We are using this setting to require space before code blocks
Layout/SpaceBeforeBlockBraces:
EnforcedStyle: space
However, in RSpec examples, we do not use the space after expect and change methods when they use blocks for readability:
expect{ calling_the_method }.to change{ Model.all.size }.by(1)
Rubocop complains about the code above.
Is it possible to tell it to ignore blocks after specific methods or ignore lines matching regex?
I have tried:
Layout/SpaceBeforeBlockBraces:
EnforcedStyle: space
IgnoredPatterns: ['\A\s*((?:expect)|(.*change))']
Is it possible to tell it [the SpaceBeforeBlockBraces cop] to ignore blocks after specific methods or ignore lines matching regex?
No. As of 2018-08-12, I don't think that SpaceBeforeBlockBraces supports the IgnoredPattern option, but it might be an easy PR. The IgnoredPattern option is a mixin (rubocop/cop/mixin/ignored_pattern.rb) so you could just include it into whatever cop you want. Rubocop has strict rules for contributions, so if you do a PR, make sure to read all instructions thoroughly.
The SpaceBeforeBlockBraces cop should support the Exclude option, if you want to exclude your test directory. I think all cops support Include and Exclude.
Related
According to many recent HTML specs, when we are using custom attributes (meaning any attributes not defined in the spec), we should prefix them with data-. However, I see no reason to have to do this (unless you require perfectly valid HTML, obviously). Pretty much all current browsers correctly ignore custom attributes, meaning no conflicts except with identically-named attributes from others' code, and we can ignore even this with custom prefixes or something similar (as suggested on the AngularJS directive page). What, if any, other benefits are there? This question has been asked before, at least twice, but both are pretty old.
I forget where I read it, but some guide said custom HTML tags need dashes, and single-word tags aren't valid. First of all, why? Second, should we do this, and why (besides being valid)? Would there be any problem with underscores or camelCase, etc.? Also, conflicts with existing elements shouldn't be a problem, if, like with data attributes, you prefix or suffix them, etc. See the Angular directive page again.
I'm sure all these questions have been asked before, but I'm combining them into one. Is that a good idea (quick, someone ask on Meta)?
The data-* attributes have two advantages:
It is a convention meaning other programmers will understand quickly that it is a custom attribute.
You get a DOM Javascript API for free: HTMLElement.dataset. If you use jQuery, it leverages this to populates the keys and values you find with .data().
The reason for the - in custom element names is for two basic reasons:
It is a quick way for the HTML parser to know it is a custom element instead of a standard element.
You don't run into the issue of a new standard element being added with the same name which would cause conflict if you register a custom Javascript prototype for the DOM element.
Should you use your own custom element name? Right now it is so new that don't expect it to be fully supported. Let's say it does work. You have to balance the issue of the extra complexity with the benefit. If you can get away with a classname, then use a classname. But if you need a whole new element with a custom Javascript DOM prototype for the element, then you may have a valid usage of it.
Is there an online CSS optimizer equivalent to Googles JavaScript Closure Optimizer.
I've found plenty of CSS compressors online, but I'm looking for a CSS optimizer ... where it actually removes redundant/conflicting attributes
Online tools based on csstidy: www.codebeautifier.com or www.cleancss.com.
And perhaps CSS Redundancy Checker might be useful for you. It's a Ruby script that will take CSS rules, and a set of HTML files, and will tell you what you aren’t actually using.
Personally, I wouldn't trust any CSS optimizer such as you describe. Any time I have ever tried one, and I've tried a few and even tried to write one, it has resulted in CSS problems on pages I've created.
For one to actually remove conflicting selectors, it would really have to understand how you would like such conflicts resolved — which ones are "right" and which are "wrong" — and that is something you have to eyeball to decide. Even removing "redundant" selectors is fraught with peril, unless you have repeated selectors verbatim. And any CSS hacks you have employed (not good practice, but sometimes unavoidable) can be destroyed.
I'm not saying this kind of thing is impossible, just that it's VERY hard to do and you should absolutely expect to regression-test all your pages after using one.
You could make such a service by using the relevant parts of an open source rendering engine such as WebKit or Gecko.
Infact....
CSSTIDY
never used it myself though
it is open sourced and provides you the ability to use it with php, it also uses no regular expresions so is compatible with css2
Check out Dust-me it's a firefox extension that will at least remove unused selectors. I suspect it might be a combination of these that'll get the job done.
https://csscompressor.net gives an audit of the changes it has made.
Be careful when using some hacks eg for IE6, as they may cause a failure
I have a few hand-crafted web pages. When deploying them I would like to run them through a tool so that new smaller HTML files are created, with extraneous whitespace taken out, etc.
We already use YUICompressor for our Javascript and our CSS, and we tend to follow all of the techniques described by the Yahoo performance team.
Is there a good, free tool that does this? I prefer tools that would fit into our deployment process similarly to YUICompressor.
HTML Tidy does the job.
I use the following on one document that I generate (a rather large one). This saved me about 10% on the post-gzip size.
tidy -c -omit -ashtml -utf8 --doctype strict \
--drop-proprietary-attributes yes --output-bom no \
--wrap 0 source.html > target.html
-c — Replace surplus presentational tags and attributes
-omit — Drop optional end tags
-ashtml — use HTML rather than XHTML (HTML is leaner and XHTML provides no benefits for most use cases)
-utf8 — So we don't have to use entities for characters outside the character set (entities are more bytes)
--doctype strict — use Strict (again, leaner)
--drop-proprietary-attributes yes — get rid of proprietary junk
--output-bom no — BOMs cause issues in some clients
--wrap 0 — Have very long lines
Plain old minify will also attack your HTML for you, if you want.
