curlybars 1.16.1.pre.2 → 1.16.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a8897a8516ee71758de87ec45acd0dcf0f177ef5e69470dcbc4e81004f57fb26
-  data.tar.gz: 5948e415e943ff80c52fa5a756259bdda63b8943c10b77eda9bae650e384fe14
+  metadata.gz: 746a0625058bd9a2bca9ebf655c36f7cbd7e11e43000a051f4a76516ce73150b
+  data.tar.gz: f631902fba5a77cce57a36472636b99a5c03450dfbe5943e058c92b7c09e1d07
 SHA512:
-  metadata.gz: 41f73fbddd332bb54078bd45f74dd9eb93192d8707d943d9f72af8ca29da186ad85935bd5b113ddbe74b1f3084a15431c5a13b1145b57cfd1c2b3215624733b2
-  data.tar.gz: 3cee5f68d7ad53d3b948395e381f83465da70d7ec74a1cdc7bba37f8598ad212264698e8e675aff6925fb573710ab90cae58fb6e5d608570814c80c61b673fff
+  metadata.gz: c0fb5fb5398bf4643f679fdb07403de92892ee84efb70bae6a689297251e1ff9e79311b1c7711a6ba6a247a84eac945d735f72deacd8a555c9cd8ebfd75e9d81
+  data.tar.gz: ac273a2a866a2634c6d17ebf4a4bfd32b656c765e896214e2f3d6d2d49069232503e96bdc04a23b698d8f569cf5d368f5ab736699e280e404b9765bb370b4132

data/exe/curlybars-indent-lint

@@ -178,4 +178,6 @@ def main
   end
 end
 
+# simplecov:disable
 main if __FILE__ == $PROGRAM_NAME
+# simplecov:enable

data/lib/curlybars/configuration.rb

@@ -13,6 +13,7 @@ module Curlybars
 
   def self.reset
     @configuration = Configuration.new
+    @global_helpers_dependency_tree = nil
   end
 
   class Configuration

data/lib/curlybars/method_whitelist.rb

@@ -47,8 +47,8 @@ module Curlybars
 
         contextual_block&.call(context, schema_adder)
 
-        schema = all_methods_without_type.each_with_object({}) do |method, memo|
-          memo[method] = nil
+        schema = all_methods_without_type.to_h do |method|
+          [method, nil]
         end
 
         methods_with_type_resolved = all_methods_with_type.transform_values do |type|
@@ -104,12 +104,19 @@ module Curlybars
       define_method(:as_json) do |*args|
         return @__as_json if defined?(@__as_json)
 
-        @__as_json ||= allowed_methods.each_with_object({}) do |method, hash|
+        guard = args.first.is_a?(Hash) ? args.first[:curlybars_guard] : nil
+        guard&.enter!
+
+        @__as_json = allowed_methods.each_with_object({}) do |method, hash|
           unless self.method(method).arity > 0
             value = send(method)
-            hash[method] = value.equal?(self) ? "[circular reference]" : value.as_json
+            serialized = value.equal?(self) ? "[circular reference]" : value.as_json(*args)
+            guard&.measure(serialized)
+            hash[method] = serialized
           end
         end
+      ensure
+        guard&.leave!
       end
     end
 

data/lib/curlybars/node/each_else.rb

@@ -12,6 +12,7 @@ module Curlybars
             template_cache_key = '#{each_template.cache_key}'
 
             collection = rendering.coerce_to_hash!(collection, #{collection_path.path.inspect}, position)
+            rendering.check_nesting_not_too_deep(position)
             collection.each.with_index.map do |key_and_presenter, index|
               rendering.check_timeout!
               rendering.optional_presenter_cache(key_and_presenter[1], template_cache_key, buffer) do |buffer|

data/lib/curlybars/node/path.rb

@@ -168,11 +168,6 @@ module Curlybars
 
           message = "`#{path}` cannot resolve to a helper"
           raise Curlybars::Error::Validate.new('not_a_helper', message, position)
-        when :not_helper
-          return unless helper?(branches)
-
-          message = "`#{path}` resolves to a helper"
-          raise Curlybars::Error::Validate.new('is_a_helper', message, position)
         when :anything
         else
           raise "invalid type `#{check_type}`"

data/lib/curlybars/node/sub_expression.rb

@@ -63,22 +63,19 @@ module Curlybars
 
         type = node.resolve_and_check!(branches, check_type: check_type)
 
