handlebars-source 4.7.8 → 4.7.10

data/handlebars.js

@@ -1,7 +1,7 @@
 /**!
 
  @license
- handlebars v4.7.8
+ handlebars v4.7.10
 
 Copyright (C) 2011-2019 by Yehuda Katz
 
@@ -92,11 +92,11 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	// Compiler imports
 
-	var _handlebarsCompilerAst = __webpack_require__(84);
+	var _handlebarsCompilerAst = __webpack_require__(83);
 
 	var _handlebarsCompilerAst2 = _interopRequireDefault(_handlebarsCompilerAst);
 
-	var _handlebarsCompilerBase = __webpack_require__(85);
+	var _handlebarsCompilerBase = __webpack_require__(84);
 
 	var _handlebarsCompilerCompiler = __webpack_require__(90);
 
@@ -104,11 +104,11 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	var _handlebarsCompilerJavascriptCompiler2 = _interopRequireDefault(_handlebarsCompilerJavascriptCompiler);
 
-	var _handlebarsCompilerVisitor = __webpack_require__(88);
+	var _handlebarsCompilerVisitor = __webpack_require__(87);
 
 	var _handlebarsCompilerVisitor2 = _interopRequireDefault(_handlebarsCompilerVisitor);
 
-	var _handlebarsNoConflict = __webpack_require__(83);
+	var _handlebarsNoConflict = __webpack_require__(82);
 
 	var _handlebarsNoConflict2 = _interopRequireDefault(_handlebarsNoConflict);
 
@@ -178,7 +178,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	// Each of these augment the Handlebars object. No need to setup here.
 	// (This is done to easily share code between commonjs and browse envs)
 
-	var _handlebarsSafeString = __webpack_require__(77);
+	var _handlebarsSafeString = __webpack_require__(76);
 
 	var _handlebarsSafeString2 = _interopRequireDefault(_handlebarsSafeString);
 
@@ -190,11 +190,11 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	var Utils = _interopRequireWildcard(_handlebarsUtils);
 
-	var _handlebarsRuntime = __webpack_require__(78);
+	var _handlebarsRuntime = __webpack_require__(77);
 
 	var runtime = _interopRequireWildcard(_handlebarsRuntime);
 
-	var _handlebarsNoConflict = __webpack_require__(83);
+	var _handlebarsNoConflict = __webpack_require__(82);
 
 	var _handlebarsNoConflict2 = _interopRequireDefault(_handlebarsNoConflict);
 
@@ -278,7 +278,7 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	var _internalProtoAccess = __webpack_require__(73);
 
-	var VERSION = '4.7.8';
+	var VERSION = '4.7.10';
 	exports.VERSION = VERSION;
 	var COMPILER_REVISION = 8;
 	exports.COMPILER_REVISION = COMPILER_REVISION;
@@ -452,8 +452,9 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	function escapeExpression(string) {
 	  if (typeof string !== 'string') {
-	    // don't escape SafeStrings, since they're already safe
-	    if (string && string.toHTML) {
+	    // don't escape SafeStrings, since they're already safe. Other values with a
+	    // "toHTML" key, e.g. from JSON context data, are escaped like any object.
+	    if (string && typeof string.toHTML === 'function') {
 	      return string.toHTML();
 	    } else if (string == null) {
 	      return '';
@@ -516,11 +517,15 @@ return /******/ (function(modules) { // webpackBootstrap
 	      column = undefined,
 	      endColumn = undefined;
 
-	  if (loc) {
+	  // Hand-built ASTs may carry a partial loc; never let the location
+	  // bookkeeping mask the actual error message.
+	  if (loc && loc.start) {
 	    line = loc.start.line;
-	    endLineNumber = loc.end.line;
 	    column = loc.start.column;
-	    endColumn = loc.end.column;
+	    if (loc.end) {
+	      endLineNumber = loc.end.line;
+	      endColumn = loc.end.column;
+	    }
 
 	    message += ' - ' + line + ':' + column;
 	  }
@@ -655,7 +660,8 @@ return /******/ (function(modules) { // webpackBootstrap
 	  if (instance.helpers[helperName]) {
 	    instance.hooks[helperName] = instance.helpers[helperName];
 	    if (!keepHelper) {
-	      delete instance.helpers[helperName];
+	      // Using delete is slow
+	      instance.helpers[helperName] = undefined;
 	    }
 	  }
 	}
@@ -727,6 +733,26 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	var _exception2 = _interopRequireDefault(_exception);
 
+	/**
+	 * Close an unfinished iterator after the block body threw, like for...of does,
+	 * so that generators can run their cleanup code.
+	 *
+	 * Errors thrown while closing, including by a `return` getter, are ignored:
+	 * the block's error is the cause and is the one the caller must see.
+	 *
+	 * @param {Iterator} iterator the iterator that was being consumed
+	 */
+	function closeIterator(iterator) {
+	  try {
+	    var _close = iterator['return'];
+	    if (_utils.isFunction(_close)) {
+	      _close.call(iterator);
+	    }
+	  } catch (closeError) {
+	    // NOP
+	  }
+	}
+
 	exports['default'] = function (instance) {
 	  instance.registerHelper('each', function (context, options) {
 	    if (!options) {
@@ -752,7 +778,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	      data = _utils.createFrame(options.data);
 	    }
 
-	    function execIteration(field, index, last) {
+	    function execIteration(field, index, last, value) {
 	      if (data) {
 	        data.key = field;
 	        data.index = index;
@@ -764,9 +790,9 @@ return /******/ (function(modules) { // webpackBootstrap
 	        }
 	      }
 
-	      ret = ret + fn(context[field], {
+	      ret = ret + fn(value, {
 	        data: data,
-	        blockParams: _utils.blockParams([context[field], field], [contextPath + field, null])
+	        blockParams: _utils.blockParams([value, field], [contextPath + field, null])
 	      });
 	    }
 
