actionview

actionview — go-ruby-actionview

A pure-Go (no cgo) reimplementation of the core of Rails' ActionView — the html-safe output buffer, the tag / url / form / text / number view helpers, and a rendering pipeline — faithful to MRI 4.0.5 / actionview 8.1 output, without any Ruby runtime.

It reproduces ActionView's observable markup byte-for-byte where it matters: tag_options attribute rendering, the form field name/id conventions (user[name] / user_name), currency and human number formatting, link_to and content_tag markup. It is intended as the ActionView backend for a future go-embedded-ruby binding, but is a standalone, reusable module.

It reuses go-ruby-activesupport (the inflector and core-ext string helpers) and go-ruby-erb (HTML / URL escaping), and is a sibling of go-ruby-set and the rest of the go-ruby-* stdlib ecosystem.

MRI-faithful. This mirrors ActionView's observable output, not its Ruby object model. SafeBuffer is the html-safe string; the helpers are Go functions (and Context methods for the request/CSRF-aware ones). Template evaluation (ERB / Ruby) is intentionally not here — it is an injectable seam, so this package stays free of any template engine.

The html-safe buffer

SafeBuffer is the foundation (ActiveSupport::SafeBuffer / ActionView::OutputBuffer): a string known to be HTML-safe, which auto-escapes non-safe fragments on concatenation.

var b actionview.SafeBuffer
b.Concat("<script>")           // untrusted -> escaped:   &lt;script&gt;
b.SafeConcat("<br>")           // trusted markup -> verbatim: <br>
b.AppendSafe(actionview.Raw("<b>")) // another safe buffer -> verbatim
// b.String() == "&lt;script&gt;<br><b>"

Every helper returns a SafeBuffer (or, for the formatters, a plain string), and escapes its inputs unless you pass a SafeBuffer / Raw, exactly like Rails' raw / html_safe.

Helpers

// TagHelper
actionview.ContentTag("div", "hi", actionview.Attrs{{"class", "a"}}) // <div class="a">hi</div>
actionview.Tag("br", nil, nil)                                       // <br>
actionview.ContentTag("div", "c", actionview.Attrs{{"data", map[string]any{"user_id": 5}}})
// <div data-user-id="5">c</div>
actionview.TokenList("a", "a", map[string]any{"b": true})            // a b
actionview.CDATASection("x]]>y")

// UrlHelper
actionview.LinkTo("Home", "/home", nil)                             // <a href="/home">Home</a>
actionview.MailTo("a@b.com", "Email", actionview.Attrs{{"subject", "Hi"}})
ctx := &actionview.Context{}
ctx.ButtonTo("Delete", "/posts/1", "delete", nil)

// FormTagHelper / FormHelper — exact name/id conventions
b := actionview.FormBuilderFor("user", map[string]any{"name": "Dave"})
b.TextField("name", nil)   // <input type="text" value="Dave" name="user[name]" id="user_name" />
b.Label("name", "", nil)   // <label for="user_name">Name</label>
b.CheckBox("admin", "", "", nil)

// TextHelper
actionview.Truncate("Once upon a time", 10, "...", " ", true)       // Once...
actionview.SimpleFormat("Hello\n\nWorld", nil, "", nil)
actionview.Pluralize(2, "person", "")                               // 2 people

// NumberHelper
actionview.NumberToCurrency(1234.5)                                 // $1,234.50
actionview.NumberToHuman(1234567)                                   // 1.23 Million
actionview.NumberToHumanSize(1234567)                               // 1.18 MB
actionview.NumberToPercentage(99.5)                                 // 99.500%

Rendering pipeline & the RenderTemplate seam

Context.Render owns the lookup, partial-name derivation and collection iteration (_counter / _iteration locals); the actual template evaluation is an injectable seam (Context.RenderTemplate), so you can plug in ERB, Ruby, or anything else:

ctx := &actionview.Context{
    RenderTemplate: func(id string, locals map[string]any) (string, error) {
        return myEngine.Render(id, locals) // ERB / go-ruby-erb / rbgo / ...
    },
}
out, _ := ctx.Render(actionview.RenderOptions{
    Partial:    "users/_user",
    Collection: []any{userA, userB},   // each element -> user, user_counter, user_iteration
    Spacer:     "<hr>",
})

Fidelity

Helper output is validated byte-for-byte against the real actionview gem (8.1 on MRI 4.0.5) in oracle_test.go — content_tag, link_to, mail_to, the number formatters, truncate / simple_format / highlight / word_wrap, and the FormBuilder field name/id conventions all match exactly. CI installs the gem and runs the diff on the ubuntu/macOS lanes.

