tina4ruby 3.13.87 → 3.13.89

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7743996e98fff70baf3c82a0f2a26dfafb24cb0c9ddc46cfc6a3be5a1df4c92f
-  data.tar.gz: 2b747045e71df0e69e7d6bdd3cb2b19309fcea16617770982b5743a4c6db9edc
+  metadata.gz: c9a4969bc3af1b2a6f203d215043c4fb9497aa40e71a0f7d1c17d92eddeecea3
+  data.tar.gz: 67a4a34e48ca3e167201ab06ac5cab96be36b4f4224a97f04cae0c58f700184c
 SHA512:
-  metadata.gz: f94e1f6feeda985b8c5091c0235181bb34165f4ee42120fa808b5b8a39cd8deaabc8ae9fe68a9c05d33598d184680d3b49c40f9791b1f0d2fb57689a87b73054
-  data.tar.gz: 6d31b432dddc04f237bddd28e6580d294c9427a22b0fda2947a9e2d9e3aba469b2fd06cdb2e0560d8edb60f1383c6916ba407a7efb257202d7cb95e381514083
+  metadata.gz: a89938265a10f5b8f0a48966f370c55006937a236285fe6b8f2fd9c5f75464d5c4fc0fc65cf1583f76539e24cd095701e3c092d87fb9d1197978d1d9774f552c
+  data.tar.gz: af228d8eebfab34598468e44f6962ac701280d4ad1207e4184f2eee6aabc631c5dda36753de7c99b1e8aea4dde7cff635fa2c44c30fff469532124cab0d9f11a

data/lib/tina4/frond.rb

@@ -143,6 +143,26 @@ module Tina4
     IMPORT_AS_RE    = /\Aimport\s+["'](.+?)["']\s+as\s+(\w+)/
     CACHE_RE        = /\Acache\s+["'](.+?)["']\s*(\d+)?/
     SPACELESS_RE    = />\s+</
+
+    # Every tag that OPENS a construct. An unknown tag is a typo, and 3.13.89
+    # makes it raise rather than render its body: a mistyped guard --
+    # {% iff is_admin %} instead of {% if is_admin %} -- used to render the gated
+    # content UNCONDITIONALLY, so a reviewer saw a guard that was not there. Twig
+    # and Jinja2 both raise on an unknown tag; Frond now does too. There is no
+    # user-extension point for tags in any of the four frameworks, so an unknown
+    # name is always a mistake, never a plugin.
+    KNOWN_TAGS = %w[
+      autoescape block cache extends for from if import include live macro raw set
+      spaceless
+    ].freeze
+
+    # Terminators and branch keywords. These reach the tag dispatch only when
+    # stray (their own collector consumes them in the normal case), and a stray
+    # one keeps the old render-nothing behaviour -- see the comment at the raise.
+    TERMINATOR_TAGS = %w[
+      elif else elseif endautoescape endblock endcache endfor endif endlive
+      endmacro endraw endset endspaceless
+    ].freeze
     AUTOESCAPE_RE   = /\Aautoescape\s+(false|true)/
     STRIPTAGS_RE    = /<[^>]+>/
     THOUSANDS_RE    = /(\d)(?=(\d{3})+(?!\d))/
@@ -429,6 +449,66 @@ module Tina4
       str.to_s.gsub(HTML_ESCAPE_RE, HTML_ESCAPE_MAP)
     end
 
