)
+    mocha (3.1.0)
+      ruby2_keywords (>= 0.0.5)
     nokogiri (1.19.1-aarch64-linux-gnu)
       racc (~> 1.4)
     nokogiri (1.19.1-aarch64-linux-musl)
@@ -175,6 +177,7 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
+    ruby2_keywords (0.0.5)
     securerandom (0.4.1)
     stringio (3.2.0)
     thor (1.5.0)
@@ -204,6 +207,7 @@ DEPENDENCIES
   appraisal
   maxitest (~> 7.0)
   minitest-difftastic
+  mocha (~> 3.1.0)
   railties (~> 8.0.0)
   rake (~> 13.0)
   reactionview!
diff --git a/gemfiles/rails_8_1.gemfile b/gemfiles/rails_8_1.gemfile
@@ -2,10 +2,11 @@
 
 source "https://rubygems.org"
 
-gem "actionview", "~> 8.1.0"
 gem "appraisal"
+gem "actionview", "~> 8.1.0"
 gem "maxitest", "~> 7.0"
 gem "minitest-difftastic"
+gem "mocha", "~> 3.1.0"
 gem "railties", "~> 8.1.0"
 gem "rake", "~> 13.0"
 gem "readline", "~> 0.0.4"
diff --git a/gemfiles/rails_8_1.gemfile.lock b/gemfiles/rails_8_1.gemfile.lock
@@ -94,6 +94,8 @@ GEM
       prism (~> 1.5)
     minitest-difftastic (0.2.1)
       difftastic (~> 0.6)
+    mocha (3.1.0)
+      ruby2_keywords (>= 0.0.5)
     nokogiri (1.19.1-aarch64-linux-gnu)
       racc (~> 1.4)
     nokogiri (1.19.1-aarch64-linux-musl)
@@ -174,6 +176,7 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
+    ruby2_keywords (0.0.5)
     securerandom (0.4.1)
     stringio (3.2.0)
     thor (1.5.0)
@@ -203,6 +206,7 @@ DEPENDENCIES
   appraisal
   maxitest (~> 7.0)
   minitest-difftastic
+  mocha (~> 3.1.0)
   railties (~> 8.1.0)
   rake (~> 13.0)
   reactionview!
diff --git a/gemfiles/rails_8_2.gemfile b/gemfiles/rails_8_2.gemfile
@@ -2,10 +2,11 @@
 
 source "https://rubygems.org"
 
-gem "actionview", github: "rails/rails"
 gem "appraisal"
+gem "actionview", github: "rails/rails"
 gem "maxitest", "~> 7.0"
 gem "minitest-difftastic"
+gem "mocha", "~> 3.1.0"
 gem "railties", github: "rails/rails"
 gem "rake", "~> 13.0"
 gem "readline", "~> 0.0.4"
diff --git a/gemfiles/rails_8_2.gemfile.lock b/gemfiles/rails_8_2.gemfile.lock
@@ -109,6 +109,8 @@ GEM
       prism (~> 1.5)
     minitest-difftastic (0.2.1)
       difftastic (~> 0.6)
+    mocha (3.1.0)
+      ruby2_keywords (>= 0.0.5)
     nokogiri (1.19.1-aarch64-linux-gnu)
       racc (~> 1.4)
     nokogiri (1.19.1-aarch64-linux-musl)
@@ -180,6 +182,7 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
+    ruby2_keywords (0.0.5)
     securerandom (0.4.1)
     stringio (3.2.0)
     thor (1.5.0)
@@ -209,6 +212,7 @@ DEPENDENCIES
   appraisal
   maxitest (~> 7.0)
   minitest-difftastic
+  mocha (~> 3.1.0)
   railties!
   rake (~> 13.0)
   reactionview!
diff --git a/lib/reactionview/template/handlers/erb.rb b/lib/reactionview/template/handlers/erb.rb
@@ -7,12 +7,24 @@ class ERB < ActionView::Template::Handlers::ERB
         autoload :Herb, "reactionview/template/handlers/herb/herb"
 
         def call(template, source)
-          if template.format == :html && ReActionView.config.intercept_erb
+          if intercept_template?(template)
             ::ReActionView::Template::Handlers::Herb.call(template, source)
           else
             super
           end
         end
+
+        private
+
+        def intercept_template?(template)
+          template.format == :html && ReActionView.config.intercept_erb && local_template?(template)
+        end
+
+        def local_template?(template)
+          return true unless template.respond_to?(:identifier) && template.identifier
+
+          template.identifier.start_with?(Rails.root.to_s)
+        end
       end
     end
   end
diff --git a/test/template/handlers/herb_test.rb b/test/template/handlers/herb_test.rb
@@ -365,4 +365,25 @@ def @view_context.ui_badge(count, **_options)
 
     assert_compiled_snapshot(template)
   end
+
+  test "does not process templates that are not local" do
+    ReActionView.config.intercept_erb = true
+    Rails.stubs(:root).returns("/local/template")
+
+    template = %(<p><h2>I am invalid</h2></p>)
+    template_obj = ActionView::Template.new(
+      template,
+      "test_template",
+      ReActionView::Template::Handlers::ERB,
+      virtual_path: "test",
+      format: :html,
+      locals: []
+    )
+
+    compiled_source = template_obj.handler.call(template_obj, template)
+    result = @view_context.instance_eval(compiled_source).to_s
+
+    normalized_result = result.gsub(/>\s+</, "><").gsub(/\s+/, " ").strip
+    assert_equal "<p><h2>I am invalid</h2></p>", normalized_result
+  end
 end
diff --git a/test/test_helper.rb b/test/test_helper.rb
@@ -10,6 +10,7 @@
 
 require "maxitest/autorun"
 require "minitest/spec"
+require "mocha/minitest"
 
 require_relative "snapshot_utils"
 