-        if helper?(type)
-          if generic_helper?(type)
-            is_collection = type.last.is_a?(Array)
-            return infer_generic_helper_type!(branches, is_collection: is_collection)
-          end
-
-          return type.last
+        if generic_helper?(type)
+          is_collection = type.last.is_a?(Array)
+          infer_generic_helper_type!(branches, is_collection: is_collection)
+        elsif helper?(type)
+          type.last
+        else
+          type
         end
-
-        type
       end
 
       def generic_helper?(type)
-        return false unless type.is_a?(Array)
+        return false unless helper?(type)
         return false unless type.size == 2
-        return false unless type.first == :helper
 
         type.last == [{}] || type.last == {}
       end

data/lib/curlybars/node/template.rb

@@ -9,11 +9,6 @@ module Curlybars
         <<-RUBY
           ::Module.new do
             def self.exec(contexts, rendering, variables, buffer)
-              unless contexts.length < ::Curlybars.configuration.nesting_limit
-                message = "Nesting too deep"
-                position = rendering.position(#{position.line_number}, #{position.line_offset})
-                raise ::Curlybars::Error::Render.new('nesting_too_deep', message, position)
-              end
               #{compiled_items}
             end
           end.exec(contexts, rendering, variables, buffer)

data/lib/curlybars/node/with_else.rb

@@ -10,6 +10,7 @@ module Curlybars
           if rendering.to_bool(compiled_path)
             position = rendering.position(#{position.line_number}, #{position.line_offset})
             rendering.check_context_is_presenter(compiled_path, #{presenter_path.path.inspect}, position)
+            rendering.check_nesting_not_too_deep(position)
 
             contexts.push(compiled_path)
             begin

data/lib/curlybars/path_finder.rb

@@ -82,8 +82,7 @@ module Curlybars
         stack.pop unless stack.empty?
       end
 
-      remaining_segments = full_path.empty? ? [] : full_path.split('.')
-      stack + remaining_segments
+      stack + full_path.split('.')
     end
 
     def handle_block_helper(node, context_stack)

data/lib/curlybars/rendering_support.rb

@@ -31,6 +31,16 @@ module Curlybars
       raise ::Curlybars::Error::Render.new('timeout', message, nil)
     end
 
+    # Called before a #with or #each block pushes its context. The contexts
+    # stack starts with the root presenter, so its length is one more than
+    # the number of enclosing #with and #each blocks.
+    def check_nesting_not_too_deep(position)
+      return if contexts.length <= Curlybars.configuration.nesting_limit
+
+      message = "Nesting too deep (> #{Curlybars.configuration.nesting_limit} levels)"
+      raise Curlybars::Error::Render.new('nesting_too_deep', message, position)
+    end
+
     def check_context_is_presenter(context, path, position)
       return if presenter?(context)
 
@@ -205,7 +215,7 @@ module Curlybars
 
       eval(eval_source) # rubocop:disable Security/Eval -- eval is the established compilation pattern for the whole engine
     rescue Curlybars::Error::Render => e
-      raise if e.id == 'render.timeout' || e.id == 'render.output_too_long'
+      raise if e.id == 'render.timeout' || e.id == 'render.output_too_long' || e.id == 'render.nesting_too_deep'
 
       ""
     rescue StandardError
@@ -257,8 +267,11 @@ module Curlybars
       raise Curlybars::Error::Render.new('unallowed_path', message, position)
     end
 
+    # Counts the dots after the final `/` in the path. Leading `../` segments
+    # move up the contexts stack rather than traversing, so they don't count.
     def check_traverse_not_too_deep(traverse, position)
-      return unless traverse.count('.') > Curlybars.configuration.traversing_limit
+      dots = traverse.split('/').last.count('.')
+      return unless dots > Curlybars.configuration.traversing_limit
 
       message = "`#{traverse}` too deep"
       raise Curlybars::Error::Render.new('traverse_too_deep', message, position)

data/lib/curlybars/serialization_guard.rb

@@ -0,0 +1,35 @@
+module Curlybars
+  class SerializationGuard
+    def initialize(budget:, depth_limit:)
+      @budget = budget
+      @depth_limit = depth_limit
+      @accumulated = 0
+      @depth = 0
+    end
+
+    def enter!
+      @depth += 1
+      return unless @depth > @depth_limit
+
+      message = "Serialization nesting too deep (> #{@depth_limit})"
+      raise Curlybars::Error::Render.new('nesting_too_deep', message, nil)
+    end
+
+    def leave!
+      @depth -= 1
+    end
+
+    def measure(value)
+      # Only String leaves are counted: deep-measuring every Hash/Array would
+      # mean serializing twice. This under-counts raw hash/array fields; the
+      # authoritative ceiling is still SafeBuffer#concat at the output node.
+      return unless value.is_a?(String)
+
+      @accumulated += value.bytesize
+      return unless @accumulated > @budget
+
+      message = "Output too long (> #{@budget} bytes)"
+      raise Curlybars::Error::Render.new('output_too_long', message, nil)
+    end
+  end
+end

data/lib/curlybars/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Curlybars
-  VERSION = '1.16.1.pre.2'
+  VERSION = '1.16.1'
 end

data/lib/curlybars.rb

@@ -29,7 +29,7 @@ module Curlybars
       cache_key = ["Curlybars.compile", Curlybars::VERSION, identifier, Digest::SHA256.hexdigest(source)]
 
       cache.fetch(cache_key) do
-        ast(transformed_source(source), identifier, run_processors: true).compile
+        ast(transformed_source(source, identifier), identifier, run_processors: true).compile
       end
     end
 
