tina4ruby 3.13.88 → 3.13.89

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8878ff3cfcfe50696d437b251a372f66d99a8098707e7cfd919554ec24d996fb
-  data.tar.gz: dbc5ae0b61c125a88fda3310d7dff72e0bb5a5d52d94ae863455ff607c5aab35
+  metadata.gz: c9a4969bc3af1b2a6f203d215043c4fb9497aa40e71a0f7d1c17d92eddeecea3
+  data.tar.gz: 67a4a34e48ca3e167201ab06ac5cab96be36b4f4224a97f04cae0c58f700184c
 SHA512:
-  metadata.gz: b51a87207d60bff1cd55241e23eb3b7325980752430bfef840ed8fce8e1ba491fbdf4096dd8369548112163ec40147b5e70874b3d6b66c174d82a5161e3f2062
-  data.tar.gz: 8b03d0f03526f60931fefafdf78f21e84b3e85dfb040af5106a1a7c26677e110fc21a2274b8d623bbbab60c23ba70661d8612ae02c43f024d29e02a82ca5e167
+  metadata.gz: a89938265a10f5b8f0a48966f370c55006937a236285fe6b8f2fd9c5f75464d5c4fc0fc65cf1583f76539e24cd095701e3c092d87fb9d1197978d1d9774f552c
+  data.tar.gz: af228d8eebfab34598468e44f6962ac701280d4ad1207e4184f2eee6aabc631c5dda36753de7c99b1e8aea4dde7cff635fa2c44c30fff469532124cab0d9f11a

data/lib/tina4/frond.rb

@@ -143,6 +143,26 @@ module Tina4
     IMPORT_AS_RE    = /\Aimport\s+["'](.+?)["']\s+as\s+(\w+)/
     CACHE_RE        = /\Acache\s+["'](.+?)["']\s*(\d+)?/
     SPACELESS_RE    = />\s+</
+
+    # Every tag that OPENS a construct. An unknown tag is a typo, and 3.13.89
+    # makes it raise rather than render its body: a mistyped guard --
+    # {% iff is_admin %} instead of {% if is_admin %} -- used to render the gated
+    # content UNCONDITIONALLY, so a reviewer saw a guard that was not there. Twig
+    # and Jinja2 both raise on an unknown tag; Frond now does too. There is no
+    # user-extension point for tags in any of the four frameworks, so an unknown
+    # name is always a mistake, never a plugin.
+    KNOWN_TAGS = %w[
+      autoescape block cache extends for from if import include live macro raw set
+      spaceless
+    ].freeze
+
+    # Terminators and branch keywords. These reach the tag dispatch only when
+    # stray (their own collector consumes them in the normal case), and a stray
+    # one keeps the old render-nothing behaviour -- see the comment at the raise.
+    TERMINATOR_TAGS = %w[
+      elif else elseif endautoescape endblock endcache endfor endif endlive
+      endmacro endraw endset endspaceless
+    ].freeze
     AUTOESCAPE_RE   = /\Aautoescape\s+(false|true)/
     STRIPTAGS_RE    = /<[^>]+>/
     THOUSANDS_RE    = /(\d)(?=(\d{3})+(?!\d))/
@@ -713,8 +733,17 @@ module Tina4
             result, i = handle_for(tokens, i, context)
             output << result
           when "set"
-            handle_set(content, context)
-            i += 1
+            # An assignment has an "="; without one this is the BLOCK form,
+            # {% set name %}...{% endset %}, which captures its rendered body.
+            # A bare include? is exact here, not a shortcut: the block form's tag
+            # content is only ever "set <name>", so an "=" anywhere -- even inside
+            # a quoted value like {% set m = "a = b" %} -- means assignment.
+            if content.include?("=")
+              handle_set(content, context)
+              i += 1
+            else
+              i = handle_set_block(tokens, i, context)
+            end
           when "include"
             if @sandbox && @allowed_tags && !@allowed_tags.include?("include")
               i += 1
@@ -746,6 +775,15 @@ module Tina4
             i += 1
           else
             i += 1
+            unless tag.empty? || TERMINATOR_TAGS.include?(tag)
+              raise ArgumentError,
+                    %(Frond: unknown tag "#{tag}" -- known tags are: #{KNOWN_TAGS.sort.join(", ")})
+            end
+            # An empty tag ({%  %}) or a stray terminator (an {% endif %} with
+            # no {% if %}): no output.
+            # Malformed, but it has always rendered nothing, and nothing is the
+            # safe answer -- unlike an unknown tag it cannot expose content that
+            # was meant to be gated.
           end
 
           if strip_a && i < tokens.length && tokens[i][0] == TEXT
@@ -2344,6 +2382,48 @@ module Tina4
       )
     end
 
+    # {% set name %}...{% endset %} -- render the body and bind it.
+    #
+    # Emits nothing itself. The captured value is a SafeString because it is
+    # template output that has already been escaped on the way in; re-escaping it
+    # at {{ name }} would double-encode every entity. Twig and Jinja2 both mark
+    # the capture safe. Returns the index just past {% endset %}.
+    def handle_set_block(tokens, start, context)
+      content, _, _ = strip_tag(tokens[start][1])
+      name = (content.split[1] || "").strip
+
+      body_tokens = []
+      i = start + 1
+      depth = 0
+      while i < tokens.length
+        if tokens[i][0] == BLOCK
+          tc, _, _ = strip_tag(tokens[i][1])
+          tag = tc.split[0] || ""
+          if tag == "set" && !tc.include?("=")
+            depth += 1
+            body_tokens << tokens[i]
+          elsif tag == "endset"
+            if depth.zero?
+              i += 1
+              break
+            end
+            depth -= 1
+            body_tokens << tokens[i]
+          else
+            body_tokens << tokens[i]
+          end
+        else
+          body_tokens << tokens[i]
+        end
+        i += 1
+      end
+
+      unless name.empty?
+        context[name] = Tina4::SafeString.new(render_tokens(body_tokens.dup, context))
+      end
+      i
+    end
+
     def handle_spaceless(tokens, start, context)
       body_tokens = []
       i = start + 1

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.88"
+  VERSION = "3.13.89"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.88
+  version: 3.13.89
 platform: ruby
 authors:
 - Tina4 Team