mustache 0.99.4 → 1.1.3

data/lib/mustache/context.rb

@@ -1,20 +1,19 @@
+require 'mustache/context_miss'
+
 class Mustache
-  # A ContextMiss is raised whenever a tag's target can not be found
-  # in the current context if `Mustache#raise_on_context_miss?` is
-  # set to true.
-  #
-  # For example, if your View class does not respond to `music` but
-  # your template contains a `{{music}}` tag this exception will be raised.
-  #
-  # By default it is not raised. See Mustache.raise_on_context_miss.
-  class ContextMiss < RuntimeError;  end
 
   # A Context represents the context which a Mustache template is
   # executed within. All Mustache tags reference keys in the Context.
+  #
   class Context
-    # Expect to be passed an instance of `Mustache`.
+
+    # Initializes a Mustache::Context.
+    #
+    # @param [Mustache] mustache A Mustache instance.
+    #
     def initialize(mustache)
       @stack = [mustache]
+      @partial_template_cache = {}
     end
 
     # A {{>partial}} tag translates into a call to the context's
@@ -23,6 +22,7 @@ class Mustache
     # If the Mustache view handling the rendering (e.g. the view
     # representing your profile page or some other template) responds
     # to `partial`, we call it and render the result.
+    #
     def partial(name, indentation = '')
       # Look for the first Mustache in the stack.
       mustache = mustache_in_stack
@@ -30,38 +30,55 @@ class Mustache
       # Indent the partial template by the given indentation.
       part = mustache.partial(name).to_s.gsub(/^/, indentation)
 
-      # Call the Mustache's `partial` method and render the result.
-      result = mustache.render(part, self)
+      # Get a template object for the partial and render the result.
+      template_for_partial(part).render(self)
+    end
+
+    def template_for_partial(partial)
+      @partial_template_cache[partial] ||= Template.new(partial)
     end
 
-    # Find the first Mustache in the stack. If we're being rendered
-    # inside a Mustache object as a context, we'll use that one.
+    # Find the first Mustache in the stack.
+    #
+    # If we're being rendered inside a Mustache object as a context,
+    # we'll use that one.
+    #
+    # @return [Mustache] First Mustache in the stack.
+    #
     def mustache_in_stack
-      @stack.detect { |frame| frame.is_a?(Mustache) }
+      @mustache_in_stack ||= @stack.find { |frame| frame.is_a?(Mustache) }
     end
 
     # Allows customization of how Mustache escapes things.
     #
-    # Returns a String.
-    def escapeHTML(str)
-      mustache_in_stack.escapeHTML(str)
+    # @param [Object] value Value to escape.
+    #
+    # @return [String] Escaped string.
+    #
+    def escape(value)
+      mustache_in_stack.escape(value)
     end
 
     # Adds a new object to the context's internal stack.
     #
-    # Returns the Context.
-    def push(new)
-      @stack.unshift(new)
+    # @param [Object] new_obj Object to be added to the internal stack.
+    #
+    # @return [Context] Returns the Context.
+    #
+    def push(new_obj)
+      @stack.unshift(new_obj)
+      @mustache_in_stack = nil
       self
     end
-    alias_method :update, :push
 
     # Removes the most recently added object from the context's
     # internal stack.
     #
-    # Returns the Context.
+    # @return [Context] Returns the Context.
+    #
     def pop
       @stack.shift
+      @mustache_in_stack = nil
       self
     end
 
@@ -80,7 +97,7 @@ class Mustache
     # Do we know about a particular key? In other words, will calling
     # `context[key]` give us a result that was set. Basically.
     def has_key?(key)
-      !!fetch(key)
+      fetch(key, false)
     rescue ContextMiss
       false
     end
@@ -97,9 +114,7 @@ class Mustache
         next if frame == self
 
         value = find(frame, name, :__missing)
-        if value != :__missing
-          return value
-        end
+        return value if :__missing != value
       end
 
