feat(allowlist): add Pug template support - #1114
Conversation
Allow Pug templates, route them to a dedicated review rule, and cover case-insensitive resolution plus fixture exclusion boundaries. Refs alibaba#1113
|
✅ OpenCodeReview: Review complete: 0 finding(s) across 2 selected item(s). |
| {"pug fixture", "test/fixtures/page.pug", true}, | ||
| {"pug template in tests directory", "tests/templates/page.pug", false}, | ||
| {"pug template in test directory", "test/templates/page.pug", false}, |
There was a problem hiding this comment.
What evidence made you think the wanted is false? Is there a exclude patterrn?
There was a problem hiding this comment.
Please update the site documentation, people forget this every time.
| func TestResolveDetail_SystemPugPatternMatch(t *testing.T) { | ||
| setTestHome(t, t.TempDir()) | ||
| resolver, _, err := NewResolver(t.TempDir(), "", ResolverOptions{}) | ||
| if err != nil { | ||
| t.Fatalf("NewResolver: %v", err) | ||
| } | ||
| dr := resolver.(DetailResolver) | ||
|
|
||
| for _, path := range []string{"index.pug", "views/account/profile.pug", "VIEWS/INDEX.PUG"} { | ||
| t.Run(path, func(t *testing.T) { | ||
| detail := dr.ResolveDetail(path) | ||
| if detail.Source != "system" { | ||
| t.Errorf("expected source 'system', got %q", detail.Source) | ||
| } | ||
| if detail.Pattern != "**/*.pug" { | ||
| t.Errorf("expected pattern '**/*.pug', got %q", detail.Pattern) | ||
| } | ||
| for _, required := range []string{ | ||
| "Pug Escaping and Output Contexts", | ||
| "server-side template injection", | ||
| "&attributes", | ||
| "compileClient", | ||
| "Accessibility", | ||
| } { | ||
| if !strings.Contains(detail.Rule, required) { | ||
| t.Errorf("expected Pug rule to contain %q", required) | ||
| } | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
There was a problem hiding this comment.
I doubt if this test is necessary @dvd233 , but OK for improving coverage.
Qiyuanqiii
left a comment
Qiyuanqiii
left a comment
There was a problem hiding this comment.
Requesting changes because the new built-in **/*.pug -> pug.md route is not reflected in the public review-rules documentation. Please update pages/src/content/docs/{en,zh,ja,ko,ru}/review-rules.md in the same matching order so the documented built-in rules stay aligned with runtime behavior, consistent with #1086. The allowlist and resolver changes otherwise look good.
|
@lizhengfeng101 Merge without documentation? |
Pug usage is declining and is primarily found in legacy codebases, so it need not be included in the rules documentation. |
4 participants
Summary
.pugto the case-insensitive supported-extension allowlist;ResolveDetailmetadata and rule-content assertions.Why a dedicated rule
Pug compiles JavaScript-backed, indentation-sensitive templates to HTML. Its safe defaults are context-specific:
#{}/=and ordinary attributes are HTML-escaped, while!{}/!=and general&attributes(object)spreads cross explicit raw-output boundaries. HTML escaping also does not make values safe inside JavaScript, CSS, URLs, or event handlers.The rule therefore aims for high-signal findings while explicitly suppressing common false positives, including ordinary escaped text interpolation and the already-escaped implicit mixin
attributesobject.Validation
make testmake checkmake buildocr rules check views/account.pugocr rules check VIEWS/ACCOUNT.PUGAll commands passed with Go 1.25.5. The runtime checks matched
Source: System built-in,Pattern: **/*.pug, and the dedicated Pug rule for both path casings.Self-review
ocr review --previewinitially exposed the repository's default exclusion of test files and unsupported rule-doc extensions. A temporary, repository-external include rule then confirmed all 5 changed files were selected with 0 exclusions. LLM-backedocr reviewcould not dispatch because this environment has no OCR LLM endpoint configured, so I usedocr delegateto produce the complete 5-file rules/background bundle and performed separate Standards and Spec passes; both produced 0 findings.Closes #1113
Part of #470
AI assistance disclosure
Codex was used to inspect repository conventions, cross-check the rule against Pug's official language/API documentation and security guidance, draft the implementation and tests, run validation, and review the final diff. I verified the final file set, behavior, test logs, commit, and remote branch before submission.