mustache 1.1.2 → 1.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e598c073f543841b69a2384f922a006d8f30ea469b59ffb7400ce6a16970a58
-  data.tar.gz: 824baa455f2eeaab4952424cbf84e88eb983ef4559d1a78e27caf2f249d0200d
+  metadata.gz: bf066480926aaca95b8ebbb4e45de15a11cae753e407be03a8059bee4deb9837
+  data.tar.gz: a334278f764909eb095bed8bf31132af6c61d6dffadbf5688cd745e85517a7a6
 SHA512:
-  metadata.gz: '02199b9d2d753dad273b70dc41019b10732a904002273f5f7677929574a2301bc235ad4028bf6c4157aaeb127b9766e79e9e43afd7ec4a0f625a9c4273223ad6'
-  data.tar.gz: e643d2c2f06222d751bdd6f6b26a3f1d88bd8bca9be050895a8057b3d36e2d43338bd28f31ead374c9c918a0e409d70b9cb1664771552c13b7b9c159dd6042da
+  metadata.gz: 571c5ff585457d1073fa4de0d506073b55a7c3409967d39a488b71fe38b03e7074312ad5e9e379d0f654043dc8be7ffdba4e1cb3b6df4ba6e884920885064ecd
+  data.tar.gz: cb3b39d80301b99e13e4cf412e5da3065ecf5215d7b7bece535c032e6cec5c452a0d44f43363d4d35a06a2267e67945325c177ae8631f8b19bac8f344fad2768

data/README.md

@@ -1,7 +1,7 @@
 # Mustache
 
 [![Gem Version](https://badge.fury.io/rb/mustache.svg)](http://badge.fury.io/rb/mustache)
-[![Build Status](https://travis-ci.org/mustache/mustache.svg?branch=master)](https://travis-ci.org/mustache/mustache)
+[![Test](https://github.com/mustache/mustache/actions/workflows/test.yml/badge.svg)](https://github.com/mustache/mustache/actions/workflows/test.yml)
 
 Inspired by [ctemplate][1] and [et][2], Mustache is a
 framework-agnostic way to render logic-free views.
@@ -166,8 +166,9 @@ follows the classic Ruby naming convention.
 
     TemplatePartial => ./template_partial.mustache
 
-You can set the search path using `Mustache.template_path`. It can be set on a
-class by class basis:
+You can set the search path using `Mustache.template_path`. Search multiple
+paths by delimiting them with your platform's 'path separator' (colon on Unix).
+It can be set on a class by class basis:
 
 ```ruby
 class Simple < Mustache
@@ -381,9 +382,9 @@ Once you've made your great commits:
 
 ~~To join the list simply send an email to <mustache@librelist.com>. This
 will subscribe you and send you information about your subscription,
-including unsubscribe information.
+including unsubscribe information.~~
 
-The archive can be found at <http://librelist.com/browser/mustache/>.~~
+~~The archive can be found at <http://librelist.com/browser/mustache/>.~~
 
 The mailing list hasn't been updated in quite a while, please join us on Gitter
 or IRC:

data/Rakefile

@@ -35,7 +35,7 @@ if command? :ronn
 
   desc "Build the manual"
   task "man:build" do
-    sh "ronn -br5 --organization=DEFUNKT --manual='Mustache Manual' man/*.ron"
+    sh "ronn-ng -br5 --organization=DEFUNKT --manual='Mustache Manual' man/*.ron"
   end
 end
 

data/bin/mustache

@@ -11,7 +11,7 @@ class Mustache
     # Return a structure describing the options.
     def self.parse_options(args)
       opts = OptionParser.new do |opts|
-        opts.banner = "Usage: mustache [-c] [-t] [-e] [-r library] FILE ..."
+        opts.banner = "Usage: mustache [-c] [-t] [-l level] [-e] [-r library] FILE ..."