@@ -76,7 +76,7 @@ module Curlybars
     # source - The source HBS String used to generate an AST.
     # identifier - The the file name of the template being checked (defaults to `nil`).
     def visit(visitor, source, identifier = nil)
-      tree = ast(transformed_source(source), identifier, run_processors: true)
+      tree = ast(transformed_source(source, identifier), identifier, run_processors: true)
       visitor.accept(tree)
     end
 
@@ -99,11 +99,19 @@ module Curlybars
     #
     # Returns an Array of Curlybars::Node::Path instances that match the target path.
     def find(target_path, source, identifier = nil, role: nil)
-      tree = ast(transformed_source(source), identifier, run_processors: true)
+      tree = ast(transformed_source(source, identifier), identifier, run_processors: true)
       finder = Curlybars::PathFinder.new(tree)
       finder.find(target_path, role: role)
     end
 
+    def serialize(value)
+      guard = Curlybars::SerializationGuard.new(
+        budget: configuration.output_limit,
+        depth_limit: configuration.nesting_limit
+      )
+      value.to_json(curlybars_guard: guard)
+    end
+
     def global_helpers_dependency_tree
       @global_helpers_dependency_tree ||= begin
         classes = Curlybars.configuration.global_helpers_provider_classes
@@ -119,7 +127,7 @@ module Curlybars
 
     private
 
-    def transformed_source(source)
+    def transformed_source(source, identifier)
       transformers = Curlybars.configuration.compiler_transformers
       transformers.inject(source) do |memo, transformer|
         transformer.transform(memo, identifier)
@@ -147,6 +155,7 @@ module Curlybars
 end
 
 require 'curlybars/safe_buffer'
+require 'curlybars/serialization_guard'
 require 'curlybars/configuration'
 require 'curlybars/rendering_support'
 require 'curlybars/parser'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: curlybars
 version: !ruby/object:Gem::Version
-  version: 1.16.1.pre.2
+  version: 1.16.1
 platform: ruby
 authors:
 - Libo Cannici
@@ -96,7 +96,6 @@ files:
 - lib/curlybars/lexer.rb
 - lib/curlybars/method_whitelist.rb
 - lib/curlybars/node/block_helper_else.rb
-- lib/curlybars/node/boolean.rb
 - lib/curlybars/node/each_else.rb
 - lib/curlybars/node/if_else.rb
 - lib/curlybars/node/item.rb
@@ -106,7 +105,6 @@ files:
 - lib/curlybars/node/partial.rb
 - lib/curlybars/node/path.rb
 - lib/curlybars/node/root.rb
-- lib/curlybars/node/string.rb
 - lib/curlybars/node/sub_expression.rb
 - lib/curlybars/node/template.rb
 - lib/curlybars/node/text.rb
@@ -123,6 +121,7 @@ files:
 - lib/curlybars/railtie.rb
 - lib/curlybars/rendering_support.rb
 - lib/curlybars/safe_buffer.rb
+- lib/curlybars/serialization_guard.rb
 - lib/curlybars/template_handler.rb
 - lib/curlybars/validation_context.rb
 - lib/curlybars/version.rb
@@ -139,7 +138,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.2'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="

data/lib/curlybars/node/boolean.rb

@@ -1,24 +0,0 @@
-module Curlybars
-  module Node
-    Boolean = Struct.new(:boolean) do
-      def compile
-        # NOTE: the following is a heredoc string, representing the ruby code fragment
-        # outputted by this node.
-        <<-RUBY
-          ->() { #{boolean} }
-        RUBY
-      end
-
-      def validate(branches, context: nil)
-        # Nothing to validate here.
-      end
-
-      def cache_key
-        [
-          boolean.to_s,
-          self.class.name
-        ].join("/")
-      end
-    end
-  end
-end

data/lib/curlybars/node/string.rb

@@ -1,24 +0,0 @@
-module Curlybars
-  module Node
-    String = Struct.new(:string) do
-      def compile
-        # NOTE: the following is a heredoc string, representing the ruby code fragment
-        # outputted by this node.
-        <<-RUBY
-          ->() { #{string.inspect} }
-        RUBY
-      end
-
-      def validate(branches, context: nil)
-        # Nothing to validate here.
-      end
-
-      def cache_key
-        [
-          string,
-          self.class.name
-        ].join("/")
-      end
-    end
-  end
-end