       if default == :__raise || mustache_in_stack.raise_on_context_miss?
@@ -114,28 +129,65 @@ class Mustache
     # If it's an object that responds to the key as a method call,
     # invokes that method. You get the idea.
     #
-    #     obj - The object to perform the lookup on.
-    #     key - The key whose value you want.
-    # default - An optional default value, to return if the
-    #           key is not found.
+    # @param [Object] obj The object to perform the lookup on.
+    # @param [String,Symbol] key The key whose value you want
+    # @param [Object] default An optional default value, to return if the key is not found.
+    #
+    # @return [Object] The value of key in object if it is found, and default otherwise.
     #
-    # Returns the value of key in obj if it is found and default otherwise.
     def find(obj, key, default = nil)
-      hash = obj.respond_to?(:has_key?)
-
-      if hash && obj.has_key?(key)
-        obj[key]
-      elsif hash && obj.has_key?(key.to_s)
-        obj[key.to_s]
-      elsif !hash && obj.respond_to?(key)
-        meth = obj.method(key) rescue proc { obj.send(key) }
-        if meth.arity == 1
-          meth.to_proc
-        else
-          meth[]
-        end
+
+      if mustache_in_stack.context_access_security_level == 5 and !obj.instance_of?(Hash)
+        # on level 5, object must be exactly Hash
+        return context_level_violation("Detected key access attempt for a non-Hash object using '#{key}'", default)
+      end
+
+      return find_in_hash(obj.to_hash, key, default) if obj.respond_to?(:to_hash)
+
+      if mustache_in_stack.context_access_security_level >= 4
+        # on levels 4 and 5, method access is not allowed
+        return context_level_violation("Detected method access attempt using '#{key}'", default)
+      end
+
+      unless obj.respond_to?(key)
+        # no match for the key, but it may include a hyphen, so try again replacing hyphens with underscores.
+        key = key.to_s.tr('-', '_')
+        return default unless obj.respond_to?(key)
+      end
+
+      if mustache_in_stack.context_access_security_level >= 3 && !obj.class.instance_methods(false).include?(key.to_sym)
+        # on level 3, inherited methods are blocked
+        return context_level_violation("Detected inherited method '#{key}'", default)
+      end
+
+      if mustache_in_stack.context_access_security_level >= 2 && MethodBlacklist.include?(key.to_s)
+        # on levels 2 and 3, reflection-based methods are blacklisted
+        return context_level_violation("Detected blacklisted reflection-related key '#{key}'", default)
+      end
+
+      meth = obj.method(key) rescue proc { obj.send(key) }
+      meth.arity == 1 ? meth.to_proc : meth.call
+    end
+
+    def current
+      @stack.first
+    end
+
+
+    private
+
+    # Fetches a hash key if it exists, or returns the given default.
+    def find_in_hash(obj, key, default)
+      return obj[key]      if obj.has_key?(key)
+      return obj[key.to_s] if obj.has_key?(key.to_s)
+      return obj[key]      if obj.respond_to?(:default_proc) && obj.default_proc && obj[key]
+
+      # If default is :__missing then we are from #fetch which is hunting through the stack
+      # If default is nil then we are reducing dot notation
+      if :__missing != default && mustache_in_stack.raise_on_context_miss?
+        raise ContextMiss.new("Can't find #{key} in #{obj}")
       else
-        default
+        obj.fetch(key, default)
       end
     end
   end

