tina4ruby 3.13.137 → 3.13.138

data/lib/tina4/env.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "digest"
 
 module Tina4

data/lib/tina4/error_overlay.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # Tina4 Debug — Rich error overlay for development mode.
 #

data/lib/tina4/events.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # Tina4 Events — Simple observer pattern for decoupled communication.
 #

data/lib/tina4/feedback.rb

@@ -1,8 +1,15 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "json"
 require "net/http"
 require "uri"
+require_relative "parse_json"
 
 module Tina4
   # ── Customer feedback widget — server-side plumbing ─────────────────
@@ -170,7 +177,7 @@ module Tina4
           req.body = JSON.generate(forward_body)
           resp = Net::HTTP.start(uri.host, uri.port, open_timeout: 5, read_timeout: 60) { |h| h.request(req) }
           parsed = begin
-            JSON.parse(resp.body.to_s)
+            Tina4.parse_json(resp.body.to_s)
           rescue JSON::ParserError
             nil
           end
@@ -293,7 +300,7 @@ module Tina4
         input.rewind if input.respond_to?(:rewind)
         raw = input.read
         return nil if raw.nil? || raw.empty?
-        JSON.parse(raw)
+        Tina4.parse_json(raw)
       rescue JSON::ParserError
         nil
       end

data/lib/tina4/field_types.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module FieldTypes