But HTML minification isn't, generally, hugely effective:
Taking runs of whitespace down to one won't do that much. If you're already using gzip/deflate, that'll be compressing the whitespace quite efficiently. You can't remove all whitespace as single whitespaces can often have an effect on rendering that it is desirable to keep.
Taking comments out may have an effect, depending on how much comment content you actually have. But you'd have to be careful not to hit conditional comments.
Apart from that, there is not much in an HTML document that can be ‘minified’. Obviously the JS idea of packing variable names down to the shortest possible string is inapplicable.
Doing all this with regex, as most minifiers do, is a bit dodgy. You have to stick to a limited ‘normal’ range of markup that won't trip it up.
With HTML minification you're typically getting less gain (and less post-gzip gain) than JS/CSS minification, and for dynamically-generated pages you have more overhead (as you can't pre-minify them like with static scripts/styles). Some templating languages may already have built-in features for trimming whitespace at generation time; if available in your environment, use that.
I was wondering, and was as of yet, unable to find any answers online, how to accomplish the following.
Let's say I have a string that contains the following:
my_string = "Hello, I am a string."
(in the preview window I see that this is actually formatting in BOLD and ITALIC instead of showing the "strong" and "i" tags)
Now, I would like to make this secure, using the html_escape() (or h()) method/function.
So I'd like to prevent users from inserting any javascript and/or stylesheets, however, I do still want to have the word "Hello" shown in bold, and the word "string" shown in italic.
As far as I can see, the h() method does not take any additional arguments, other than the piece of text itself.
Is there a way to escape only certain html tags, instead of all? Like either White or Black listing tags?
Example of what this might look like, of what I'm trying to say would be:
h(my_string, :except => [:strong, :i]) # => so basically, escape everything, but leave "strong" and "i" tags alone, do not escape these.
Is there any method or way I could accomplish this?
Thanks in advance!
Excluding specific tags is actually pretty hard problem. Especially the script tag can be inserted in very many different ways - detecting them all is very tricky.
If at all possible, don't implement this yourself.
Use the white list plugin or a modified version of it . It's superp!
You can have a look Sanitize as well(Seems better, never tried it though).
Have you considered using RedCloth or BlueCloth instead of actually allowing HTML? These methods provide quite a bit of formatting options and manage parsing for you.
Edit 1: I found this message when browsing around for how to remove HTML using RedCloth, might be of some use. Also, this page shows you how version 2.0.5 allows you to remove HTML. Can't seem to find any newer information, but a forum post found a vulnerability. Hopefully it has been fixed since that was from 2006, but I can't seem to find a RedCloth manual or documentation...
I would second Sanitize for removing HTML tags. It works really well. It removes everything by default and you can specify a whitelist for tags you want to allow.
Preventing XSS attacks is serious business, follow hrnt's and consider that there is probably an order of magnitude more exploits than that possible due to obscure browser quirks. Although html_escape will lock things down pretty tightly, I think it's a mistake to use anything homegrown for this type of thing. You simply need more eyeballs and peer review for any kind of robustness guarantee.
I'm the in the process of evaluating sanitize vs XssTerminate at the moment. I prefer the xss_terminate approach for it's robustness—scrubbing at the model level will be quite reliable in a regular Rails app where all user input goes through ActiveRecord, but Nokogiri and specifically Loofah seem to be a little more peformant, more actively maintained, and definitely more flexible and Ruby-ish.
Update I've just implemented a fork of ActsAsTextiled called ActsAsSanitiled that uses Santize (which has recently been updated to use nokogiri by the way) to guarantee safety and well-formedness of the RedCloth output, all without needing any helpers in your templates.
I have been using prototype.js in a web application. I am populating some Divs dynamically, on selecting some radio buttons. Before populating contents in Div, I am clearing previous contents by using prototype's update method as -
$('item').update('');
In IE, this puts a line break automatically but not in Firefox 3.5. So, to work it in same manner as IE, I have change the code as -
$('item').update(' ');
Now, this worked for me as expected. But, generally " " is being used with a semicolon ($nbsp;). I want to know, if there can be a failure of this code.
For example, is there any chances where   will be display instead of a blank space? But some browsers might be smart enough to detect the coding error by the programmer and autocorrect it.
The ending semicolon can be omited but it’s absolutely not recommended. See this note in the HTML 4 specification regarding character references:
In SGML, it is possible to eliminate the final ";" after a character reference in some cases (e.g., at a line break or immediately before a tag). In other circumstances it may not be eliminated (e.g., in the middle of a word). We strongly suggest using the ";" in all cases to avoid problems with user agents that require this character to be present.
NEVER rely on browser autocorrection or "recommended" behavior.
If your code is wrong, then (a) it's wrong and (b) browsers are free to do inconsistent things with it.
I concur, Dodgy markup and JavaScript errors are a disaster for debugging any problems you have in future as you can't eliminate the dodgy markup is causing the browser to interpret code incorrectly.
not sure if this will help (or change anything) but the correct syntax is actually without the single quotes:
$('element').update();