@@ -774,18 +800,24 @@ return /******/ (function(modules) { // webpackBootstrap
 	      if (_utils.isArray(context)) {
 	        for (var j = context.length; i < j; i++) {
 	          if (i in context) {
-	            execIteration(i, i, i === context.length - 1);
+	            execIteration(i, i, i === context.length - 1, context[i]);
 	          }
 	        }
 	      } else if (typeof _Symbol === 'function' && context[_Symbol$iterator]) {
-	        var newContext = [];
 	        var iterator = _getIterator(context);
-	        for (var it = iterator.next(); !it.done; it = iterator.next()) {
-	          newContext.push(it.value);
-	        }
-	        context = newContext;
-	        for (var j = context.length; i < j; i++) {
-	          execIteration(i, i, i === context.length - 1);
+	        var current = iterator.next();
+	        while (!current.done) {
+	          var next = iterator.next();
+	          try {
+	            execIteration(i, i, next.done, current.value);
+	          } catch (e) {
+	            if (!next.done) {
+	              closeIterator(iterator);
+	            }
+	            throw e;
+	          }
+	          current = next;
+	          i++;
 	        }
 	      } else {
 	        (function () {
@@ -796,13 +828,13 @@ return /******/ (function(modules) { // webpackBootstrap
 	            // the last iteration without have to scan the object twice and create
 	            // an itermediate keys array.
 	            if (priorKey !== undefined) {
-	              execIteration(priorKey, i - 1);
+	              execIteration(priorKey, i - 1, false, context[priorKey]);
 	            }
 	            priorKey = key;
 	            i++;
 	          });
 	          if (priorKey !== undefined) {
-	            execIteration(priorKey, i - 1, true);
+	            execIteration(priorKey, i - 1, true, context[priorKey]);
 	          }
 	        })();
 	      }
@@ -2039,9 +2071,10 @@ return /******/ (function(modules) { // webpackBootstrap
 	exports.__esModule = true;
 	exports.createProtoAccessControl = createProtoAccessControl;
 	exports.resultIsAllowed = resultIsAllowed;
+	exports.isPrototypeConstructor = isPrototypeConstructor;
 	exports.resetLoggedProperties = resetLoggedProperties;
 
-	var _createNewLookupObject = __webpack_require__(76);
+	var _utils = __webpack_require__(5);
 
 	var _logger = __webpack_require__(72);
 
@@ -2050,23 +2083,28 @@ return /******/ (function(modules) { // webpackBootstrap
 	var loggedProperties = _Object$create(null);
 
 	function createProtoAccessControl(runtimeOptions) {
-	  var defaultMethodWhiteList = _Object$create(null);
-	  defaultMethodWhiteList['constructor'] = false;
-	  defaultMethodWhiteList['__defineGetter__'] = false;
-	  defaultMethodWhiteList['__defineSetter__'] = false;
-	  defaultMethodWhiteList['__lookupGetter__'] = false;
-
-	  var defaultPropertyWhiteList = _Object$create(null);
+	  // Create an object with "null"-prototype to avoid truthy results on
+	  // prototype properties.
+	  var propertyWhiteList = _Object$create(null);
 	  // eslint-disable-next-line no-proto
-	  defaultPropertyWhiteList['__proto__'] = false;
+	  propertyWhiteList['__proto__'] = false;
+	  _utils.extend(propertyWhiteList, runtimeOptions.allowedProtoProperties);
+
+	  var methodWhiteList = _Object$create(null);
+	  methodWhiteList['constructor'] = false;
+	  methodWhiteList['__defineGetter__'] = false;
+	  methodWhiteList['__defineSetter__'] = false;
+	  methodWhiteList['__lookupGetter__'] = false;
+	  methodWhiteList['__lookupSetter__'] = false;
+	  _utils.extend(methodWhiteList, runtimeOptions.allowedProtoMethods);
 
 	  return {
 	    properties: {
-	      whitelist: _createNewLookupObject.createNewLookupObject(defaultPropertyWhiteList, runtimeOptions.allowedProtoProperties),
+	      whitelist: propertyWhiteList,
 	      defaultValue: runtimeOptions.allowProtoPropertiesByDefault
 	    },
 	    methods: {
-	      whitelist: _createNewLookupObject.createNewLookupObject(defaultMethodWhiteList, runtimeOptions.allowedProtoMethods),
+	      whitelist: methodWhiteList,
 	      defaultValue: runtimeOptions.allowProtoMethodsByDefault
 	    }
 	  };
@@ -2080,6 +2118,25 @@ return /******/ (function(modules) { // webpackBootstrap
 	  }
 	}
 
+	/**
+	 * Detect a prototype object's own "constructor" back-reference, e.g.
+	 * `Function.prototype.constructor === Function`. Because "constructor" is an
+	 * "own" property of such objects, it would otherwise bypass the prototype-access
+	 * checks and expose dangerous constructors (allowing arbitrary code execution).
+	 *
+	 * Only functions can be constructors, so other values are never treated as one
+	 * and their `prototype` is never read.
+	 *
+	 * @param {*} parent the object the property is being read from
+	 * @param {string} propertyName the property being looked up
+	 * @param {*} result the already-resolved value of `parent[propertyName]`
+	 * @returns {boolean} true if the lookup resolves `parent`'s own constructor
+	 */
+
+	function isPrototypeConstructor(parent, propertyName, result) {
+	  return propertyName === 'constructor' && typeof result === 'function' && parent === result.prototype;
+	}
+
 	function checkWhiteList(protoAccessControlForType, propertyName) {
 	  if (protoAccessControlForType.whitelist[propertyName] !== undefined) {
 	    return protoAccessControlForType.whitelist[propertyName] === true;
@@ -2121,34 +2178,6 @@ return /******/ (function(modules) { // webpackBootstrap
 
 /***/ }),
 /* 76 */
-/***/ (function(module, exports, __webpack_require__) {
-
-	'use strict';
-
-	var _Object$create = __webpack_require__(74)['default'];
-
-	exports.__esModule = true;
-	exports.createNewLookupObject = createNewLookupObject;
-
-	var _utils = __webpack_require__(5);
-
-	/**
-	 * Create a new object with "null"-prototype to avoid truthy results on prototype properties.
-	 * The resulting object can be used with "object[property]" to check if a property exists
-	 * @param {...object} sources a varargs parameter of source objects that will be merged
-	 * @returns {object}
-	 */
-
-	function createNewLookupObject() {
-	  for (var _len = arguments.length, sources = Array(_len), _key = 0; _key < _len; _key++) {
-	    sources[_key] = arguments[_key];
-	  }
-
-	  return _utils.extend.apply(undefined, [_Object$create(null)].concat(sources));
-	}
-
-/***/ }),
-/* 77 */
 /***/ (function(module, exports) {
 