data/lib/tina4/form_parser.rb

@@ -0,0 +1,241 @@
+# frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+
+require "stringio"
+
+module Tina4
+  # multipart/form-data parsing, owned by Tina4 (no Rack).
+  #
+  # Replaces Rack::Request#POST, which Tina4::Request used for multipart bodies
+  # until rack stopped being a dependency. Field names nest exactly the way Rack
+  # nested them - `user[name]` becomes a hash, `tags[]` an array, `a[][x]` an
+  # array of hashes, a repeated plain name keeps its last value - so a Ruby app
+  # that posts nested forms sees the same body it always did. spec/form_parser_spec.rb
+  # pins every shape against values captured from Rack 3.2.7.
+  #
+  # Files are parsed in the SAME pass and keyed by field name, each name mapping
+  # to a LIST of descriptors so a repeated file field keeps every file
+  # (fileupload_contract upload-repeated-field-list).
+  #
+  # The part delimiter is CRLF + "--" + boundary, as RFC 2046 defines it, so a
+  # file whose bytes happen to contain "--boundary" mid-line is not cut short.
+  module FormParser
+    # A name nested deeper than this is refused rather than recursed into.
+    # Rack's QueryParser param_depth_limit, kept for the same reason.
+    PARAM_DEPTH_LIMIT = 32
+
+    # A field name that is both a value and a container (`a=1` then `a[b]=2`)
+    # or nests past PARAM_DEPTH_LIMIT. Rack raised here too.
+    class ParameterError < StandardError; end
+
+    # Marks a hash the NESTING built, as opposed to a value that happens to be a
+    # hash. Only these may be descended into.
+    class NestedParams < Hash; end
+    private_constant :NestedParams
+
+    module_function
+
+    # The boundary token from a multipart Content-Type, quotes removed; nil when
+    # there is none.
+    def boundary(content_type)
+      content_type.to_s.split(";").each do |part|
+        part = part.strip
+        next unless part.downcase.start_with?("boundary=")
+
+        value = part[9..].to_s.strip
+        value = value[1...-1] if value.length >= 2 && value.start_with?('"') && value.end_with?('"')
+        return value.empty? ? nil : value
+      end
+      nil
+    end
+
+    # Parse a multipart body.
+    #
+    # @return [Hash] { fields: Hash (nested, Rack-shaped), files: Hash{name => [descriptor]},
+    #   error: ParameterError or nil }
+    #   A descriptor is { filename:, type:, content:, size:, tempfile: } with the
+    #   RAW client filename - Tina4::Request.save_upload sanitises it on write.
+    #   A name conflict or over-deep nesting empties the fields and is returned
+    #   as :error rather than raised, so one bad field name cannot lose the files.
+    def parse_multipart(body, content_type)
+      token = boundary(content_type)
+      fields = NestedParams.new
+      files = {}
+      return { fields: {}, files: files, error: nil } if token.nil? || body.nil? || body.empty?
+
+      pairs = []
+      each_part(body.b, token) do |headers, content|
+        name, filename = disposition_params(headers["content-disposition"].to_s)
+        next if name.nil? || name.empty?
+
+        if filename.nil?
+          pairs << [name.dup.force_encoding(Encoding::UTF_8), text_value(content, headers["content-type"])]
+        else
+          (files[name] ||= []) << {
+            filename: filename.dup.force_encoding(Encoding::UTF_8).scrub,
+            type: headers["content-type"] || "application/octet-stream",
+            content: content,
+            size: content.bytesize,
+            tempfile: StringIO.new(content)
+          }
+        end
+      end
+      # A name conflict voids the FIELDS only (Rack raised for the whole form);
+      # the files were collected independently and survive it.
+      error = nil
+      begin
+        pairs.each { |name, value| normalize_params(fields, name, value, 0) }
+      rescue ParameterError => e
+        error = e
+        fields = NestedParams.new
+      end
+      { fields: to_plain_hash(fields), files: files, error: error }
+    end
+
+    # Yield [headers, content] for every part. headers keys are lowercased.
+    def each_part(body, token)
+      delimiter = "--#{token}".b
+      position = body.index(delimiter)
+      return if position.nil?
+
+      position += delimiter.bytesize
+      separator = "\r\n#{delimiter}".b
+      while position < body.bytesize
+        # "--" straight after a delimiter closes the body.
+        break if body.byteslice(position, 2) == "--"
+
+        position += 2 if body.byteslice(position, 2) == "\r\n"
+        header_end = body.index("\r\n\r\n", position)
+        break if header_end.nil?
+
+        next_delimiter = body.index(separator, header_end + 4)
+        break if next_delimiter.nil?
+
+        yield part_headers(body.byteslice(position, header_end - position)),
+              body.byteslice(header_end + 4, next_delimiter - header_end - 4)
+        position = next_delimiter + separator.bytesize
+      end
+    end
+
+    def part_headers(block)
+      headers = {}
+      block.split("\r\n").each do |line|
+        name, value = line.split(":", 2)
+        next if value.nil?
+
+        headers[name.strip.downcase] = value.strip.force_encoding(Encoding::UTF_8).scrub
+      end
+      headers
+    end
+
+    # name= and filename= from a Content-Disposition value, by PARAMETER (not by
+    # a substring match, which found "name=" inside "filename=").
+    def disposition_params(disposition)
+      params = {}
+      disposition.scan(/;\s*([A-Za-z0-9!#$%&'*+.^_`|~-]+)\s*=\s*("(?:[^"\\]|\\.)*"|[^;]*)/) do |key, raw|
+        value = raw.strip
+        value = value[1...-1].gsub(/\\(.)/, '\1') if value.start_with?('"') && value.end_with?('"') && value.length >= 2
+        params[key.downcase] ||= value
+      end
+      [params["name"], params["filename"]]
+    end
+
+    # A text field is UTF-8 unless the part says `text/plain; charset=...`
+    # (Rack's rule). An unknown charset falls back to binary, never raises.
+    def text_value(content, part_type)
+      encoding = Encoding::UTF_8
+      if part_type
+        type, *parameters = part_type.split(";").map(&:strip)
+        if type.casecmp?("text/plain")
+          parameters.each do |parameter|
+            key, value = parameter.split("=", 2)
+            next unless key&.casecmp?("charset") && value
+
+            encoding = begin
+              Encoding.find(value.delete('"'))
+            rescue ArgumentError
+              Encoding::BINARY
+            end
+          end
+        end
+      end
+      content.dup.force_encoding(encoding)
+    end
+
+    # Rack::QueryParser#normalize_params, ported. Returns params.
+    def normalize_params(params, name, value, depth)
+      raise ParameterError, "field name nests deeper than #{PARAM_DEPTH_LIMIT} levels" if depth >= PARAM_DEPTH_LIMIT
+
+      if depth.zero?
+        start = name.index("[", 1)
+        key = start ? name[0, start] : name
+        after = start ? name[start..] : ""
+      elsif name.start_with?("[]")
+        key = "[]"
+        after = name[2..]
+      elsif name.start_with?("[") && (close = name.index("]", 1))
+        key = name[1, close - 1]
+        after = name[(close + 1)..]
+      else
+        key = name
+        after = ""
+      end
+      return if key.empty?
+
+      if after.empty?
+        return [value] if key == "[]" && !depth.zero?
+
+        params[key] = value
+      elsif after == "["
+        params[name] = value
+      elsif after == "[]"
+        params[key] ||= []
+        raise ParameterError, "expected Array for `#{key}'" unless params[key].is_a?(Array)
+
+        params[key] << value
+      elsif after.start_with?("[]")
+        child_key = after[3, after.length - 4] if after[2] == "[" && after.end_with?("]")
+        child_key = after[2..] if child_key.nil? || child_key.empty? || child_key.include?("[") || child_key.include?("]")
+        params[key] ||= []
+        raise ParameterError, "expected Array for `#{key}'" unless params[key].is_a?(Array)
+
+        last = params[key].last
+        if last.is_a?(NestedParams) && !nested_key?(last, child_key)
+          normalize_params(last, child_key, value, depth + 1)
+        else
+          params[key] << normalize_params(NestedParams.new, child_key, value, depth + 1)
+        end
+      else
+        params[key] ||= NestedParams.new
+        raise ParameterError, "expected Hash for `#{key}'" unless params[key].is_a?(NestedParams)
+
+        params[key] = normalize_params(params[key], after, value, depth + 1)
+      end
+      params
+    end
+
+    def nested_key?(hash, key)
+      return false if key.include?("[]")
+
+      key.split(/[\[\]]+/).reject(&:empty?).reduce(hash) do |level, part|
+        return false unless level.is_a?(NestedParams) && level.key?(part)
+
+        level[part]
+      end
+      true
+    end
+
+    def to_plain_hash(value)
+      case value
+      when Hash then value.each_with_object({}) { |(key, child), plain| plain[key] = to_plain_hash(child) }
+      when Array then value.map { |child| to_plain_hash(child) }
+      else value
+      end
+    end
+  end
+end