data/lib/mustache/context_miss.rb

@@ -0,0 +1,55 @@
+class Mustache
+
+  # A ContextMiss is raised whenever a tag's target can not be found
+  # in the current context if `Mustache#raise_on_context_miss?` is
+  # set to true.
+  #
+  # For example, if your View class does not respond to `music` but
+  # your template contains a `{{music}}` tag this exception will be raised.
+  #
+  # By default it is not raised. See Mustache.raise_on_context_miss.
+  #
+  class ContextMiss < RuntimeError;  end
+
+  # A ContextLevelViolation is raised whenever accessing a key in the context is
+  # not allowed by the selected context access security level
+  #
+  # For example, if your context access security level is set to 3 but
+  # your template tries to access an inherited method this exception will be raised.
+  #
+  # By default it is only raised for blacklisted keys in objects.
+  # See Mustache.context_access_security_level.
+  #
+  class ContextLevelViolation < ContextMiss;  end
+
+  class Context
+    # Raises ContextLevelViolation or returns default depending on raise_on_context_miss
+    #
+    # @param [String] message The error message if raise_on_context_miss is set
+    # @param [Object] default An optional default value, to return if the key is not found.
+    #
+    # @return [Object] The default value if errors are not raised
+    #
+    def context_level_violation(message, default = nil)
+      return default unless mustache_in_stack.raise_on_context_miss?
+      raise ContextLevelViolation.new(message)
+    end
+  end
+
+
+  MethodBlacklist = ["allocate", "attached_object", "superclass", "subclasses", "new", "autoload?", "autoload",
+  "included_modules", "include?", "set_temporary_name", "ancestors", "attr", "attr_reader", "attr_writer",
+  "attr_accessor", "public_instance_method", "instance_methods", "public_instance_methods",
+  "protected_instance_methods", "private_instance_methods", "undefined_instance_methods", "freeze", "const_get",
+  "constants", "const_missing", "const_defined?", "const_set", "const_source_location", "remove_class_variable",
+  "class_variable_get", "class_variables", "private_constant", "class_variable_set", "class_variable_defined?",
+  "public_constant", "include", "deprecate_constant", "singleton_class?", "prepend", "refinements", "define_method",
+  "module_exec", "class_exec", "module_eval", "class_eval", "remove_method", "undef_method", "alias_method",
+  "method_defined?", "public_method_defined?", "private_method_defined?", "protected_method_defined?",
+  "public_class_method", "private_class_method", "instance_method", "singleton_class", "dup", "itself", "methods",
+  "singleton_methods", "protected_methods", "private_methods", "public_methods", "instance_variables",
+  "instance_variable_get", "instance_variable_set", "instance_variable_defined?", "remove_instance_variable",
+  "instance_of?", "kind_of?", "is_a?", "display", "public_send", "extend", "clone", "class", "frozen?", "tap",
+  "then", "yield_self", "respond_to?", "method", "public_method", "singleton_method", "define_singleton_method",
+  "hash", "object_id", "send", "enum_for", "__send__", "instance_eval", "instance_exec", "__id__"]
+end

data/lib/mustache/enumerable.rb

@@ -0,0 +1,3 @@
+class Mustache
+  Enumerable = Module.new
+end

data/lib/mustache/generator.rb

@@ -27,9 +27,10 @@ class Mustache
   #   $ mustache --compile test.mustache
   #   "Hi #{CGI.escapeHTML(ctx[:thing].to_s)}!\n"
   class Generator
-    # Options are unused for now but may become useful in the future.
+    # Options can be used to manipulate the resulting ruby code string behavior.
     def initialize(options = {})
       @options = options
+      @option_static_lambdas = options[:static_lambdas] == true
     end
 
     # Given an array of tokens, returns an interpolatable Ruby string.
@@ -37,6 +38,10 @@ class Mustache
       "\"#{compile!(exp)}\""
     end
 
+
+    private
+
+
     # Given an array of tokens, converts them into Ruby code. In
     # particular there are three types of expressions we are concerned
     # with:
@@ -64,21 +69,26 @@ class Mustache
     #
     #   [:multi,
     #    [:static, "Hello "],
-    #    [:mustache, :etag, "name"],
+    #    [:mustache, :etag,
+    #     [:mustache, :fetch, ["name"]]],
     #    [:static, "\nYou have just won $"],
-    #    [:mustache, :etag, "value"],
-    #    [:static, "!\n"],
-    #    [:mustache,
-    #     :section,
-    #     "in_ca",
-    #     [:multi,
-    #      [:static, "Well, $"],
-    #      [:mustache, :etag, "taxed_value"],
-    #      [:static, ", after taxes.\n"]]]]
+    #   [:mustache, :etag,
+    #    [:mustache, :fetch, ["value"]]],
+    #   [:static, "!\n"],
+    #   [:mustache,
+    #    :section,
+    #    [:mustache, :fetch, ["in_ca"]],
+    #   [:multi,
+    #    [:static, "Well, $"],
+    #    [:mustache, :etag,
+    #     [:mustache, :fetch, ["taxed_value"]]],
+    #    [:static, ", after taxes.\n"]],
+    #    "Well, ${{taxed_value}}, after taxes.\n",
+    #    ["{{", "}}"]]]
     def compile!(exp)
       case exp.first
       when :multi
-        exp[1..-1].map { |e| compile!(e) }.join
+        exp[1..-1].reduce("".dup) { |sum, e| sum << compile!(e) }
       when :static
         str(exp[1])
       when :mustache
@@ -90,38 +100,49 @@ class Mustache
 
     # Callback fired when the compiler finds a section token. We're
     # passed the section name and the array of tokens.
-    def on_section(name, content, raw, delims)
+    def on_section(name, offset, content, raw, delims)
       # Convert the tokenized content of this section into a Ruby
       # string we can use.
       code = compile(content)
 