+    # Serializes a value to compact JSON text that is always valid JSON.
+    #
+    # Never raises and never returns an empty string: a non-finite float becomes
+    # null (the JSON spec has no Infinity or NaN) and malformed UTF-8 is scrubbed,
+    # so a payload always arrives, in the worst case as null.
+    def self.json_text(value)
+      JSON.generate(value)
+    rescue StandardError
+      # Only reached when the happy path raised, so a well-formed payload never
+      # pays for the walk.
+      begin
+        JSON.generate(json_sanitize(value))
+      rescue StandardError
+        "null"
+      end
+    end
+
+    # Replaces anything JSON.generate refuses with a JSON-representable stand-in.
+    def self.json_sanitize(value)
+      case value
+      when Float   then value.finite? ? value : nil
+      when Hash    then value.transform_values { |item| json_sanitize(item) }
+      when Array   then value.map { |item| json_sanitize(item) }
+      when String  then value.valid_encoding? ? value : value.scrub
+      else value
+      end
+    end
+
+    # Serializes to JSON that is valid JSON, valid JavaScript, and safe in HTML.
+    #
+    # THE cross-framework contract for json_encode / to_json / tojson. Keep the
+    # four implementations byte-identical; frond_expression_corpus.txt locks it.
+    #
+    # Three things this must never do, each of which was a real bug:
+    #
+    # 1. Never emit a non-finite literal. JSON.generate raises on Infinity, and
+    #    the old `rescue v.to_s` turned that raise into Ruby inspect output --
+    #    `{"a" => 1.0}` -- which no JSON.parse will read. Reported as
+    #    tina4-php#184 by justin-k-bruce, who hit the same class of bug in PHP.
+    # 2. Never emit nothing, and never emit something that still parses and means
+    #    something else. "var ROWS = ;" is at least a loud SyntaxError.
+    # 3. Never HTML-escape it. Entity-encoding JSON produces {&quot;a&quot;:1},
+    #    a SyntaxError inside <script>, which is the filter's whole point. Escape
+    #    only the dangerous characters, as JSON \uXXXX escapes: the result stays
+    #    valid JSON AND valid JavaScript, </script> cannot terminate the block,
+    #    and it is safe inside a single-quoted attribute. This is what Jinja2's
+    #    tojson does, and it is why the result is a SafeString.
+    #
+    # U+2028 and U+2029 join that escape set. Both are legal inside a JSON string
+    # and both were illegal inside a JavaScript string literal before ES2019.
+    def self.json_safe(value)
+      Tina4::SafeString.new(json_text(value).gsub(JSON_ESCAPE_RE, JSON_ESCAPE_MAP))
+    end
+
+    JSON_ESCAPE_MAP = {
+      "<" => "\\u003c", ">" => "\\u003e", "&" => "\\u0026", "'" => "\\u0027",
+      "\u2028" => "\\u2028", "\u2029" => "\\u2029"
+    }.freeze
+    JSON_ESCAPE_RE = /[<>&'\u2028\u2029]/
+
     private
 
     # Keep a memo cache bounded (ADR-0004). Call immediately before inserting
@@ -653,8 +733,17 @@ module Tina4
             result, i = handle_for(tokens, i, context)
             output << result
           when "set"
-            handle_set(content, context)
-            i += 1
+            # An assignment has an "="; without one this is the BLOCK form,
+            # {% set name %}...{% endset %}, which captures its rendered body.
+            # A bare include? is exact here, not a shortcut: the block form's tag
+            # content is only ever "set <name>", so an "=" anywhere -- even inside
+            # a quoted value like {% set m = "a = b" %} -- means assignment.
+            if content.include?("=")
+              handle_set(content, context)
+              i += 1
+            else
+              i = handle_set_block(tokens, i, context)
+            end
           when "include"
             if @sandbox && @allowed_tags && !@allowed_tags.include?("include")
               i += 1
@@ -686,6 +775,15 @@ module Tina4
             i += 1
           else
             i += 1
+            unless tag.empty? || TERMINATOR_TAGS.include?(tag)
+              raise ArgumentError,
+                    %(Frond: unknown tag "#{tag}" -- known tags are: #{KNOWN_TAGS.sort.join(", ")})
+            end
+            # An empty tag ({%  %}) or a stray terminator (an {% endif %} with
+            # no {% if %}): no output.
+            # Malformed, but it has always rendered nothing, and nothing is the
+            # safe answer -- unlike an unknown tag it cannot expose content that
+            # was meant to be gated.
           end
 
           if strip_a && i < tokens.length && tokens[i][0] == TEXT
@@ -2284,6 +2382,48 @@ module Tina4
       )
     end
 