data/lib/tina4/frond.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # Tina4 Frond Engine -- Lexer, parser, and runtime.
 # Zero-dependency twig-like template engine.
@@ -8,13 +14,14 @@
 
 require "json"
 require "digest"
-require "base64"
-require "cgi"
+require_relative "base64"
+require "cgi/escape"
 require "erb"
 require "uri"
 require "date"
 require "time"
 require "securerandom"
+require_relative "parse_json"
 
 module Tina4
   # Marker class for strings that should not be auto-escaped in Frond.
@@ -484,6 +491,38 @@ module Tina4
     # The escaping decision has to ask this rather than read the filter name out
     # of the source: a denied `raw` that still marked its value safe made the
     # allow-list entry governing XSS escaping inert.
+    # Words in an expression that are not variable references.
+    SANDBOX_EXPR_KEYWORDS = %w[true false none null nil and or not in is loop
+                               if else empty starts ends with matches].freeze
+    SANDBOX_IDENT_RE  = /(?<![.\w'"])([A-Za-z_][A-Za-z0-9_]*)/
+    SANDBOX_STRING_RE = /'[^']*'|"[^"]*"/
+    # Methods that must never be invoked through {{ obj.method }} — reflection,
+    # metaprogramming and process control (F6/ADR-0077).
+    UNSAFE_METHODS = %w[send __send__ public_send instance_eval instance_exec
+                        eval class methods public_methods private_methods
+                        instance_variables instance_variable_get
+                        instance_variable_set define_singleton_method method
+                        tap then object_id __id__ system exec spawn binding
+                        singleton_class ancestors superclass constants
+                        const_get remove_method].to_set.freeze
+
+    # Sandbox gate for a WHOLE expression (F6/ADR-0077): refuse a dunder walk
+    # or a root variable outside the allow-list, in output, conditions, set
+    # right-hand sides and for iterables alike.
+    def sandbox_expr_ok?(expr)
+      return true unless @sandbox
+      return false if expr.include?("__")
+      return true unless @allowed_vars
+
+      stripped = expr.gsub(SANDBOX_STRING_RE, "")
+      stripped.scan(SANDBOX_IDENT_RE).each do |(ident)|
+        next if SANDBOX_EXPR_KEYWORDS.include?(ident.downcase)
+        next if @filters.key?(ident)
+        return false unless @allowed_vars.include?(ident)
+      end
+      true
+    end
+
     def filter_permitted?(name)
       return true unless @sandbox && @allowed_filters
 
@@ -506,6 +545,83 @@ module Tina4
       str.to_s.gsub(HTML_ESCAPE_RE, HTML_ESCAPE_MAP)
     end
 