 
         opts.separator " "
 
@@ -42,6 +42,11 @@ class Mustache
           exit
         end
 
+        opts.on("-l", "--level",
+          "Provide a context access security level.") do |level|
+          Mustache.context_access_security_level = level.to_i
+        end
+
         opts.on("-e", "--error",
           "Raise an error on context misses.") do |e|
           Mustache.raise_on_context_miss = true

data/lib/mustache/context.rb

@@ -136,14 +136,35 @@ class Mustache
     # @return [Object] The value of key in object if it is found, and default otherwise.
     #
     def find(obj, key, default = nil)
+
+      if mustache_in_stack.context_access_security_level == 5 and !obj.instance_of?(Hash)
+        # on level 5, object must be exactly Hash
+        return context_level_violation("Detected key access attempt for a non-Hash object using '#{key}'", default)
+      end
+
       return find_in_hash(obj.to_hash, key, default) if obj.respond_to?(:to_hash)
 
+      if mustache_in_stack.context_access_security_level >= 4
+        # on levels 4 and 5, method access is not allowed
+        return context_level_violation("Detected method access attempt using '#{key}'", default)
+      end
+
       unless obj.respond_to?(key)
         # no match for the key, but it may include a hyphen, so try again replacing hyphens with underscores.
         key = key.to_s.tr('-', '_')
         return default unless obj.respond_to?(key)
       end
 
+      if mustache_in_stack.context_access_security_level >= 3 && !obj.class.instance_methods(false).include?(key.to_sym)
+        # on level 3, inherited methods are blocked
+        return context_level_violation("Detected inherited method '#{key}'", default)
+      end
+
+      if mustache_in_stack.context_access_security_level >= 2 && MethodBlacklist.include?(key.to_s)
+        # on levels 2 and 3, reflection-based methods are blacklisted
+        return context_level_violation("Detected blacklisted reflection-related key '#{key}'", default)
+      end
+
       meth = obj.method(key) rescue proc { obj.send(key) }
       meth.arity == 1 ? meth.to_proc : meth.call
     end

data/lib/mustache/context_miss.rb

@@ -11,4 +11,45 @@ class Mustache
   #
   class ContextMiss < RuntimeError;  end
 
+  # A ContextLevelViolation is raised whenever accessing a key in the context is
+  # not allowed by the selected context access security level
+  #
+  # For example, if your context access security level is set to 3 but
+  # your template tries to access an inherited method this exception will be raised.
+  #
+  # By default it is only raised for blacklisted keys in objects.
+  # See Mustache.context_access_security_level.
+  #
+  class ContextLevelViolation < ContextMiss;  end
+
+  class Context
+    # Raises ContextLevelViolation or returns default depending on raise_on_context_miss
+    #
+    # @param [String] message The error message if raise_on_context_miss is set
+    # @param [Object] default An optional default value, to return if the key is not found.
+    #
+    # @return [Object] The default value if errors are not raised
+    #
+    def context_level_violation(message, default = nil)
+      return default unless mustache_in_stack.raise_on_context_miss?
+      raise ContextLevelViolation.new(message)
+    end
+  end
+
+
+  MethodBlacklist = ["allocate", "attached_object", "superclass", "subclasses", "new", "autoload?", "autoload",
+  "included_modules", "include?", "set_temporary_name", "ancestors", "attr", "attr_reader", "attr_writer",
+  "attr_accessor", "public_instance_method", "instance_methods", "public_instance_methods",
+  "protected_instance_methods", "private_instance_methods", "undefined_instance_methods", "freeze", "const_get",
+  "constants", "const_missing", "const_defined?", "const_set", "const_source_location", "remove_class_variable",
+  "class_variable_get", "class_variables", "private_constant", "class_variable_set", "class_variable_defined?",
+  "public_constant", "include", "deprecate_constant", "singleton_class?", "prepend", "refinements", "define_method",
+  "module_exec", "class_exec", "module_eval", "class_eval", "remove_method", "undef_method", "alias_method",
+  "method_defined?", "public_method_defined?", "private_method_defined?", "protected_method_defined?",
+  "public_class_method", "private_class_method", "instance_method", "singleton_class", "dup", "itself", "methods",
+  "singleton_methods", "protected_methods", "private_methods", "public_methods", "instance_variables",
+  "instance_variable_get", "instance_variable_set", "instance_variable_defined?", "remove_instance_variable",
+  "instance_of?", "kind_of?", "is_a?", "display", "public_send", "extend", "clone", "class", "frozen?", "tap",
+  "then", "yield_self", "respond_to?", "method", "public_method", "singleton_method", "define_singleton_method",
+  "hash", "object_id", "send", "enum_for", "__send__", "instance_eval", "instance_exec", "__id__"]
 end

data/lib/mustache/generator.rb

@@ -151,7 +151,7 @@ class Mustache
       # what's inside.
       ev(<<-compiled)
       v = #{compile!(name)}
-      if v.nil? || v == false || v.respond_to?(:empty?) && v.empty?