 	// Build out our basic SafeString type
@@ -2167,12 +2196,12 @@ return /******/ (function(modules) { // webpackBootstrap
 	module.exports = exports['default'];
 
 /***/ }),
-/* 78 */
+/* 77 */
 /***/ (function(module, exports, __webpack_require__) {
 
 	'use strict';
 
-	var _Object$seal = __webpack_require__(79)['default'];
+	var _Object$seal = __webpack_require__(78)['default'];
 
 	var _Object$keys = __webpack_require__(60)['default'];
 
@@ -2200,7 +2229,7 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	var _helpers = __webpack_require__(10);
 
-	var _internalWrapHelper = __webpack_require__(82);
+	var _internalWrapHelper = __webpack_require__(81);
 
 	var _internalProtoAccess = __webpack_require__(73);
 
@@ -2249,16 +2278,26 @@ return /******/ (function(modules) { // webpackBootstrap
 	    }
 	    partial = env.VM.resolvePartial.call(this, partial, context, options);
 
-	    var extendedOptions = Utils.extend({}, options, {
-	      hooks: this.hooks,
-	      protoAccessControl: this.protoAccessControl
-	    });
+	    options.hooks = this.hooks;
+	    options.protoAccessControl = this.protoAccessControl;
+
+	    var result = env.VM.invokePartial.call(this, partial, context, options);
 
-	    var result = env.VM.invokePartial.call(this, partial, context, extendedOptions);
+	    // An empty result normally means the partial is template source that still
+	    // has to be compiled. A function partial has already been invoked, so an
+	    // empty result from it is a bug in that partial.
+	    if (result == null && Utils.isFunction(partial)) {
+	      throw new _exception2['default']('The partial ' + options.name + ' returned no output: partials must return a string');
+	    }
 
 	    if (result == null && env.compile) {
+	      // Only template source registered as a partial may be compiled here.
+	      // Anything else (e.g. an AST-shaped object) must not become code.
+	      if (typeof partial !== 'string') {
+	        throw new _exception2['default']('The partial ' + options.name + ' could not be compiled: partials must be strings or functions returning strings');
+	      }
 	      options.partials[options.name] = env.compile(partial, templateSpec.compilerOptions, env);
-	      result = options.partials[options.name](context, extendedOptions);
+	      result = options.partials[options.name](context, options);
 	    }
 	    if (result != null) {
 	      if (options.indent) {
@@ -2293,7 +2332,12 @@ return /******/ (function(modules) { // webpackBootstrap
 	      if (result == null) {
 	        return result;
 	      }
-	      if (Object.prototype.hasOwnProperty.call(parent, propertyName)) {
+	      // Own properties are trusted context data and returned as-is, except for
+	      // a prototype's own "constructor" back-reference (e.g.
+	      // Function.prototype.constructor === Function): that must still pass the
+	      // prototype-access deny list, otherwise the Function constructor becomes
+	      // reachable and arbitrary code can be executed.
+	      if (Object.prototype.hasOwnProperty.call(parent, propertyName) && !_internalProtoAccess.isPrototypeConstructor(parent, propertyName, result)) {
 	        return result;
 	      }
 
@@ -2307,7 +2351,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	      for (var i = 0; i < len; i++) {
 	        var result = depths[i] && container.lookupProperty(depths[i], name);
 	        if (result != null) {
-	          return depths[i][name];
+	          return result;
 	        }
 	      }
 	    },
@@ -2389,8 +2433,9 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	  ret._setup = function (options) {
 	    if (!options.partial) {
-	      var mergedHelpers = Utils.extend({}, env.helpers, options.helpers);
-	      wrapHelpersToPassLookupProperty(mergedHelpers, container);
+	      var mergedHelpers = {};
+	      addHelpers(mergedHelpers, env.helpers, container);
+	      addHelpers(mergedHelpers, options.helpers, container);
 	      container.helpers = mergedHelpers;
 
 	      if (templateSpec.usePartial) {
@@ -2456,21 +2501,24 @@ return /******/ (function(modules) { // webpackBootstrap
 	function resolvePartial(partial, context, options) {
 	  if (!partial) {
 	    if (options.name === '@partial-block') {
-	      partial = options.data['partial-block'];
+	      partial = lookupOwnProperty(options.data, 'partial-block');
 	    } else {
-	      partial = options.partials[options.name];
+	      partial = lookupOwnProperty(options.partials, options.name);
 	    }
-	  } else if (!partial.call && !options.name) {
-	    // This is a dynamic partial that returned a string
+	  } else if (typeof partial !== 'function' && !options.name) {
+	    // This is a dynamic partial that returned a name rather than a compiled
+	    // partial. Only functions are accepted as partials here; any other value
+	    // (including an object with a "call" property) is treated as a name, so
+	    // that context data can never be compiled as a template.
 	    options.name = partial;
-	    partial = options.partials[partial];
+	    partial = lookupOwnProperty(options.partials, partial);
 	  }
 	  return partial;
 	}
 
 	function invokePartial(partial, context, options) {
 	  // Use the current closure context to save the partial-block if this partial
-	  var currentPartialBlock = options.data && options.data['partial-block'];
+	  var currentPartialBlock = lookupOwnProperty(options.data, 'partial-block');
 	  options.partial = true;
 	  if (options.ids) {
 	    options.data.contextPath = options.ids[0] || options.data.contextPath;
@@ -2512,6 +2560,12 @@ return /******/ (function(modules) { // webpackBootstrap
 	  return '';
 	}
 
+	function lookupOwnProperty(obj, name) {
+	  if (obj && Object.prototype.hasOwnProperty.call(obj, name)) {
+	    return obj[name];
+	  }
+	}
+
 	function initData(context, data) {
 	  if (!data || !('root' in data)) {
 	    data = data ? _base.createFrame(data) : {};
@@ -2529,9 +2583,10 @@ return /******/ (function(modules) { // webpackBootstrap
 	  return prog;
 	}
 
