mustache 1.1.1 → 1.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bfcec948b9e5fbd73d9c72e3ade21724d3fd73a1d2ee2ea58ab26bf7e1a341ba
-  data.tar.gz: 1a5d4d062ad29d4a4057a6489f6779d3e61bb7132ecf56fc1ab97a48bfcb926d
+  metadata.gz: bf066480926aaca95b8ebbb4e45de15a11cae753e407be03a8059bee4deb9837
+  data.tar.gz: a334278f764909eb095bed8bf31132af6c61d6dffadbf5688cd745e85517a7a6
 SHA512:
-  metadata.gz: afd9888e324611b31fb9a6ac809393b2c42261befce363ab691d68719edb2687dda2129ba64a12367bd0f39d31b1fda861b209345f2abfc06debf67aa0e3ab99
-  data.tar.gz: c225773518109b0eeeecaf89d39faaec30b951361b10c16944f4e016aec6597fc41e75237920dc8c44e00956a00edfcf1b72f2e914ea4dc3f8b296f2436977dc
+  metadata.gz: 571c5ff585457d1073fa4de0d506073b55a7c3409967d39a488b71fe38b03e7074312ad5e9e379d0f654043dc8be7ffdba4e1cb3b6df4ba6e884920885064ecd
+  data.tar.gz: cb3b39d80301b99e13e4cf412e5da3065ecf5215d7b7bece535c032e6cec5c452a0d44f43363d4d35a06a2267e67945325c177ae8631f8b19bac8f344fad2768

data/README.md

@@ -1,7 +1,7 @@
 # Mustache
 
 [![Gem Version](https://badge.fury.io/rb/mustache.svg)](http://badge.fury.io/rb/mustache)
-[![Build Status](https://travis-ci.org/mustache/mustache.svg?branch=master)](https://travis-ci.org/mustache/mustache)
+[![Test](https://github.com/mustache/mustache/actions/workflows/test.yml/badge.svg)](https://github.com/mustache/mustache/actions/workflows/test.yml)
 
 Inspired by [ctemplate][1] and [et][2], Mustache is a
 framework-agnostic way to render logic-free views.
@@ -166,8 +166,9 @@ follows the classic Ruby naming convention.
 