+    # -- Escape strategies (ADR-0077) ------------------------------------
+    # Shared by js_escape and e(strategy); byte-identical to the Python
+    # master. Twig-compatible.
+    JS_SAFE_RE  = /[A-Za-z0-9,._]/
+    CSS_SAFE_RE = /[A-Za-z0-9]/
+    ATTR_SAFE_RE = /[A-Za-z0-9,.\-_]/
+
+    def self.js_escape_str(value)
+      out = +""
+      value.to_s.each_char do |ch|
+        if ch =~ JS_SAFE_RE
+          out << ch
+          next
+        end
+        code = ch.ord
+        if code < 0x80
+          out << format("\\x%02X", code)
+        elsif code <= 0xFFFF
+          out << format("\\u%04X", code)
+        else
+          code -= 0x10000
+          out << format("\\u%04X", 0xD800 + (code >> 10))
+          out << format("\\u%04X", 0xDC00 + (code & 0x3FF))
+        end
+      end
+      out
+    end
+
+    def self.css_escape(value)
+      out = +""
+      value.to_s.each_char do |ch|
+        out << (ch =~ CSS_SAFE_RE ? ch : format("\\%06X ", ch.ord))
+      end
+      out
+    end
+
+    def self.html_attr_escape(value)
+      out = +""
+      value.to_s.each_char do |ch|
+        out << (ch =~ ATTR_SAFE_RE ? ch : format("&#x%02X;", ch.ord))
+      end
+      out
+    end
+
+    # RFC-3986 rawurlencode: unreserved set stays, everything else percent-encoded.
+    def self.url_escape(value)
+      value.to_s.b.gsub(/[^A-Za-z0-9\-_.~]/) { |c| format("%%%02X", c.ord) }
+    end
+
+    # Dispatch e(strategy)/escape(strategy). An unknown strategy raises, so a
+    # typo can never silently pass the value through unescaped.
+    def self.escape_strategy(value, strategy = "html")
+      s = strategy.to_s.strip.gsub(/\A['"]|['"]\z/, "")
+      case s
+      when "", "html"
+        Tina4::SafeString.new(escape_html(value.to_s))
+      when "js"
+        Tina4::SafeString.new(js_escape_str(value))
+      when "url"
+        Tina4::SafeString.new(url_escape(value))
+      when "css"
+        Tina4::SafeString.new(css_escape(value))
+      when "html_attr", "attr"
+        Tina4::SafeString.new(html_attr_escape(value))
+      else
+        raise ArgumentError, "Unknown escape strategy: #{strategy}"
+      end
+    end
+
+    # Confine a client-supplied media type to a strict type/subtype grammar
+    # (F3/ADR-0077); anything malformed falls back to a safe default.
+    MEDIA_TYPE_RE = %r{\A[A-Za-z0-9][A-Za-z0-9!\#$&^_.+-]*/[A-Za-z0-9][A-Za-z0-9!\#$&^_.+-]*\z}
+    def self.sanitise_media_type(type)
+      t = type.to_s.strip
+      t =~ MEDIA_TYPE_RE ? t : "application/octet-stream"
+    end
+
     # Serializes a value to compact JSON text that is always valid JSON.
     #
     # Never raises and never returns an empty string: a non-finite float becomes
@@ -616,35 +732,54 @@ module Tina4
     # Tokenizer
     # -----------------------------------------------------------------------
 
-    # Regex to extract {% raw %}...{% endraw %} blocks before tokenizing
-    RAW_BLOCK_RE = /\{%-?\s*raw\s*-?%\}(.*?)\{%-?\s*endraw\s*-?%\}/m
-
+    # Walk literal delimiters instead of retrying a whole-template regex at
+    # every unmatched opener. This also bounds parsing on Ruby versions that
+    # do not memoize regexp backtracking.
     def tokenize(source)
-      # 1. Extract raw blocks and replace with placeholders
       raw_blocks = []
-      source = source.gsub(RAW_BLOCK_RE) do
-        idx = raw_blocks.length
-        raw_blocks << Regexp.last_match(1)
-        "\x00RAW_#{idx}\x00"
+      chunks = []
+      copied = 0
+      cursor = 0
+      raw_start = nil
+      while (start = source.index("{%", cursor))
+        cursor = start + 2
+        match = /\G\{%-?\s*(raw|endraw)\s*-?%\}/.match(source, start)
+        next unless match
+        finish = match.end(0) - 2
+        tag = match[1]
+        if tag == "raw" && raw_start.nil?
+          raw_start = [start, finish + 2]
+        elsif tag == "endraw" && raw_start
+          chunks << source[copied...raw_start[0]]
+          chunks << "\x00RAW_#{raw_blocks.length}\x00"
+          raw_blocks << source[raw_start[1]...start]
+          copied = finish + 2
+          raw_start = nil
+        end
       end
+      chunks << source[copied..]
+      source = chunks.join
 
