twig_ruby 0.0.1 → 0.0.2

data/lib/twig/runtime/enumerable_hash.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Twig
+  module Runtime
+    class EnumerableHash
+      include Enumerable
+
+      MISSING_KEY = "__§__missing_key_#{rand}".freeze
+
+      private_constant :MISSING_KEY
+
+      def self.from(object)
+        if object.is_a?(Array)
+          new(AutoHash.new.add(*object))
+        elsif object.is_a?(Hash)
+          new(object.to_h)
+        else
+          new(object)
+        end
+      end
+
+      def initialize(wrapped)
+        @wrapped = wrapped
+      end
+
+      def each(...)
+        key = 0
+        @wrapped&.each do |k, v = MISSING_KEY| # rubocop:disable Style/HashEachMethods
+          if v == MISSING_KEY
+            yield(key, k)
+            key += 1
+          else
+            yield(k, v)
+          end
+        end
+      end
+
+      def values
+        collect { |_, v| v }
+      end
+
+      def keys
+        collect { |k, _| k }
+      end
+
+      def filter
+        self.class.new(super)
+      end
+    end
+  end
+end

data/lib/twig/runtime/escaper.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+module Twig
+  module Runtime
+    class Escaper
+      def initialize(charset)
+        @charset = charset
+      end
+
+      JS_SHORT_MAP = {
+        '\\' => '\\\\',
+        '/' => '\\/',
+        "\x08" => '\b',
+        "\x0C" => '\f',
+        "\x0A" => '\n',
+        "\x0D" => '\r',
+        "\x09" => '\t',
+      }.freeze
+
+      def escape(string, strategy = :html, charset = nil, autoescape = false)
+        # Allow strings marked as html_safe to get through without escaping
+        if string.html_safe? && autoescape
+          return string
+        end
+
+        case strategy.to_sym
+        when :html
+          CGI.escapeHTML(string.to_s)
+        when :html_attr
+          escape_html_attr(string.to_s, charset || @charset)
+        when :js
+          escape_js(string.to_s, charset || @charset)
+        when :css
+          escape_css(string.to_s, charset || @charset)
+        when :url
+          CGI.escape(string.to_s)
+        else
+          string.to_s
+        end.html_safe
+      end
+
+      private
+
+      def escape_html_attr(string, charset)
+        # Convert encoding if needed
+        if charset != 'UTF-8'
+          string = convert_encoding(string, 'UTF-8', charset)
+        end
+
+        # Validate UTF-8
+        unless string.valid_encoding?
+          raise Error::Runtime, 'The string to escape is not a valid UTF-8 string.'
+        end
+
+        # Escape characters not safe for HTML attributes
+        string = string.gsub(/[^a-zA-Z0-9,.\-_]/u) do |char|
+          ord = char.ord
+
+          # Replace characters undefined in HTML with Unicode replacement character
+          if (ord <= 0x1F && char != "\t" && char != "\n" && char != "\r") || ord.between?(0x7F, 0x9F)
+            '&#xFFFD;'
+          elsif char.bytesize == 1
+            # Use named entities for common characters
+            case ord
+            when 34 then '&quot;'  # quotation mark
+            when 38 then '&amp;'   # ampersand
+            when 60 then '&lt;'    # less-than sign
+            when 62 then '&gt;'    # greater-than sign
+            else
+              format('&#x%02X;', ord)
+            end
+          else
+            # Use hex entities for multi-byte characters
+            format('&#x%04X;', char.codepoints.first)
+          end
+        end
+
+        # Convert back to original encoding if needed
+        if charset != 'UTF-8'
+          string = string.encode(charset, 'UTF-8')
+        end
+
+        string
+      end
+
+      def escape_js(string, charset)
+        # Convert encoding if needed
+        if charset != 'UTF-8'
+          string = convert_encoding(string, 'UTF-8', charset)
+        end
+
+        # Validate UTF-8
+        unless string.valid_encoding?
+          raise Error::Runtime, 'The string to escape is not a valid UTF-8 string.'
+        end
+
+        string = string.gsub(/[^a-zA-Z0-9,._]/) do |char|
+          codepoint = char.ord
+
+          if JS_SHORT_MAP.key?(char)
+            JS_SHORT_MAP[char]
+          elsif codepoint < 0x10000
+            format('\u%04X', codepoint)
+          else
+            # Split characters outside the BMP into surrogate pairs
+            # https://tools.ietf.org/html/rfc2781.html#section-2.1
+            u = codepoint - 0x10000
+            high = 0xD800 | (u >> 10)
+            low = 0xDC00 | (u & 0x3FF)
+
+            format('\u%04X\u%04X', high, low)
+          end
+        end
+
+        # Convert back to original encoding if needed
+        if charset != 'UTF-8'
+          string = string.encode(charset, 'UTF-8')
+        end
+
+        string
+      end
+
+      def escape_css(string, charset)
+        # Convert encoding if needed
+        if charset != 'UTF-8'
+          string = convert_encoding(string, 'UTF-8', charset)
+        end
+
+        # Validate UTF-8
+        unless string.valid_encoding?
+          raise Error::Runtime, 'The string to escape is not a valid UTF-8 string.'
+        end
+
+        string = string.gsub(/[^a-zA-Z0-9]/) do |char|
+          if char.bytesize == 1
+            format('\\%X ', char.ord)
+          else
+            format('\\%X ', char.codepoints.first)
+          end
+        end
+
+        # Convert back to original encoding if needed
+        if charset != 'UTF-8'
+          string = string.encode(charset, 'UTF-8')
+        end
+
+        string
+      end
+
+      def convert_encoding(string, to_encoding, from_encoding)
+        string.encode(to_encoding, from_encoding)
+      end
+    end
+  end
+end