+    # {% set name %}...{% endset %} -- render the body and bind it.
+    #
+    # Emits nothing itself. The captured value is a SafeString because it is
+    # template output that has already been escaped on the way in; re-escaping it
+    # at {{ name }} would double-encode every entity. Twig and Jinja2 both mark
+    # the capture safe. Returns the index just past {% endset %}.
+    def handle_set_block(tokens, start, context)
+      content, _, _ = strip_tag(tokens[start][1])
+      name = (content.split[1] || "").strip
+
+      body_tokens = []
+      i = start + 1
+      depth = 0
+      while i < tokens.length
+        if tokens[i][0] == BLOCK
+          tc, _, _ = strip_tag(tokens[i][1])
+          tag = tc.split[0] || ""
+          if tag == "set" && !tc.include?("=")
+            depth += 1
+            body_tokens << tokens[i]
+          elsif tag == "endset"
+            if depth.zero?
+              i += 1
+              break
+            end
+            depth -= 1
+            body_tokens << tokens[i]
+          else
+            body_tokens << tokens[i]
+          end
+        else
+          body_tokens << tokens[i]
+        end
+        i += 1
+      end
+
+      unless name.empty?
+        context[name] = Tina4::SafeString.new(render_tokens(body_tokens.dup, context))
+      end
+      i
+    end
+
     def handle_spaceless(tokens, start, context)
       body_tokens = []
       i = start + 1
@@ -2406,7 +2546,10 @@ module Tina4
         "e"             => ->(v, *_a) { Tina4::SafeString.new(Frond.escape_html(v.to_s)) },
         "raw"           => ->(v, *_a) { v },
         "safe"          => ->(v, *_a) { v },
-        "json_encode"   => ->(v, *_a) { JSON.generate(v) rescue v.to_s },
+        # Frond.json_safe, never a bare JSON.generate: generate RAISES on an
+        # Infinity/NaN float, and the old `rescue v.to_s` answered that raise with
+        # Ruby inspect output that no JSON.parse will read. See Frond.json_safe.
+        "json_encode"   => ->(v, *_a) { Frond.json_safe(v) },
         "json_decode"   => ->(v, *_a) { v.is_a?(String) ? (JSON.parse(v) rescue v) : v },
         "base64_encode" => ->(v, *_a) { Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
         "base64encode"  => ->(v, *_a) { Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
@@ -2425,17 +2568,12 @@ module Tina4
         "url_encode"    => ->(v, *_a) { ERB::Util.url_encode(v.to_s) },
 
         # -- JSON / JS --
-        "to_json" => ->(v, *a) {
-          indent = a[0] ? a[0].to_i : nil
-          json = indent ? JSON.pretty_generate(v) : JSON.generate(v)
-          # Escape <, >, & for safe HTML embedding
-          Tina4::SafeString.new(json.gsub("<", '\u003c').gsub(">", '\u003e').gsub("&", '\u0026'))
-        },
-        "tojson" => ->(v, *a) {
-          indent = a[0] ? a[0].to_i : nil
-          json = indent ? JSON.pretty_generate(v) : JSON.generate(v)
-          Tina4::SafeString.new(json.gsub("<", '\u003c').gsub(">", '\u003e').gsub("&", '\u0026'))
-        },
+        # Same serializer as json_encode -- the three names are one behaviour.
+        # The old indent argument is gone: PHP cannot honour an arbitrary indent
+        # (JSON_PRETTY_PRINT is fixed at four spaces), so honouring it here alone
+        # broke byte-parity for the one filter whose whole job is a wire format.
+        "to_json" => ->(v, *_a) { Frond.json_safe(v) },
+        "tojson"  => ->(v, *_a) { Frond.json_safe(v) },
         "js_escape" => ->(v, *_a) {
           Tina4::SafeString.new(
             v.to_s.gsub("\\", "\\\\").gsub("'", "\\'").gsub('"', '\\"')

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.87"
+  VERSION = "3.13.89"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.87
+  version: 3.13.89
 platform: ruby
 authors:
 - Tina4 Team