-	function wrapHelpersToPassLookupProperty(mergedHelpers, container) {
-	  _Object$keys(mergedHelpers).forEach(function (helperName) {
-	    var helper = mergedHelpers[helperName];
+	function addHelpers(mergedHelpers, helpers, container) {
+	  if (!helpers) return;
+	  _Object$keys(helpers).forEach(function (helperName) {
+	    var helper = helpers[helperName];
 	    mergedHelpers[helperName] = passLookupPropertyOption(helper, container);
 	  });
 	}
@@ -2539,25 +2594,26 @@ return /******/ (function(modules) { // webpackBootstrap
 	function passLookupPropertyOption(helper, container) {
 	  var lookupProperty = container.lookupProperty;
 	  return _internalWrapHelper.wrapHelper(helper, function (options) {
-	    return Utils.extend({ lookupProperty: lookupProperty }, options);
+	    options.lookupProperty = lookupProperty;
+	    return options;
 	  });
 	}
 
 /***/ }),
-/* 79 */
+/* 78 */
 /***/ (function(module, exports, __webpack_require__) {
 
-	module.exports = { "default": __webpack_require__(80), __esModule: true };
+	module.exports = { "default": __webpack_require__(79), __esModule: true };
 
 /***/ }),
-/* 80 */
+/* 79 */
 /***/ (function(module, exports, __webpack_require__) {
 
-	__webpack_require__(81);
+	__webpack_require__(80);
 	module.exports = __webpack_require__(21).Object.seal;
 
 /***/ }),
-/* 81 */
+/* 80 */
 /***/ (function(module, exports, __webpack_require__) {
 
 	// 19.1.2.17 Object.seal(O)
@@ -2570,7 +2626,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	});
 
 /***/ }),
-/* 82 */
+/* 81 */
 /***/ (function(module, exports) {
 
 	'use strict';
@@ -2593,7 +2649,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	}
 
 /***/ }),
-/* 83 */
+/* 82 */
 /***/ (function(module, exports) {
 
 	/* global globalThis */
@@ -2627,7 +2683,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	module.exports = exports['default'];
 
 /***/ }),
-/* 84 */
+/* 83 */
 /***/ (function(module, exports) {
 
 	'use strict';
@@ -2662,7 +2718,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	module.exports = exports['default'];
 
 /***/ }),
-/* 85 */
+/* 84 */
 /***/ (function(module, exports, __webpack_require__) {
 
 	'use strict';
@@ -2675,11 +2731,11 @@ return /******/ (function(modules) { // webpackBootstrap
 	exports.parseWithoutProcessing = parseWithoutProcessing;
 	exports.parse = parse;
 
-	var _parser = __webpack_require__(86);
+	var _parser = __webpack_require__(85);
 
 	var _parser2 = _interopRequireDefault(_parser);
 
-	var _whitespaceControl = __webpack_require__(87);
+	var _whitespaceControl = __webpack_require__(86);
 
 	var _whitespaceControl2 = _interopRequireDefault(_whitespaceControl);
 
@@ -2720,7 +2776,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	}
 
 /***/ }),
-/* 86 */
+/* 85 */
 /***/ (function(module, exports) {
 
 	// File ignored in coverage tests via setting in .istanbul.yml
@@ -3461,7 +3517,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	module.exports = exports["default"];
 
 /***/ }),
-/* 87 */
+/* 86 */
 /***/ (function(module, exports, __webpack_require__) {
 
 	'use strict';
@@ -3470,7 +3526,7 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	exports.__esModule = true;
 
-	var _visitor = __webpack_require__(88);
+	var _visitor = __webpack_require__(87);
 
 	var _visitor2 = _interopRequireDefault(_visitor);
 
@@ -3516,7 +3572,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	        // If we are on a standalone node, save the indent info for partials
 	        if (current.type === 'PartialStatement') {
 	          // Pull out the whitespace from the final line
-	          current.indent = /([ \t]+$)/.exec(body[i - 1].original)[1];
+	          current.indent = /(?:^|[^ \t])([ \t]+)$/.exec(body[i - 1].original)[1];
 	        }
 	      }
 	    }
@@ -3624,7 +3680,9 @@ return /******/ (function(modules) { // webpackBootstrap
 	  }
 
 	  if (prev.type === 'ContentStatement') {
-	    return (sibling || !isRoot ? /\r?\n\s*?$/ : /(^|\r?\n)\s*?$/).test(prev.original);
+	    // Matches when the trailing whitespace contains a newline (or, for the
+	    // root's first node, is the whole string). See omitLeft for the anchoring.
+	    return (sibling || !isRoot ? /(?:^|\S)[^\S\n]*\n\s*$/ : /^\s*$|(?:^|\S)[^\S\n]*\n\s*$/).test(prev.original);
 	  }
 	}
 	function isNextWhitespace(body, i, isRoot) {
@@ -3676,7 +3734,10 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	  // We omit the last node if it's whitespace only and not preceded by a non-content node.
 	  var original = current.value;
-	  current.value = current.value.replace(multiple ? /\s+$/ : /[ \t]+$/, '');
+	  // The match must start after a non-whitespace character (or at the start):
+	  // a plain /\s+$/ is retried at every position of a whitespace run, which
+	  // takes quadratic time on long runs.
+	  current.value = current.value.replace(multiple ? /(^|\S)\s+$/ : /(^|[^ \t])[ \t]+$/, '$1');
 	  current.leftStripped = current.value !== original;
 	  return current.leftStripped;
 	}
@@ -3685,7 +3746,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	module.exports = exports['default'];
 
 /***/ }),
-/* 88 */
+/* 87 */
 /***/ (function(module, exports, __webpack_require__) {
 
 	'use strict';
@@ -3698,10 +3759,34 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	var _exception2 = _interopRequireDefault(_exception);
 
+	var _utils = __webpack_require__(5);
+
+	var _nodeTypes = __webpack_require__(88);
+
 	function Visitor() {
 	  this.parents = [];
 	}
 