     TemplatePartial => ./template_partial.mustache
 
-You can set the search path using `Mustache.template_path`. It can be set on a
-class by class basis:
+You can set the search path using `Mustache.template_path`. Search multiple
+paths by delimiting them with your platform's 'path separator' (colon on Unix).
+It can be set on a class by class basis:
 
 ```ruby
 class Simple < Mustache
@@ -381,9 +382,9 @@ Once you've made your great commits:
 
 ~~To join the list simply send an email to <mustache@librelist.com>. This
 will subscribe you and send you information about your subscription,
-including unsubscribe information.
+including unsubscribe information.~~
 
-The archive can be found at <http://librelist.com/browser/mustache/>.~~
+~~The archive can be found at <http://librelist.com/browser/mustache/>.~~
 
 The mailing list hasn't been updated in quite a while, please join us on Gitter
 or IRC:

data/Rakefile

@@ -35,7 +35,7 @@ if command? :ronn
 
   desc "Build the manual"
   task "man:build" do
-    sh "ronn -br5 --organization=DEFUNKT --manual='Mustache Manual' man/*.ronn"
+    sh "ronn-ng -br5 --organization=DEFUNKT --manual='Mustache Manual' man/*.ron"
   end
 end
 

data/bin/mustache

@@ -11,7 +11,7 @@ class Mustache
     # Return a structure describing the options.
     def self.parse_options(args)
       opts = OptionParser.new do |opts|
-        opts.banner = "Usage: mustache [-c] [-t] [-e] [-r library] FILE ..."
+        opts.banner = "Usage: mustache [-c] [-t] [-l level] [-e] [-r library] FILE ..."
 
         opts.separator " "
 
@@ -42,6 +42,11 @@ class Mustache
           exit
         end
 
+        opts.on("-l", "--level",
+          "Provide a context access security level.") do |level|
+          Mustache.context_access_security_level = level.to_i
+        end
+
         opts.on("-e", "--error",
           "Raise an error on context misses.") do |e|
           Mustache.raise_on_context_miss = true

data/lib/mustache/context.rb

@@ -136,14 +136,35 @@ class Mustache
     # @return [Object] The value of key in object if it is found, and default otherwise.
     #
     def find(obj, key, default = nil)
+
+      if mustache_in_stack.context_access_security_level == 5 and !obj.instance_of?(Hash)
+        # on level 5, object must be exactly Hash
+        return context_level_violation("Detected key access attempt for a non-Hash object using '#{key}'", default)
+      end
+
       return find_in_hash(obj.to_hash, key, default) if obj.respond_to?(:to_hash)
 
+      if mustache_in_stack.context_access_security_level >= 4
+        # on levels 4 and 5, method access is not allowed
+        return context_level_violation("Detected method access attempt using '#{key}'", default)
+      end
+
       unless obj.respond_to?(key)
         # no match for the key, but it may include a hyphen, so try again replacing hyphens with underscores.
         key = key.to_s.tr('-', '_')
         return default unless obj.respond_to?(key)
       end
 
+      if mustache_in_stack.context_access_security_level >= 3 && !obj.class.instance_methods(false).include?(key.to_sym)
+        # on level 3, inherited methods are blocked
+        return context_level_violation("Detected inherited method '#{key}'", default)
+      end
+
+      if mustache_in_stack.context_access_security_level >= 2 && MethodBlacklist.include?(key.to_s)
+        # on levels 2 and 3, reflection-based methods are blacklisted
+        return context_level_violation("Detected blacklisted reflection-related key '#{key}'", default)
+      end
+
       meth = obj.method(key) rescue proc { obj.send(key) }
       meth.arity == 1 ? meth.to_proc : meth.call
     end

data/lib/mustache/context_miss.rb

@@ -11,4 +11,45 @@ class Mustache
   #
   class ContextMiss < RuntimeError;  end
 
+  # A ContextLevelViolation is raised whenever accessing a key in the context is
+  # not allowed by the selected context access security level
+  #
+  # For example, if your context access security level is set to 3 but
+  # your template tries to access an inherited method this exception will be raised.
+  #
+  # By default it is only raised for blacklisted keys in objects.
+  # See Mustache.context_access_security_level.
+  #
+  class ContextLevelViolation < ContextMiss;  end
+
+  class Context
+    # Raises ContextLevelViolation or returns default depending on raise_on_context_miss
+    #
+    # @param [String] message The error message if raise_on_context_miss is set
+    # @param [Object] default An optional default value, to return if the key is not found.
+    #
+    # @return [Object] The default value if errors are not raised
+    #
+    def context_level_violation(message, default = nil)
+      return default unless mustache_in_stack.raise_on_context_miss?
+      raise ContextLevelViolation.new(message)
+    end
+  end
+
+
+  MethodBlacklist = ["allocate", "attached_object", "superclass", "subclasses", "new", "autoload?", "autoload",
+  "included_modules", "include?", "set_temporary_name", "ancestors", "attr", "attr_reader", "attr_writer",
+  "attr_accessor", "public_instance_method", "instance_methods", "public_instance_methods",
+  "protected_instance_methods", "private_instance_methods", "undefined_instance_methods", "freeze", "const_get",
+  "constants", "const_missing", "const_defined?", "const_set", "const_source_location", "remove_class_variable",
+  "class_variable_get", "class_variables", "private_constant", "class_variable_set", "class_variable_defined?",
+  "public_constant", "include", "deprecate_constant", "singleton_class?", "prepend", "refinements", "define_method",
+  "module_exec", "class_exec", "module_eval", "class_eval", "remove_method", "undef_method", "alias_method",
+  "method_defined?", "public_method_defined?", "private_method_defined?", "protected_method_defined?",
+  "public_class_method", "private_class_method", "instance_method", "singleton_class", "dup", "itself", "methods",
+  "singleton_methods", "protected_methods", "private_methods", "public_methods", "instance_variables",
+  "instance_variable_get", "instance_variable_set", "instance_variable_defined?", "remove_instance_variable",
+  "instance_of?", "kind_of?", "is_a?", "display", "public_send", "extend", "clone", "class", "frozen?", "tap",
+  "then", "yield_self", "respond_to?", "method", "public_method", "singleton_method", "define_singleton_method",
+  "hash", "object_id", "send", "enum_for", "__send__", "instance_eval", "instance_exec", "__id__"]
 end

data/lib/mustache/generator.rb

@@ -88,7 +88,7 @@ class Mustache