Two documented, deterministic divergences: attributes supplied via a Go map are emitted in sorted-key order (Go maps have no insertion order; MRI preserves it — use the ordered Attrs slice for exact control), and, in the sanitizer, golang.org/x/net/html normalises attribute order to sorted on HTML5 active-formatting elements (a, b, i, em, strong, code, …) while preserving source order everywhere else (div, p, span, img, …) — so a formatting element carrying two or more surviving attributes may reorder them. This never affects which attributes survive, only their order.

HTML sanitization

SanitizeHelper is implemented on top of the stdlib golang.org/x/net/html (pure Go, no cgo), reproducing the observable behaviour of Rails' rails-html-sanitizer / Loofah HTML5 vendor (Rails::HTML5::Sanitizer) — the natural match for x/net/html's HTML5 parser. The security-critical outcomes (XSS vectors neutralised, disallowed tags/attributes stripped, allowed markup preserved) are identical to ActionView's default sanitize helper.

// sanitize: SafeList/PermitScrubber allow-list scrubbing.
actionview.Sanitize(`<script>alert(1)</script>hi`, nil, nil)      // hi
actionview.Sanitize(`<a href="javascript:x">y</a>`, nil, nil)     // <a>y</a>
actionview.Sanitize(`<a href="/x" onclick="e">y</a>`, nil, nil)   // <a href="/x">y</a>
actionview.Sanitize(`<b>b</b> <i>i</i>`, []string{"b"}, nil)      // <b>b</b> i

// strip_tags / strip_links / sanitize_css.
actionview.StripTags(`<b>hi</b> <a href="/x">y</a>`)              // hi y
actionview.StripLinks(`<a href="/x">click</a> here`)              // click here
actionview.SanitizeCSS(`color: red; background: url(javascript:1)`) // color:red;

// The scrubber classes and configurable defaults.
s := actionview.NewSafeListSanitizer()   // + NewFullSanitizer / NewLinkSanitizer
s.Sanitize(html, tags, attributes)       // WhiteListSanitizer is the alias
actionview.SanitizedAllowedTags          // = DefaultAllowedTags (mutable policy)
actionview.SanitizedAllowedAttributes    // = DefaultAllowedAttributes

The sanitizer neutralises javascript: URIs (including entity-obfuscated colons), drops event handlers, demotes <script>/<style> bodies to inert text, removes comments, prunes foreign (svg/math) subtrees, and enforces the Rails default tag/attribute/protocol/CSS allow-lists. SanitizeSanitizer adapts it to the Sanitizer seam so SimpleFormat / Highlight can run with sanitize: true. Behaviour is validated byte-for-byte against both rails-html-sanitizer's HTML5 sanitizer and ActionView's SanitizeHelper (sanitize / strip_tags / strip_links / sanitize_css) in sanitizer_oracle_test.go.

Roadmap (deferred from v0.1)

This is the foundation. Deliberately deferred, in rough priority order:

• Template resolver / LookupContext — formats, variants, locales, digests, the real partial/template file lookup (only the RenderTemplate seam exists now).
• Layouts and content_for / yield / provide.
• Fragment / Russian-doll caching.
• AssetTagHelper (image/stylesheet/javascript tags, the asset pipeline).
• FormOptionsHelper beyond the basics (grouped/collection selects, time zones).
• DateHelper (distance_of_time_in_words, date/time selects).
• TranslationHelper / i18n (t / l, locale-driven number & date formats).
• Streaming (render stream:) and CSP nonce helpers.
• Branding (family banner / logo / favicon) push.

Tests & coverage

$ GOWORK=off CGO_ENABLED=0 go test -race \
    -coverpkg=$(go list ./... | paste -sd, -) -coverprofile=cover.out ./...
$ go tool cover -func=cover.out | tail -1
total:   (statements)   100.0%

100% line coverage is enforced in CI, across the six supported 64-bit targets (amd64, arm64, riscv64, loong64, ppc64le, s390x — including big-endian). The MRI oracle tests skip themselves where ruby or the gem is unavailable, so the deterministic suite alone holds the gate.

License

BSD-3-Clause — see LICENSE. Copyright (c) 2026, the go-ruby-actionview/actionview authors.

WebAssembly

Being pure Go (CGO=0), this library also compiles to WebAssembly — both GOOS=js GOARCH=wasm (browser / Node.js) and GOOS=wasip1 GOARCH=wasm (WASI). CI builds both targets on every push, alongside the six 64-bit native/qemu arches.

GOOS=js     GOARCH=wasm go build ./...   # browser / Node
GOOS=wasip1 GOARCH=wasm go build ./...   # WASI (wasmtime, wasmer, wasmedge, …)