+	/**
+	 * Whether a visitor may dispatch on a node type.
+	 *
+	 * A type is dispatchable if the parser produces it, or if the visitor
+	 * (typically a subclass) defines a handler for it that is not a method of
+	 * Visitor itself. `in` is used for the latter so that accept, acceptKey and
+	 * everything inherited from Object.prototype (constructor, __proto__, ...)
+	 * can never be reached through a crafted `type`.
+	 *
+	 * Subclasses that visit untrusted ASTs, such as WhitespaceControl, must
+	 * therefore define nothing but node handlers as function properties.
+	 *
+	 * @param {Visitor} visitor the visitor that would handle the node
+	 * @param {*} type the untrusted `type` of the node
+	 * @returns {boolean} true if the visitor may call its `type` method
+	 */
+	function isDispatchable(visitor, type) {
+	  return _utils.indexOf(_nodeTypes.NODE_TYPES, type) !== -1 || !(type in Visitor.prototype) && typeof visitor[type] === 'function';
+	}
+
 	Visitor.prototype = {
 	  constructor: Visitor,
 	  mutating: false,
@@ -3710,9 +3795,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	  acceptKey: function acceptKey(node, name) {
 	    var value = this.accept(node[name]);
 	    if (this.mutating) {
-	      // Hacky sanity check: This may have a few false positives for type for the helper
-	      // methods but will generally do the right thing without a lot of overhead.
-	      if (value && !Visitor.prototype[value.type]) {
+	      if (value && !isDispatchable(this, value.type)) {
 	        throw new _exception2['default']('Unexpected node type "' + value.type + '" found when accepting ' + name + ' on ' + node.type);
 	      }
 	      node[name] = value;
@@ -3748,8 +3831,9 @@ return /******/ (function(modules) { // webpackBootstrap
 	      return;
 	    }
 
-	    /* istanbul ignore next: Sanity code */
-	    if (!this[object.type]) {
+	    // Dispatching on an unknown type could call an arbitrary method of the
+	    // visitor (e.g. `accept` itself) with an untrusted AST node.
+	    if (!isDispatchable(this, object.type) || !this[object.type]) {
 	      throw new _exception2['default']('Unknown type: ' + object.type, object);
 	    }
 
@@ -3827,6 +3911,20 @@ return /******/ (function(modules) { // webpackBootstrap
 	exports['default'] = Visitor;
 	module.exports = exports['default'];
 
+/***/ }),
+/* 88 */
+/***/ (function(module, exports) {
+
+	// AST node types produced by the parser. Visitor#accept and Compiler#accept
+	// dispatch on the untrusted `node.type`, so they must never call any other
+	// method of the visiting object. The Compiler only accepts these types; a
+	// Visitor also accepts types for which a subclass defines its own handler.
+	'use strict';
+
+	exports.__esModule = true;
+	var NODE_TYPES = ['Program', 'BlockStatement', 'DecoratorBlock', 'PartialStatement', 'PartialBlockStatement', 'Decorator', 'MustacheStatement', 'ContentStatement', 'CommentStatement', 'SubExpression', 'PathExpression', 'StringLiteral', 'NumberLiteral', 'BooleanLiteral', 'UndefinedLiteral', 'NullLiteral', 'Hash', 'HashPair'];
+	exports.NODE_TYPES = NODE_TYPES;
+
 /***/ }),
 /* 89 */
 /***/ (function(module, exports, __webpack_require__) {
@@ -4081,10 +4179,12 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	var _utils = __webpack_require__(5);
 
-	var _ast = __webpack_require__(84);
+	var _ast = __webpack_require__(83);
 
 	var _ast2 = _interopRequireDefault(_ast);
 
+	var _nodeTypes = __webpack_require__(88);
+
 	var slice = [].slice;
 
 	function Compiler() {}
@@ -4164,8 +4264,8 @@ return /******/ (function(modules) { // webpackBootstrap
 	  },
 
 	  accept: function accept(node) {
-	    /* istanbul ignore next: Sanity code */
-	    if (!this[node.type]) {
+	    // Dispatching on an unknown type could call an arbitrary Compiler method.
+	    if (_utils.indexOf(_nodeTypes.NODE_TYPES, node.type) === -1 || !this[node.type]) {
 	      throw new _exception2['default']('Unknown type: ' + node.type, node);
 	    }
 
@@ -4176,6 +4276,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	  },
 
 	  Program: function Program(program) {
+	    validateBlockParams(program);
 	    this.options.blockParams.unshift(program.blockParams);
 
 	    var body = program.body,
@@ -4291,6 +4392,9 @@ return /******/ (function(modules) { // webpackBootstrap
 	  },
 
 	  ContentStatement: function ContentStatement(content) {
+	    if (content.value != null && typeof content.value !== 'string') {
+	      throw invalidAst(content, 'value must be a string');
+	    }
 	    if (content.value) {
 	      this.opcode('appendContent', content.value);
 	    }
@@ -4315,7 +4419,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	        name = path.parts[0],
 	        isBlock = program != null || inverse != null;
 
-	    this.opcode('getContext', path.depth);
+	    this.opcode('getContext', validateDepth(path));
 
 	    this.opcode('pushProgram', program);
 	    this.opcode('pushProgram', inverse);
@@ -4352,35 +4456,43 @@ return /******/ (function(modules) { // webpackBootstrap
 	  },
 
 	  PathExpression: function PathExpression(path) {
-	    this.addDepth(path.depth);
-	    this.opcode('getContext', path.depth);
+	    // Validate AST values at the compiler boundary: javascript-compiler.js
+	    // trusts all opcode arguments to be safe.
+	    var depth = validateDepth(path);
+	    var parts = validateParts(path);
 
-	    var name = path.parts[0],
+	    this.addDepth(depth);
+	    this.opcode('getContext', depth);
+
+	    var name = parts[0],
 	        scoped = _ast2['default'].helpers.scopedId(path),
-	        blockParamId = !path.depth && !scoped && this.blockParamIndex(name);
+	        blockParamId = !depth && !scoped && this.blockParamIndex(name);
 
 	    if (blockParamId) {
-	      this.opcode('lookupBlockParam', blockParamId, path.parts);
+	      this.opcode('lookupBlockParam', blockParamId, parts);
 	    } else if (!name) {
 	      // Context reference, i.e. `{{foo .}}` or `{{foo ..}}`
 	      this.opcode('pushContext');
 	    } else if (path.data) {
 	      this.options.data = true;
-	      this.opcode('lookupData', path.depth, path.parts, path.strict);
+	      this.opcode('lookupData', depth, parts, path.strict);
 	    } else {
-	      this.opcode('lookupOnContext', path.parts, path.falsy, path.strict, scoped);
+	      this.opcode('lookupOnContext', parts, path.falsy, path.strict, scoped);
 	    }
 	  },
 
 	  StringLiteral: function StringLiteral(string) {
+	    validateLiteral(string);
 	    this.opcode('pushString', string.value);
 	  },
 
 	  NumberLiteral: function NumberLiteral(number) {
+	    validateLiteral(number);
 	    this.opcode('pushLiteral', number.value);
 	  },
 