+      if v.nil? || v == false || (v.class != String && v.respond_to?(:empty?) && v.empty?)
         #{code}
       end
       compiled

data/lib/mustache/parser.rb

@@ -78,7 +78,7 @@ EOF
     SKIP_WHITESPACE = [ '#', '^', '/', '<', '>', '=', '!' ].map(&:freeze)
 
     # The content allowed in a tag name.
-    ALLOWED_CONTENT = /(\w|[?!\/.-])*/
+    ALLOWED_CONTENT = /(\w|[?!\/.@-])*/
 
     # These types of tags allow any content,
     # the rest only allow ALLOWED_CONTENT.

data/lib/mustache/settings.rb

@@ -9,6 +9,7 @@ class Mustache
     @template_name = nil
     @template_file = nil
     @raise_on_context_miss = nil
+    @context_access_security_level = 2
   end
 
   def self.initialize_settings
@@ -18,6 +19,7 @@ class Mustache
     @template_name = nil
     @template_file = nil
     @raise_on_context_miss = nil
+    @context_access_security_level = 2
   end
 
   initialize_settings
@@ -31,38 +33,43 @@ class Mustache
   #
 
   # The template path informs your Mustache view where to look for its
-  # corresponding template. By default it's the current directory (".")
+  # corresponding template. It is an array of paths, by default containing
+  # one entry:  the current directory (".")
+  # When setting up from a string, use path delimiters to create a search path
+  # When the template_file is requested, a search is done to find the file in the
+  # path, this is then stored as the name.
   #
   # A class named Stat with a template_path of "app/templates" will look
   # for "app/templates/stat.mustache"
 
+  def self.setup_path path
+    path = path.split(File::PATH_SEPARATOR) if path.is_a? String
+    path.map{|p| File.expand_path(p)}
+  end
+
   def self.template_path
-    @template_path ||= inheritable_config_for :template_path, '.'
+    @template_path ||= setup_path(inheritable_config_for(:template_path, '.'))
   end
 
   def self.template_path=(path)
-    @template_path = File.expand_path(path)
+    @template_path = setup_path(path)
     @template = nil
   end
 
   def template_path
     @template_path ||= self.class.template_path
   end
+
   alias_method :path, :template_path
 
   def template_path=(path)
-    @template_path = File.expand_path(path)
+    @template_path = self.class.setup_path(path)
     @template = nil
   end
 
-  # Alias for `template_path`
-  def self.path
-    template_path
-  end
-
-  # Alias for `template_path`
-  def self.path=(path)
-    self.template_path = path
+  class << self
+    alias_method :path, :template_path
+    alias_method :path=, :template_path=
   end
 
 
@@ -128,26 +135,25 @@ class Mustache
   # Template File
   #
 
-  # The template file is the absolute path of the file Mustache will
-  # use as its template. By default it's ./class_name.mustache
+  # The template file is the absolute path of the file Mustache will use as its template.
+  # By default it's ./class_name.mustache
+  #
 
   def self.template_file
-    @template_file || "#{path}/#{template_name}.#{template_extension}"
+    @template_file || path.map{|p| "#{p}/#{template_name}.#{template_extension}" }.find{|tf| File.readable? tf}
   end
 
-  def self.template_file=(template_file)
-    @template_file = template_file
+  def self.template_file=(tf)
+    @template_file = tf
     @template = nil
   end
 
-  # The template file is the absolute path of the file Mustache will
-  # use as its template. By default it's ./class_name.mustache
   def template_file
-    @template_file || "#{path}/#{template_name}.#{template_extension}"
+    @template_file || path.map{|p| "#{p}/#{template_name}.#{template_extension}" }.find{|tf| File.readable? tf}
   end
 
-  def template_file=(template_file)
-    @template_file = template_file
+  def template_file=(tf)
+    @template_file = tf
     @template = nil
   end
 
@@ -214,6 +220,37 @@ class Mustache
     @raise_on_context_miss = boolean
   end
 
+  #
+  # Context access security level
+  #
+
+  # What object methods could be accessed from the template?