data/lib/twig/runtime/loop_context.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+##
+# This file is part of Twig.
+#
+# (c) Fabien Potencier
+#
+# For the full copyright and license information, please view the LICENSE
+# file that was distributed with this source code.
+
+module Twig
+  module Runtime
+    class LoopContext
+      # @return [Object, nil] The parent context
+      attr_reader :parent
+
+      delegate :index0, :index, :revindex0, :revindex, :length, :first, :last, to: :loop
+
+      def initialize(loop, parent, blocks, recurse_func, depth)
+        @loop = loop
+        @parent = parent
+        @blocks = blocks
+        @recurse_func = recurse_func
+        @depth = depth
+      end
+
+      # @param value [Object] The first value in the cycle
+      # @param values [Array<Object>] The rest of the values in the cycle
+      # @return [Object] The current value in the cycle
+      def cycle(value, *values)
+        values.unshift(value)
+        values[index0 % values.length]
+      end
+
+      # Recursion function
+      # @param iterator [Enumerable] The iterator
+      # @return [Enumerator] An enumerator for recursive iteration
+      def call(iterator)
+        if @depth > 50
+          raise 'Nesting level too deep.'
+        end
+
+        @parent.buffer_and_return do
+          @recurse_func.call(LoopIterator.new(iterator), @parent, @blocks, @recurse_func, @depth + 1)
+        end
+      end
+
+      def changed(value)
+        if !defined?(@last_changed) || value != @last_changed
+          @last_changed = value
+
+          true
+        else
+          false
+        end
+      end
+
+      def previous
+        @loop.previous&.dig(1)
+      end
+
+      def next
+        @loop.next&.dig(1)
+      end
+
+      # @return [Integer] The depth starting from 0
+      def depth0
+        @depth
+      end
+
+      # @return [Integer] The depth starting from 1
+      def depth
+        @depth + 1
+      end
+
+      private
+
+      attr_reader :loop
+    end
+  end
+end