 	  BooleanLiteral: function BooleanLiteral(bool) {
+	    validateLiteral(bool);
 	    this.opcode('pushLiteral', bool.value);
 	  },
 
@@ -4395,7 +4507,17 @@ return /******/ (function(modules) { // webpackBootstrap
 	  Hash: function Hash(hash) {
 	    var pairs = hash.pairs,
 	        i = 0,
-	        l = pairs.length;
+	        l = undefined;
+
+	    if (!_utils.isArray(pairs)) {
+	      throw invalidAst(hash, 'pairs must be an array');
+	    }
+	    l = pairs.length;
+	    for (var j = 0; j < l; j++) {
+	      if (!pairs[j] || typeof pairs[j].key !== 'string') {
+	        throw invalidAst(hash, 'pair keys must be strings');
+	      }
+	    }
 
 	    this.opcode('pushHash');
 
@@ -4426,6 +4548,9 @@ return /******/ (function(modules) { // webpackBootstrap
 	  },
 
 	  classifySexpr: function classifySexpr(sexpr) {
+	    // The first part is used as a helper name below, e.g. for known helpers,
+	    // before the PathExpression handler gets to validate the parts.
+	    validateParts(sexpr.path);
 	    var isSimple = _ast2['default'].helpers.simpleId(sexpr.path);
 
 	    var isBlockParam = isSimple && !!this.blockParamIndex(sexpr.path.parts[0]);
@@ -4467,17 +4592,26 @@ return /******/ (function(modules) { // webpackBootstrap
 	  },
 
 	  pushParam: function pushParam(val) {
+	    // Literal params are not visited by their node handlers in stringParams
+	    // mode, so their values must be validated here as well.
+	    validateLiteral(val);
 	    var value = val.value != null ? val.value : val.original || '';
+	    var depth = validateDepth(val);
 
 	    if (this.stringParams) {
+	      // pushStringParam emits non-string values as raw JavaScript literals.
+	      // Literal values are validated above, but `original` is not, so
+	      // anything that is not a number or boolean is stringified.
+	      if (typeof value !== 'number' && typeof value !== 'boolean') {
+	        value = String(value);
+	      }
 	      if (value.replace) {
 	        value = value.replace(/^(\.?\.\/)*/g, '').replace(/\//g, '.');
 	      }
-
-	      if (val.depth) {
-	        this.addDepth(val.depth);
+	      if (depth) {
+	        this.addDepth(depth);
 	      }
-	      this.opcode('getContext', val.depth || 0);
+	      this.opcode('getContext', depth);
 	      this.opcode('pushStringParam', value, val.type);
 
 	      if (val.type === 'SubExpression') {
@@ -4488,8 +4622,10 @@ return /******/ (function(modules) { // webpackBootstrap
 	    } else {
 	      if (this.trackIds) {
 	        var blockParamIndex = undefined;
-	        if (val.parts && !_ast2['default'].helpers.scopedId(val) && !val.depth) {
-	          blockParamIndex = this.blockParamIndex(val.parts[0]);
+	        if (val.parts && !_ast2['default'].helpers.scopedId(val) && !depth) {
+	          // The parts are read here before the PathExpression handler,
+	          // invoked by accept() below, gets to validate them.
+	          blockParamIndex = this.blockParamIndex(validateParts(val)[0]);
 	        }
 	        if (blockParamIndex) {
 	          var blockParamChild = val.parts.slice(1).join('.');
@@ -4598,6 +4734,111 @@ return /******/ (function(modules) { // webpackBootstrap
 	  return ret;
 	}
 
+	/**
+	 * Create the exception thrown for an AST node that fails validation.
+	 *
+	 * @param {Object} node the offending AST node; its `type` is included in the
+	 *   message and its `loc`, if present, in the error location
+	 * @param {string} message what is wrong with the node
+	 * @returns {Exception} the exception to throw
+	 */
+	function invalidAst(node, message) {
+	  return new _exception2['default']('Invalid AST: ' + node.type + ' ' + message, node);
+	}
+
+	/**
+	 * Validate the `depth` of a path or param node.
+	 *
+	 * A missing depth is treated as 0, because ASTs built by hand or by other
+	 * tools commonly omit it. Any depth that is present must be a non-negative
+	 * integer, since it is written into the generated code.
+	 *
+	 * @param {Object} node the AST node whose `depth` is validated
+	 * @returns {number} the validated depth, or 0 if the node has none
+	 * @throws {Exception} if the depth is present but not a non-negative integer
+	 */
+	function validateDepth(node) {
+	  var depth = node.depth;
+	  if (depth == null) {
+	    return 0;
+	  }
+	  if (typeof depth !== 'number' || !isFinite(depth) || Math.floor(depth) !== depth || depth < 0) {
+	    throw invalidAst(node, 'depth must be a non-negative integer');
+	  }
+	  return depth;
+	}
+
+	/**
+	 * Validate the `value` of a StringLiteral, NumberLiteral or BooleanLiteral.
+	 *
+	 * Literal values are written into the generated code, so they must have
+	 * exactly the type their node promises. Nodes of any other type pass through
+	 * unchanged.
+	 *
+	 * Numbers need not be finite: the parser produces Infinity for very long
+	 * number literals, and Infinity and NaN are emitted as the read-only globals
+	 * of the same name.
+	 *
+	 * @param {Object} node the AST node to validate
+	 * @throws {Exception} if the value does not match the literal type
+	 */
+	function validateLiteral(node) {
+	  var value = node.value;
+	  if (node.type === 'StringLiteral' && typeof value !== 'string') {
+	    throw invalidAst(node, 'value must be a string');
+	  } else if (node.type === 'NumberLiteral' && typeof value !== 'number') {
+	    throw invalidAst(node, 'value must be a number');
+	  } else if (node.type === 'BooleanLiteral' && typeof value !== 'boolean') {
+	    throw invalidAst(node, 'value must be a boolean');
+	  }
+	}
+
+	/**
+	 * Validate that a node property is an array containing only strings.
+	 *
+	 * @param {Object} node the AST node the property belongs to, for the error
+	 * @param {*} value the property value to validate
+	 * @param {string} name the property name, used in the error message
+	 * @returns {string[]} the validated array
+	 * @throws {Exception} if the value is not an array or contains non-strings
+	 */
+	function validateStringArray(node, value, name) {
+	  if (!_utils.isArray(value)) {
+	    throw invalidAst(node, name + ' must be an array');
+	  }
+	  for (var i = 0; i < value.length; i++) {
+	    if (typeof value[i] !== 'string') {
+	      throw invalidAst(node, name + ' must only contain strings');
+	    }
+	  }
+	  return value;
+	}
+
+	/**
+	 * Validate the `parts` of a PathExpression node.
+	 *
+	 * @param {Object} path the PathExpression node
+	 * @returns {string[]} the validated parts
+	 * @throws {Exception} if `parts` is not an array of strings
+	 */
+	function validateParts(path) {
+	  return validateStringArray(path, path.parts, 'parts');
+	}
+
+	/**
+	 * Validate the optional `blockParams` of a Program node. Its length is
+	 * written into the generated code, so it must be an array of strings when
+	 * present.
+	 *
+	 * @param {Object} program the Program node
+	 * @throws {Exception} if `blockParams` is present and not an array of strings
+	 */
+	function validateBlockParams(program) {
+	  if (program.blockParams != null) {
+	    validateStringArray(program, program.blockParams, 'blockParams');
+	  }
+	}
+
 	function argEquals(a, b) {
 	  if (a === b) {
 	    return true;
@@ -4666,7 +4907,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	    return this.internalNameLookup(parent, name);
 	  },
 	  depthedLookup: function depthedLookup(name) {
-	    return [this.aliasable('container.lookup'), '(depths, ', JSON.stringify(name), ')'];
+	    return [this.aliasable('container.lookup'), '(depths, ', this.quotedString(name), ')'];
 	  },
 