-      # 2. Normal tokenization
       tokens = []
       pos = 0
-      source.scan(TOKEN_RE) do
-        m = Regexp.last_match
-        start = m.begin(0)
-        tokens << [TEXT, source[pos...start]] if start > pos
-
-        raw = m[0]
-        if raw.start_with?("{#")
-          tokens << [COMMENT, raw]
-        elsif raw.start_with?("{{")
-          tokens << [VAR, raw]
-        elsif raw.start_with?("{%")
-          tokens << [BLOCK, raw]
+      cursor = 0
+      missing_close = {}
+      closers = { "{%" => "%}", "{{" => "}}", "{#" => "#}" }
+      while (match = /\{%|\{\{|\{#/.match(source, cursor))
+        start = match.begin(0)
+        opener = match[0]
+        cursor = start + 2
+        next if missing_close[opener]
+        finish = source.index(closers.fetch(opener), cursor)
+        unless finish
+          missing_close[opener] = true
+          next
         end
-        pos = m.end(0)
+        tokens << [TEXT, source[pos...start]] if start > pos
+        raw = source[start...(finish + 2)]
+        type = { "{#" => COMMENT, "{{" => VAR, "{%" => BLOCK }.fetch(opener)
+        tokens << [type, raw]
+        pos = cursor = finish + 2
       end
       tokens << [TEXT, source[pos..]] if pos < source.length
 
@@ -1155,6 +1290,10 @@ module Tina4
     end
 
     def eval_var_raw(expr, context)
+      # Sandbox: gate the whole condition/RHS (F6) so a comparison or iterable
+      # cannot leak a blocked variable.
+      return nil if @sandbox && !sandbox_expr_ok?(expr)
+
       var_name, filters = parse_filter_chain(expr)
       value = eval_expr(var_name, context)
       filters.each do |fname, args|
@@ -1232,16 +1371,8 @@ module Tina4
 
       var_name, filters = parse_filter_chain(expr)
 
-      # Sandbox: check variable access
-      if @sandbox && @allowed_vars
-        root_var = @dotted_split_cache[var_name]
-        unless root_var
-          root_var = var_name.split(".")[0].split("[")[0].strip
-          cap_cache(@dotted_split_cache, MEMO_CACHE_MAX)
-          @dotted_split_cache[var_name] = root_var
-        end
-        return "" if !root_var.empty? && !@allowed_vars.include?(root_var) && root_var != "loop"
-      end
+      # Sandbox: gate the whole expression (allow-list + dunder block, F6)
+      return "" if @sandbox && !sandbox_expr_ok?(expr)
 
       value = eval_expr(var_name, context)
 
@@ -1283,7 +1414,7 @@ module Tina4
                   when "title"      then value.to_s.split.map(&:capitalize).join(" ")
                   when "string"     then value.to_s
                   when "int"        then value.to_i
-                  when "escape", "e" then Tina4::SafeString.new(Frond.escape_html(value.to_s))
+                  when "escape", "e" then Frond.escape_strategy(value, "html")
                   else value
                   end
           next
@@ -1296,9 +1427,17 @@ module Tina4
         end
       end
 
-      # Auto-escape HTML unless marked safe or SafeString
-      if @auto_escape && !is_safe && value.is_a?(String) && !value.is_a?(SafeString)
-        value = Frond.escape_html(value)
+      # Auto-escape HTML unless marked safe or SafeString. A plain string is
+      # escaped directly; an Array/Hash/object is escaped on its rendered
+      # string form (F4/ADR-0077) -- before this, only String values were
+      # escaped, so {{ items }} holding markup emitted it raw. nil, booleans
+      # and Numerics carry no HTML-special characters and are left untouched.
+      if @auto_escape && !is_safe && !value.is_a?(SafeString)
+        if value.is_a?(String)
+          value = Frond.escape_html(value)
+        elsif !value.nil? && value != true && value != false && !value.is_a?(Numeric)
+          value = Tina4::SafeString.new(Frond.escape_html(value.to_s))
+        end
       end
 
       value
@@ -2060,8 +2199,10 @@ module Tina4
                 end
           idx = idx.to_i if idx.is_a?(Numeric)
           value = idx.is_a?(Integer) ? value[idx] : nil
-        elsif value.respond_to?(part.to_sym)
-          value = value.send(part.to_sym)
+        elsif !UNSAFE_METHODS.include?(part) && value.respond_to?(part.to_sym)
+          # Only call a method the object publicly exposes, and never a
+          # reflection/metaprogramming method (F6/ADR-0077).
+          value = value.public_send(part.to_sym)
         else
           return nil
         end
@@ -2235,7 +2376,11 @@ module Tina4
         i += 1
       end
 