+  # This level determines the security restrictions for method access to protect against unsafe reflection
+  # Possible values are integers from 1 to 5:
+  #
+  # 1 - All methods allowed (use only with trusted templates)
+  # 2 - Reflection-related methods are blacklisted (default)
+  # 3 - All inherited or reflection-related methods are prohibited
+  # 4 - Access allowed only for Hash elements
+  # 5 - Access allowed only for Hash elements, only numbers, strings, hashes and functions allowed
+
+  def self.context_access_security_level
+    @context_access_security_level
+  end
+
+  def self.context_access_security_level=(integer)
+    @context_access_security_level = integer
+  end
+
+  # Instance level version of `Mustache.context_access_security_level`
+  def context_access_security_level
+    self.class.context_access_security_level || @context_access_security_level
+  end
+
+  def context_access_security_level=(integer)
+    @context_access_security_level = integer
+  end
+
 
   #
   # View Namespace

data/lib/mustache/version.rb

@@ -1,3 +1,3 @@
 class Mustache
-  VERSION = '1.1.2'
+  VERSION = '1.1.3'
 end

data/lib/mustache.rb

@@ -187,14 +187,11 @@ class Mustache
   # reading templates from a database. It will be rendered by the
   # context, so all you need to do is return a string.
   def partial(name)
-    path = "#{template_path}/#{name}.#{template_extension}"
+    partialpath = template_path.map{|p| "#{p}/#{name}.#{template_extension}" }.find{|pf| File.readable? pf}
 
-    begin
-      File.read(path)
-    rescue
-      raise if raise_on_context_miss?
-      ""
-    end
+    raise RuntimeError.new("Can't find partial #{name}") if not partialpath and raise_on_context_miss?
+
+    partialpath ? File.read(partialpath) : ""
   end
 
   # Override this to provide custom escaping.

data/man/mustache.5

@@ -229,7 +229,8 @@ Shown\.
 .P
 \fBNon\-Empty Lists\fR
 .P
-If the \fBperson\fR key exists and has a non\-false value, the HTML between the pound and slash will be rendered and displayed one or more times\.
+If the \fBrepo\fR key exists and has a non\-false value, the HTML between the pound and slash will be rendered and displayed one or more times\.
+.
 .P
 When the value is a non\-empty list, the text in the block will be displayed once for each item in the list\. The context of the block will be set to the current item for each iteration\. In this way we can loop over collections\.
 .P

data/man/mustache.5.html

@@ -307,7 +307,7 @@ list, the HTML between the pound and slash will not be displayed.</p>
 
 <p><strong>Non-Empty Lists</strong></p>
 
-<p>If the <code>person</code> key exists and has a non-false value, the HTML between
+<p>If the <code>repo</code> key exists and has a non-false value, the HTML between
 the pound and slash will be rendered and displayed one or more times.</p>
 
 <p>When the value is a non-empty list, the text in the block will be

data/man/mustache.5.ron

@@ -223,7 +223,7 @@ Output:
 
 **Non-Empty Lists**
 
-If the `person` key exists and has a non-false value, the HTML between
+If the `repo` key exists and has a non-false value, the HTML between
 the pound and slash will be rendered and displayed one or more times.
 
 When the value is a non-empty list, the text in the block will be

data/test/autoloading_test.rb

@@ -7,6 +7,11 @@ class AutoloadingTest < Minitest::Test
     Mustache.view_path = File.dirname(__FILE__) + '/fixtures'
   end
 
+  # Restore `view_namespace` to the default value
+  def teardown
+    Mustache.view_namespace = Object
+  end
+
   def test_autoload
     klass = Mustache.view_class(:Comments)
     assert_equal Comments, klass

data/test/fixtures/override/passenger.conf

@@ -0,0 +1,6 @@
+<VirtualHost *>
+  ServerAdmin override@mustache.com
+  ServerName {{server}}
+  DocumentRoot {{deploy_to}}
+  RailsEnv {{stage}}
+</VirtualHost>

data/test/mustache_test.rb

@@ -66,6 +66,14 @@ end_complex
                  instance.render
   end
 
+  def test_empty_string_as_section_does_not_render_inverted
+    instance = Mustache.new
+    instance[:value] = ""
+    instance.template = "{{#value}}Value Found{{/value}}{{^value}}Value Not Found{{/value}}"
+
+    assert_equal "Value Found", instance.render
+  end
+
   def test_sassy_single_line_sections
     instance = Mustache.new
     instance[:full_time] = true
@@ -726,14 +734,17 @@ text
     base = Class.new(Mustache)
     tmpl = Class.new(base)
 
-    {:template_path      => File.expand_path('./foo'),
-     :template_extension => 'stache',
+    {:template_extension => 'stache',
      :view_namespace     => TestNamespace,
      :view_path          => './foo'
      }.each do |attr, value|
       base.send("#{attr}=", value)
       assert_equal value, tmpl.send(attr)
     end
+    attr = :template_path
+    value = File.expand_path('./foo')
+    base.send("#{attr}=", value)
+    assert_equal value, tmpl.send(attr).first
   end
 
   def test_hash_default_proc
@@ -841,4 +852,11 @@ template
     klass.template = "Hi {{name}}!"