 	  compilerInfo: function compilerInfo() {
@@ -4701,7 +4942,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	  // END PUBLIC API
 	  internalNameLookup: function internalNameLookup(parent, name) {
 	    this.lookupPropertyFunctionIsUsed = true;
-	    return ['lookupProperty(', parent, ',', JSON.stringify(name), ')'];
+	    return ['lookupProperty(', parent, ',', this.quotedString(name), ')'];
 	  },
 
 	  lookupPropertyFunctionIsUsed: false,
@@ -4794,12 +5035,10 @@ return /******/ (function(modules) { // webpackBootstrap
 	      var decorators = _context.decorators;
 
 	      for (i = 0, l = programs.length; i < l; i++) {
-	        if (programs[i]) {
-	          ret[i] = programs[i];
-	          if (decorators[i]) {
-	            ret[i + '_d'] = decorators[i];
-	            ret.useDecorators = true;
-	          }
+	        ret[i] = programs[i];
+	        if (decorators[i]) {
+	          ret[i + '_d'] = decorators[i];
+	          ret.useDecorators = true;
 	        }
 	      }
 
@@ -5125,20 +5364,21 @@ return /******/ (function(modules) { // webpackBootstrap
 	    this.resolvePath('data', parts, 0, true, strict);
 	  },
 
-	  resolvePath: function resolvePath(type, parts, i, falsy, strict) {
+	  resolvePath: function resolvePath(type, parts, startPartIndex, falsy, strict) {
 	    // istanbul ignore next
 
 	    var _this2 = this;
 
 	    if (this.options.strict || this.options.assumeObjects) {
-	      this.push(strictLookup(this.options.strict && strict, this, parts, i, type));
+	      this.push(strictLookup(this.options.strict && strict, this, parts, startPartIndex, type));
 	      return;
 	    }
 
 	    var len = parts.length;
-	    for (; i < len; i++) {
+
+	    var _loop = function (i) {
 	      /* eslint-disable no-loop-func */
-	      this.replaceStack(function (current) {
+	      _this2.replaceStack(function (current) {
 	        var lookup = _this2.nameLookup(current, parts[i], type);
 	        // We want to ensure that zero and false are handled properly if the context (falsy flag)
 	        // needs to have the special handling for these values.
@@ -5150,6 +5390,10 @@ return /******/ (function(modules) { // webpackBootstrap
 	        }
 	      });
 	      /* eslint-enable no-loop-func */
+	    };
+
+	    for (var i = startPartIndex; i < len; i++) {
+	      _loop(i);
 	    }
 	  },
 
@@ -5267,7 +5511,12 @@ return /******/ (function(modules) { // webpackBootstrap
 	    var foundDecorator = this.nameLookup('decorators', name, 'decorator'),
 	        options = this.setupHelperArgs(name, paramSize);
 
-	    this.decorators.push(['fn = ', this.decorators.functionCall(foundDecorator, '', ['fn', 'props', 'container', options]), ' || fn;']);
+	    // Store the resolved decorator in a variable and verify it is a function before
+	    // calling it. Without this, unregistered decorators can cause an unhandled TypeError
+	    // (calling undefined), which crashes the process — enabling Denial of Service.
+	    this.decorators.push(['var decorator = ', foundDecorator, ';']);
+	    this.decorators.push(['if (typeof decorator !== "function") { throw new Error(', this.quotedString('Missing decorator: "' + name + '"'), '); }']);
+	    this.decorators.push(['fn = ', this.decorators.functionCall('decorator', '', ['fn', 'props', 'container', options]), ' || fn;']);
 	  },
 
 	  // [invokeHelper]
@@ -5368,7 +5617,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	    }
 
 	    if (indent) {
-	      options.indent = JSON.stringify(indent);
+	      options.indent = this.quotedString(indent);
 	    }
 	    options.helpers = 'helpers';
 	    options.partials = 'partials';
@@ -5424,7 +5673,7 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	  pushId: function pushId(type, name, child) {
 	    if (type === 'BlockParam') {
-	      this.pushStackLiteral('blockParams[' + name[0] + '].path[' + name[1] + ']' + (child ? ' + ' + JSON.stringify('.' + child) : ''));
+	      this.pushStackLiteral('blockParams[' + name[0] + '].path[' + name[1] + ']' + (child ? ' + ' + this.quotedString('.' + child) : ''));
 	    } else if (type === 'PathExpression') {
 	      this.pushString(name);
 	    } else if (type === 'SubExpression') {
@@ -5450,8 +5699,8 @@ return /******/ (function(modules) { // webpackBootstrap
 	      var existing = this.matchExistingProgram(child);
 
 	      if (existing == null) {
-	        this.context.programs.push(''); // Placeholder to prevent name conflicts for nested children
-	        var index = this.context.programs.length;
+	        // Placeholder to prevent name conflicts for nested children
+	        var index = this.context.programs.push('') - 1;
 	        child.index = index;
 	        child.name = 'program' + index;
 	        this.context.programs[index] = compiler.compile(child, options, this.context, !this.precompile);
@@ -5739,7 +5988,7 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	  setupHelperArgs: function setupHelperArgs(helper, paramSize, params, useRegister) {
 	    var options = this.setupParams(helper, paramSize, params);
-	    options.loc = JSON.stringify(this.source.currentLocation);
+	    options.loc = locationLiteral(this);
 	    options = this.objectLiteral(options);
 	    if (useRegister) {
 	      this.useRegister('options');
@@ -5771,19 +6020,35 @@ return /******/ (function(modules) { // webpackBootstrap
 	  return !JavaScriptCompiler.RESERVED_WORDS[name] && /^[a-zA-Z_$][0-9a-zA-Z_$]*$/.test(name);
 	};
 