-      iterable = eval_expr(iterable_expr, context)
+      iterable = if @sandbox && !sandbox_expr_ok?(iterable_expr)
+                   nil
+                 else
+                   eval_expr(iterable_expr, context)
+                 end
 
       if iterable.nil? || (iterable.respond_to?(:empty?) && iterable.empty?)
         if else_tokens.any?
@@ -2852,25 +2997,25 @@ module Tina4
         "striptags"  => ->(v, *_a) { v.to_s.gsub(STRIPTAGS_RE, "") },
 
         # -- Encoding --
-        "escape"        => ->(v, *_a) { Tina4::SafeString.new(Frond.escape_html(v.to_s)) },
-        "e"             => ->(v, *_a) { Tina4::SafeString.new(Frond.escape_html(v.to_s)) },
+        "escape"        => ->(v, *a) { Frond.escape_strategy(v, a[0] || "html") },
+        "e"             => ->(v, *a) { Frond.escape_strategy(v, a[0] || "html") },
         "raw"           => ->(v, *_a) { v },
         "safe"          => ->(v, *_a) { v },
         # Frond.json_safe, never a bare JSON.generate: generate RAISES on an
         # Infinity/NaN float, and the old `rescue v.to_s` answered that raise with
         # Ruby inspect output that no JSON.parse will read. See Frond.json_safe.
         "json_encode"   => ->(v, *_a) { Frond.json_safe(v) },
-        "json_decode"   => ->(v, *_a) { v.is_a?(String) ? (JSON.parse(v) rescue v) : v },
-        "base64_encode" => ->(v, *_a) { Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
-        "base64encode"  => ->(v, *_a) { Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
-        "base64_decode" => ->(v, *_a) { Base64.decode64(v.to_s) },
-        "base64decode"  => ->(v, *_a) { Base64.decode64(v.to_s) },
+        "json_decode"   => ->(v, *_a) { v.is_a?(String) ? (Tina4.parse_json(v) rescue v) : v },
+        "base64_encode" => ->(v, *_a) { Tina4::Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
+        "base64encode"  => ->(v, *_a) { Tina4::Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
+        "base64_decode" => ->(v, *_a) { Tina4::Base64.decode64(v.to_s) },
+        "base64decode"  => ->(v, *_a) { Tina4::Base64.decode64(v.to_s) },
         "data_uri" => ->(v, *_a) {
           if v.is_a?(Hash)
-            ct = v[:type] || v["type"] || "application/octet-stream"
+            ct = Frond.sanitise_media_type(v[:type] || v["type"] || "application/octet-stream")
             raw = v[:content] || v["content"] || ""
             raw = raw.respond_to?(:read) ? raw.read : raw
-            "data:#{ct};base64,#{Base64.strict_encode64(raw.to_s)}"
+            Tina4::SafeString.new("data:#{ct};base64,#{Tina4::Base64.strict_encode64(raw.to_s)}")
           else
             v.to_s
           end
@@ -2884,12 +3029,7 @@ module Tina4
         # broke byte-parity for the one filter whose whole job is a wire format.
         "to_json" => ->(v, *_a) { Frond.json_safe(v) },
         "tojson"  => ->(v, *_a) { Frond.json_safe(v) },
-        "js_escape" => ->(v, *_a) {
-          Tina4::SafeString.new(
-            v.to_s.gsub("\\", "\\\\").gsub("'", "\\'").gsub('"', '\\"')
-                  .gsub("\n", "\\n").gsub("\r", "\\r").gsub("\t", "\\t")
-          )
-        },
+        "js_escape" => ->(v, *_a) { Tina4::SafeString.new(Frond.js_escape_str(v)) },
 
         # -- Hashing --
         "md5"    => ->(v, *_a) { Digest::MD5.hexdigest(v.to_s) },