     assert_equal "Hi Dougal!", klass.new("Dougal").render
   end
+
+  def test_variable_with_at_name
+    instance = Mustache.new
+    instance.template = "\t{{#list@home}}a{{/list@home}}"
+
+    assert_equal "\taa", instance.render(:"list@home" => [1, 2])
+  end
 end

data/test/path_test.rb

@@ -0,0 +1,49 @@
+# -*- coding: utf-8 -*-
+require_relative 'helper'
+
+class MustacheTest < Minitest::Test
+
+  def test_default_path
+    assert_instance_of Array, Mustache.template_path
+    assert_equal 1, Mustache.template_path.size
+    assert_includes Mustache.template_path, Dir.pwd
+  end
+
+  def test_set_multiple_paths
+    old_path = Mustache.template_path
+    Mustache.template_path = "this#{File::PATH_SEPARATOR}that"
+    assert_instance_of Array, Mustache.template_path
+    assert_equal 2, Mustache.template_path.size
+    Mustache.template_path = old_path
+  end
+
+  def test_override_found
+
+    expected = <<-data
+<VirtualHost *>
+  ServerAdmin override@mustache.com
+  ServerName example.com
+  DocumentRoot /var/www/example.com
+  RailsEnv production
+</VirtualHost>
+data
+    old_path = Mustache.template_path
+    old_extension = Mustache.template_extension
+
+    begin
+      base = File.dirname(__FILE__)
+      Mustache.template_extension = "conf"
+      Mustache.template_path = "#{base}/fixtures/override:#{base}/fixtures"
+      assert_equal expected, Mustache.render(:passenger, :stage => 'production',
+                                                         :server => 'example.com',
+                                                         :deploy_to => '/var/www/example.com')
+      Mustache.template_path = "#{base}/fixtures:#{base}/fixtures/override"
+      refute_equal expected, Mustache.render(:passenger, :stage => 'production',
+                                                         :server => 'example.com',
+                                                         :deploy_to => '/var/www/example.com')
+    ensure
+      Mustache.template_path, Mustache.template_extension = old_path, old_extension
+    end
+  end
+
+end

metadata

@@ -1,116 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: mustache
 version: !ruby/object:Gem::Version
-  version: 1.1.2
+  version: 1.1.3
 platform: ruby
 authors:
 - Chris Wanstrath
 - Magnus Holm
 - Pieter van de Bruggen
 - Ricardo Mendes
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-02-24 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.6'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.6'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '10.3'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '10.3'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.4'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.4'
-- !ruby/object:Gem::Dependency
-  name: benchmark-ips
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: ruby-prof
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rdoc
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '4.1'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '4.1'
-- !ruby/object:Gem::Dependency
-  name: ronn
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.7'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.7'
+date: 2026-08-20 00:00:00.000000000 Z
+dependencies: []
 description: |
   Inspired by ctemplate, Mustache is a framework-agnostic way to render
   logic-free views.
@@ -178,6 +79,7 @@ files:
 - test/fixtures/nested_objects.mustache
 - test/fixtures/nested_objects.rb
 - test/fixtures/node.mustache
+- test/fixtures/override/passenger.conf
 - test/fixtures/partial_with_module.mustache
 - test/fixtures/partial_with_module.rb
 - test/fixtures/passenger.conf
@@ -198,13 +100,13 @@ files:
 - test/mustache_test.rb
 - test/parser_test.rb
 - test/partial_test.rb
+- test/path_test.rb
 - test/spec_test.rb
 - test/template_test.rb
 homepage: https://github.com/mustache/mustache
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -219,8 +121,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Mustache is a framework-agnostic way to render logic-free views.
 test_files: []