-	function strictLookup(requireTerminal, compiler, parts, i, type) {
+	/**
+	 * The compiler's current source location as a JavaScript literal.
+	 *
+	 * Hand-built ASTs may omit `loc`; emitting the literal `undefined` then
+	 * keeps the generated code valid and drops the key from object literals.
+	 * The location's `source` is the `srcName` option, so it is escaped like
+	 * every other string in the generated code.
+	 *
+	 * @param {JavaScriptCompiler} compiler the compiler whose location is emitted
+	 * @returns {string} a JSON object literal, or the string "undefined"
+	 */
+	function locationLiteral(compiler) {
+	  var loc = compiler.source.currentLocation;
+	  return loc ? _codeGen.safeJsonLiteral(loc) : 'undefined';
+	}
+
+	function strictLookup(requireTerminal, compiler, parts, startPartIndex, type) {
 	  var stack = compiler.popStack(),
 	      len = parts.length;
 	  if (requireTerminal) {
 	    len--;
 	  }
 
-	  for (; i < len; i++) {
+	  for (var i = startPartIndex; i < len; i++) {
 	    stack = compiler.nameLookup(stack, parts[i], type);
 	  }
 
 	  if (requireTerminal) {
-	    return [compiler.aliasable('container.strict'), '(', stack, ', ', compiler.quotedString(parts[i]), ', ', JSON.stringify(compiler.source.currentLocation), ' )'];
+	    return [compiler.aliasable('container.strict'), '(', stack, ', ', compiler.quotedString(parts[len]), ', ', locationLiteral(compiler), ' )'];
 	  } else {
 	    return stack;
 	  }
@@ -5802,9 +6067,62 @@ return /******/ (function(modules) { // webpackBootstrap
 	var _Object$keys = __webpack_require__(60)['default'];
 
 	exports.__esModule = true;
+	exports.safeJsonLiteral = safeJsonLiteral;
 
 	var _utils = __webpack_require__(5);
 
+	// Matches any character that quotedString may have to escape: quotes,
+	// backslashes, control characters, line separators, surrogates and "<". Most
+	// strings, e.g. lookup names, contain none of them and can skip the escaping.
+	// eslint-disable-next-line no-control-regex
+	var NEEDS_ESCAPING = /[\x00-\x1f\\"\u2028\u2029<\ud800-\udfff]/;
+
+	// Per HTML "Restrictions for contents of script elements": "<!--", "<script"
+	// and "</script" can end or change the parsing of an enclosing <script>
+	// element.
+	var SCRIPT_DELIMITERS = /<(?=!--|\/?script)/gi;
+
+	/**
+	 * Escape the "<" of every sequence that could end or change the parsing of
+	 * an enclosing <script> element.
+	 *
+	 * Only pass JavaScript or JSON code in which "<" can only occur inside string
+	 * literals, where "\u003C" has the same value.
+	 *
+	 * @param {string} code the code to escape
+	 * @returns {string} the escaped code
+	 */
+	function escapeScriptDelimiters(code) {
+	  return code.replace(SCRIPT_DELIMITERS, '\\u003C');
+	}
+
+	/**
+	 * Escape a UTF-16 surrogate code unit as a "\uXXXX" escape sequence.
+	 *
+	 * @param {string} surrogate a single surrogate code unit
+	 * @returns {string} the escape sequence
+	 */
+	function escapeSurrogate(surrogate) {
+	  return '\\u' + surrogate.charCodeAt(0).toString(16);
+	}
+
+	/**
+	 * Convert a value to a JSON literal that is safe to write into generated
+	 * code: valid in ES5, where line and paragraph separators end string literals,
+	 * encodable as UTF-8 on every engine, and safe inside an enclosing <script>
+	 * element.
+	 *
+	 * @param {*} value the value to convert
+	 * @returns {string} the JavaScript literal
+	 */
+
+	function safeJsonLiteral(value) {
+	  return escapeScriptDelimiters(JSON.stringify(value).replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029')
+	  // Engines before ES2019 leave lone surrogates unescaped, and those cannot
+	  // be encoded as UTF-8. Escaping paired ones as well keeps the value.
+	  .replace(/[\ud800-\udfff]/g, escapeSurrogate));
+	}
+
 	var SourceNode = undefined;
 
 	try {
@@ -5916,8 +6234,16 @@ return /******/ (function(modules) { // webpackBootstrap
 	  },
 
 	  quotedString: function quotedString(str) {
-	    return '"' + (str + '').replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\r/g, '\\r').replace(/\u2028/g, '\\u2028') // Per Ecma-262 7.3 + 7.8.4
-	    .replace(/\u2029/g, '\\u2029') + '"';
+	    str = str + '';
+	    // Fast path: quotedString runs for every lookup name and content string,
+	    // and the chain of replacements below is much slower than a single test.
+	    if (!NEEDS_ESCAPING.test(str)) {
+	      return '"' + str + '"';
+	    }
+
+	    // JSON.stringify escapes quotes, backslashes and control characters;
+	    // safeJsonLiteral adds line separators, surrogates and script delimiters.
+	    return safeJsonLiteral(str);
 	  },
 
 	  objectLiteral: function objectLiteral(obj) {
@@ -5964,7 +6290,6 @@ return /******/ (function(modules) { // webpackBootstrap
 	};
 
 	exports['default'] = CodeGen;
-	module.exports = exports['default'];
 
 /***/ })
 /******/ ])