curlybars 1.16.1.pre.2 → 1.16.1.pre.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a8897a8516ee71758de87ec45acd0dcf0f177ef5e69470dcbc4e81004f57fb26
-  data.tar.gz: 5948e415e943ff80c52fa5a756259bdda63b8943c10b77eda9bae650e384fe14
+  metadata.gz: e8152eb9d4e5789fce89e656283b0ae7be78799bafcd9755c99d793674a01d9a
+  data.tar.gz: 57102435a47d352a31c16d994e36bd61436b777e0e98409355bc31161045a44d
 SHA512:
-  metadata.gz: 41f73fbddd332bb54078bd45f74dd9eb93192d8707d943d9f72af8ca29da186ad85935bd5b113ddbe74b1f3084a15431c5a13b1145b57cfd1c2b3215624733b2
-  data.tar.gz: 3cee5f68d7ad53d3b948395e381f83465da70d7ec74a1cdc7bba37f8598ad212264698e8e675aff6925fb573710ab90cae58fb6e5d608570814c80c61b673fff
+  metadata.gz: 797b775e410fff90804ecfad939a0f31add15dc199a4b3221dba6ab4d9ee165134b07c40b90d6e16ea87f331ee80226d9ab0ae28823c8508a0dd7c8c5671a57f
+  data.tar.gz: 5b2f6719689b4c047d3fa8a0b31dccd92457d5147eb40a0092331eb7b2f349297bdebd0b15b04702d0808bf154b6bbe69f9c2a7a83ddc71df80aae2fa3dbce0b

data/lib/curlybars/method_whitelist.rb

@@ -47,8 +47,8 @@ module Curlybars
 
         contextual_block&.call(context, schema_adder)
 
-        schema = all_methods_without_type.each_with_object({}) do |method, memo|
-          memo[method] = nil
+        schema = all_methods_without_type.to_h do |method|
+          [method, nil]
         end
 
         methods_with_type_resolved = all_methods_with_type.transform_values do |type|
@@ -104,12 +104,19 @@ module Curlybars
       define_method(:as_json) do |*args|
         return @__as_json if defined?(@__as_json)
 
-        @__as_json ||= allowed_methods.each_with_object({}) do |method, hash|
+        guard = args.first.is_a?(Hash) ? args.first[:curlybars_guard] : nil
+        guard&.enter!
+
+        @__as_json = allowed_methods.each_with_object({}) do |method, hash|
           unless self.method(method).arity > 0
             value = send(method)
-            hash[method] = value.equal?(self) ? "[circular reference]" : value.as_json
+            serialized = value.equal?(self) ? "[circular reference]" : value.as_json(*args)
+            guard&.measure(serialized)
+            hash[method] = serialized
           end
         end
+      ensure
+        guard&.leave!
       end
     end
 

data/lib/curlybars/rendering_support.rb

@@ -205,7 +205,7 @@ module Curlybars
 
       eval(eval_source) # rubocop:disable Security/Eval -- eval is the established compilation pattern for the whole engine
     rescue Curlybars::Error::Render => e
-      raise if e.id == 'render.timeout' || e.id == 'render.output_too_long'
+      raise if e.id == 'render.timeout' || e.id == 'render.output_too_long' || e.id == 'render.nesting_too_deep'
 
       ""
     rescue StandardError

data/lib/curlybars/serialization_guard.rb

@@ -0,0 +1,35 @@
+module Curlybars
+  class SerializationGuard
+    def initialize(budget:, depth_limit:)
+      @budget = budget
+      @depth_limit = depth_limit
+      @accumulated = 0
+      @depth = 0
+    end
+
+    def enter!
+      @depth += 1
+      return unless @depth > @depth_limit
+
+      message = "Serialization nesting too deep (> #{@depth_limit})"
+      raise Curlybars::Error::Render.new('nesting_too_deep', message, nil)
+    end
+
+    def leave!
+      @depth -= 1
+    end
+
+    def measure(value)
+      # Only String leaves are counted: deep-measuring every Hash/Array would
+      # mean serializing twice. This under-counts raw hash/array fields; the
+      # authoritative ceiling is still SafeBuffer#concat at the output node.
+      return unless value.is_a?(String)
+
+      @accumulated += value.bytesize
+      return unless @accumulated > @budget
+
+      message = "Output too long (> #{@budget} bytes)"
+      raise Curlybars::Error::Render.new('output_too_long', message, nil)
+    end
+  end
+end

data/lib/curlybars/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Curlybars
-  VERSION = '1.16.1.pre.2'
+  VERSION = '1.16.1.pre.3'
 end

data/lib/curlybars.rb

@@ -104,6 +104,14 @@ module Curlybars
       finder.find(target_path, role: role)
     end
 
+    def serialize(value)
+      guard = Curlybars::SerializationGuard.new(
+        budget: configuration.output_limit,
+        depth_limit: configuration.nesting_limit
+      )
+      value.to_json(curlybars_guard: guard)
+    end
+
     def global_helpers_dependency_tree
       @global_helpers_dependency_tree ||= begin
         classes = Curlybars.configuration.global_helpers_provider_classes
@@ -147,6 +155,7 @@ module Curlybars
 end
 
 require 'curlybars/safe_buffer'
+require 'curlybars/serialization_guard'
 require 'curlybars/configuration'
 require 'curlybars/rendering_support'
 require 'curlybars/parser'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: curlybars
 version: !ruby/object:Gem::Version
-  version: 1.16.1.pre.2
+  version: 1.16.1.pre.3
 platform: ruby
 authors:
 - Libo Cannici
@@ -123,6 +123,7 @@ files:
 - lib/curlybars/railtie.rb
 - lib/curlybars/rendering_support.rb
 - lib/curlybars/safe_buffer.rb
+- lib/curlybars/serialization_guard.rb
 - lib/curlybars/template_handler.rb
 - lib/curlybars/validation_context.rb
 - lib/curlybars/version.rb