     def compile!(exp)
       case exp.first
       when :multi
-        exp[1..-1].reduce("") { |sum, e| sum << compile!(e) }
+        exp[1..-1].reduce("".dup) { |sum, e| sum << compile!(e) }
       when :static
         str(exp[1])
       when :mustache
@@ -151,7 +151,7 @@ class Mustache
       # what's inside.
       ev(<<-compiled)
       v = #{compile!(name)}
-      if v.nil? || v == false || v.respond_to?(:empty?) && v.empty?
+      if v.nil? || v == false || (v.class != String && v.respond_to?(:empty?) && v.empty?)
         #{code}
       end
       compiled

data/lib/mustache/parser.rb

@@ -78,7 +78,7 @@ EOF
     SKIP_WHITESPACE = [ '#', '^', '/', '<', '>', '=', '!' ].map(&:freeze)
 
     # The content allowed in a tag name.
-    ALLOWED_CONTENT = /(\w|[?!\/.-])*/
+    ALLOWED_CONTENT = /(\w|[?!\/.@-])*/
 
     # These types of tags allow any content,
     # the rest only allow ALLOWED_CONTENT.

data/lib/mustache/settings.rb

@@ -9,6 +9,7 @@ class Mustache
     @template_name = nil
     @template_file = nil
     @raise_on_context_miss = nil
+    @context_access_security_level = 2
   end
 
   def self.initialize_settings
@@ -18,6 +19,7 @@ class Mustache
     @template_name = nil
     @template_file = nil
     @raise_on_context_miss = nil
+    @context_access_security_level = 2
   end
 
   initialize_settings
@@ -31,38 +33,43 @@ class Mustache
   #
 
   # The template path informs your Mustache view where to look for its
-  # corresponding template. By default it's the current directory (".")
+  # corresponding template. It is an array of paths, by default containing
+  # one entry:  the current directory (".")
+  # When setting up from a string, use path delimiters to create a search path
+  # When the template_file is requested, a search is done to find the file in the
+  # path, this is then stored as the name.
   #
   # A class named Stat with a template_path of "app/templates" will look
   # for "app/templates/stat.mustache"
 
+  def self.setup_path path
+    path = path.split(File::PATH_SEPARATOR) if path.is_a? String
+    path.map{|p| File.expand_path(p)}
+  end
+
   def self.template_path
-    @template_path ||= inheritable_config_for :template_path, '.'
+    @template_path ||= setup_path(inheritable_config_for(:template_path, '.'))
   end
 
   def self.template_path=(path)
-    @template_path = File.expand_path(path)
+    @template_path = setup_path(path)
     @template = nil
   end
 
   def template_path
     @template_path ||= self.class.template_path
   end
+
   alias_method :path, :template_path
 
   def template_path=(path)
-    @template_path = File.expand_path(path)
+    @template_path = self.class.setup_path(path)
     @template = nil
   end
 
-  # Alias for `template_path`
-  def self.path
-    template_path
-  end
-
-  # Alias for `template_path`
-  def self.path=(path)
-    self.template_path = path
+  class << self
+    alias_method :path, :template_path
+    alias_method :path=, :template_path=
   end
 
 
@@ -128,26 +135,25 @@ class Mustache
   # Template File
   #
 
-  # The template file is the absolute path of the file Mustache will
-  # use as its template. By default it's ./class_name.mustache
+  # The template file is the absolute path of the file Mustache will use as its template.
+  # By default it's ./class_name.mustache
+  #
 
   def self.template_file
-    @template_file || "#{path}/#{template_name}.#{template_extension}"
+    @template_file || path.map{|p| "#{p}/#{template_name}.#{template_extension}" }.find{|tf| File.readable? tf}
   end
 
-  def self.template_file=(template_file)
-    @template_file = template_file
+  def self.template_file=(tf)
+    @template_file = tf
     @template = nil
   end
 
-  # The template file is the absolute path of the file Mustache will
-  # use as its template. By default it's ./class_name.mustache
   def template_file
-    @template_file || "#{path}/#{template_name}.#{template_extension}"
+    @template_file || path.map{|p| "#{p}/#{template_name}.#{template_extension}" }.find{|tf| File.readable? tf}
   end
 
-  def template_file=(template_file)
-    @template_file = template_file
+  def template_file=(tf)
+    @template_file = tf
     @template = nil
   end
 
@@ -214,6 +220,37 @@ class Mustache
     @raise_on_context_miss = boolean
   end
 
+  #
+  # Context access security level
+  #
+
+  # What object methods could be accessed from the template?
+  # This level determines the security restrictions for method access to protect against unsafe reflection
+  # Possible values are integers from 1 to 5:
+  #
+  # 1 - All methods allowed (use only with trusted templates)
+  # 2 - Reflection-related methods are blacklisted (default)
+  # 3 - All inherited or reflection-related methods are prohibited
+  # 4 - Access allowed only for Hash elements
+  # 5 - Access allowed only for Hash elements, only numbers, strings, hashes and functions allowed
+
+  def self.context_access_security_level
+    @context_access_security_level
+  end
+
+  def self.context_access_security_level=(integer)
+    @context_access_security_level = integer
+  end
+
+  # Instance level version of `Mustache.context_access_security_level`
+  def context_access_security_level
+    self.class.context_access_security_level || @context_access_security_level
+  end
+
+  def context_access_security_level=(integer)
+    @context_access_security_level = integer
+  end
+
 
   #
   # View Namespace

data/lib/mustache/utils.rb

@@ -22,7 +22,7 @@ class Mustache
           .split('::')
           .map do |part|
             part[0] = part[0].downcase
-            part.gsub(/[A-Z]/) { |s| "_" << s.downcase }
+            part.gsub(/[A-Z]/) { |s| '_'.dup << s.downcase }
           end
           .join('/')
       end

data/lib/mustache/version.rb

@@ -1,3 +1,3 @@
 class Mustache
-  VERSION = '1.1.1'
+  VERSION = '1.1.3'
 end

data/lib/mustache.rb

@@ -187,14 +187,11 @@ class Mustache
   # reading templates from a database. It will be rendered by the
   # context, so all you need to do is return a string.
   def partial(name)
-    path = "#{template_path}/#{name}.#{template_extension}"
+    partialpath = template_path.map{|p| "#{p}/#{name}.#{template_extension}" }.find{|pf| File.readable? pf}
 
-    begin
-      File.read(path)
-    rescue
-      raise if raise_on_context_miss?
-      ""
-    end
+    raise RuntimeError.new("Can't find partial #{name}") if not partialpath and raise_on_context_miss?
+
+    partialpath ? File.read(partialpath) : ""
   end
 
   # Override this to provide custom escaping.