-      # Compile the Ruby for this section now that we know what's
-      # inside the section.
-      ev(<<-compiled)
-      if v = #{compile!(name)}
-        if v == true
-          #{code}
-        elsif v.is_a?(Proc)
+      # Lambda handling - default handling is to dynamically interpret
+      # the returned lambda result as mustache source
+      proc_handling = if @option_static_lambdas
+        <<-compiled
+          v.call(lambda {|v| #{code}}.call(v)).to_s
+        compiled
+      else
+        <<-compiled
           t = Mustache::Template.new(v.call(#{raw.inspect}).to_s)
           def t.tokens(src=@source)
-            p = Parser.new
+            p = Mustache::Parser.new
             p.otag, p.ctag = #{delims.inspect}
             p.compile(src)
           end
           t.render(ctx.dup)
-        else
-          # Shortcut when passed non-array
-          v = [v] unless v.is_a?(Array) || defined?(Enumerator) && v.is_a?(Enumerator)
+        compiled
+      end
 
-          v.map { |h| ctx.push(h); r = #{code}; ctx.pop; r }.join
-        end
+      # Compile the Ruby for this section now that we know what's
+      # inside the section.
+      ev(<<-compiled)
+      case v = #{compile!(name)}
+      when NilClass, FalseClass
+      when TrueClass
+        #{code}
+      when Proc
+        #{proc_handling}
+      when Array, Enumerator, Mustache::Enumerable
+        v.map { |_| ctx.push(_); r = #{code}; ctx.pop; r }.join
+      else
+        ctx.push(v); r = #{code}; ctx.pop; r
       end
       compiled
     end
 
     # Fired when we find an inverted section. Just like `on_section`,
     # we're passed the inverted section name and the array of tokens.
-    def on_inverted_section(name, content, raw, _)
+    def on_inverted_section(name, offset, content, raw, delims)
       # Convert the tokenized content of this section into a Ruby
       # string we can use.
       code = compile(content)
@@ -130,7 +151,7 @@ class Mustache
       # what's inside.
       ev(<<-compiled)
       v = #{compile!(name)}
-      if v.nil? || v == false || v.respond_to?(:empty?) && v.empty?
+      if v.nil? || v == false || (v.class != String && v.respond_to?(:empty?) && v.empty?)
         #{code}
       end
       compiled
@@ -139,45 +160,45 @@ class Mustache
     # Fired when the compiler finds a partial. We want to return code
     # which calls a partial at runtime instead of expanding and
     # including the partial's body to allow for recursive partials.
-    def on_partial(name, indentation)
+    def on_partial(name, offset, indentation)
       ev("ctx.partial(#{name.to_sym.inspect}, #{indentation.inspect})")
     end
 
     # An unescaped tag.
-    def on_utag(name)
+    def on_utag(name, offset)
       ev(<<-compiled)
         v = #{compile!(name)}
         if v.is_a?(Proc)
-          v = Mustache::Template.new(v.call.to_s).render(ctx.dup)
+          v = #{@option_static_lambdas ? 'v.call' : 'Mustache::Template.new(v.call.to_s).render(ctx.dup)'}
         end
         v.to_s
       compiled
     end
 
     # An escaped tag.
-    def on_etag(name)
+    def on_etag(name, offset)
       ev(<<-compiled)
         v = #{compile!(name)}
         if v.is_a?(Proc)
-          v = Mustache::Template.new(v.call.to_s).render(ctx.dup)
+          v = #{@option_static_lambdas ? 'v.call' : 'Mustache::Template.new(v.call.to_s).render(ctx.dup)'}
         end
-        ctx.escapeHTML(v.to_s)
+        ctx.escape(v)
       compiled
     end
 
     def on_fetch(names)
+      return "ctx.current" if names.empty?
+
       names = names.map { |n| n.to_sym }
 
-      if names.length == 0
-        "ctx[:to_s]"
-      elsif names.length == 1
-        "ctx[#{names.first.to_sym.inspect}]"
+      initial, *rest = names
+      if rest.any?
+        <<-compiled
+          #{rest.inspect}.reduce(ctx[#{initial.inspect}]) { |value, key| value && ctx.find(value, key) }
+        compiled
       else
-        initial, *rest = names
         <<-compiled
-          #{rest.inspect}.inject(ctx[#{initial.inspect}]) { |value, key|
-            value && ctx.find(value, key)
-          }
+          ctx[#{initial.inspect}]
         compiled
       end
     end