data/lib/twig/runtime/loop_iterator.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Twig
+  module Runtime
+    class LoopIterator
+      attr_reader :index0, :previous, :next
+
+      def initialize(seq)
+        @seq = Runtime::EnumerableHash.from(seq).to_enum
+        @index0 = 0
+        @previous = nil
+        @next = nil
+      end
+
+      def each(&)
+        @index0 = 0
+
+        loop do
+          current = @seq.next
+
+          begin
+            @next = @seq.peek
+          rescue StopIteration
+            @next = nil
+          end
+
+          yield current[0], current[1]
+          @index0 += 1
+          @previous = current
+        rescue StopIteration
+          break
+        end
+      end
+
+      def first
+        @index0.zero?
+      end
+
+      def last
+        revindex0.zero? || length.zero?
+      end
+
+      def length
+        @length ||= @seq.count
+      end
+
+      def index
+        @index0 + 1
+      end
+
+      def revindex0
+        [0, length - index].max
+      end
+
+      def revindex
+        revindex0 + 1
+      end
+    end
+  end
+end

data/lib/twig/runtime/spread.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Twig
+  module Runtime
+    class Spread
+      attr_reader :value
+
+      def initialize(value)
+        @value = value
+      end
+
+      def array?
+        value.is_a?(Array) || value.is_a?(Range)
+      end
+
+      def hash?
+        value.is_a?(Hash)
+      end
+    end
+  end
+end

data/lib/twig/runtime_loader/base.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Twig
+  module RuntimeLoader
+    class Base
+      # @return [Object, nil]
+      def load(klass)
+        raise NotImplementedError
+      end
+    end
+  end
+end

data/lib/twig/runtime_loader/factory.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Twig
+  module RuntimeLoader
+    class Factory < Base
+      def initialize(map)
+        super()
+
+        @map = map.transform_keys do |klass|
+          klass.is_a?(Class) ? klass.name : klass
+        end
+      end
+
+      def load(klass)
+        klass = klass.name if klass.is_a?(Class)
+
+        return nil unless @map.key?(klass)
+
+        @map[klass].call
+      end
+    end
+  end
+end

data/lib/twig/template.rb

@@ -7,39 +7,292 @@ module Twig
     METHOD_CALL = :method_call
     ANY_CALL = :any_call
 
+    attr_accessor :blocks
+
     # @param [Environment] environment
-    def initialize(environment, call_context: nil, output_buffer: nil)
+    def initialize(environment)
       @environment = environment
+      @parent = nil
       @parents = {}
       @blocks = {}
-      @call_context = call_context
-      @output_buffer = output_buffer || OutputBuffer.new
+      @traits = {}
+      @macros = {}
+      @trait_aliases = {}
     end
 
     def call(context = {}, blocks = {})
       raise 'call is not implemented'
     end
 
-    def render(context = {}, blocks = {})
-      call(Context.new(context), blocks)
+    # @param [Runtime::Context] context
+    def render(context)
+      unless context.is_a?(Runtime::Context)
+        raise Error::Runtime, 'Render must implement Twig::Runtime::Context.'
+      end
+
+      render_with_blocks(context.merge(env.globals), blocks.merge(blocks))
+    end
+
+    def render_with_blocks(context = {}, blocks = {})
+      call(context, blocks)
+    rescue Error::Base => e
+      e.source_context = source_context unless e.source_context
+      e.guess if e.lineno == -1
+      raise e
+    rescue StandardError => e
+      exception = Error::Runtime.new(
+        "An exception has been thrown during the rendering of a template (\"#{e}\").",
+        -1,
+        source_context,
+        e
+      )
+      exception.guess
+
+      raise exception
+    end
+
+    def render_block(name, context, blocks = {}, use_blocks: true, template_context: self)
+      unless context.is_a?(Runtime::Context)
+        context = Runtime::Context.new(context)
+      end
+
+      name = name.to_sym
+      template = if use_blocks && blocks.key?(name)
+                   blocks[name]
+                 elsif self.blocks.key?(name)
+                   self.blocks[name]
+                 end
+
+      # avoid RCEs when sandbox is enabled
+      if !template.nil? && !template[0].is_a?(::Twig::Template)
+        raise Error::Logic, 'A block must be a method on a ::Twig::Template instance.'
+      end
+
+      if !template.nil?
+        begin
+          context.buffer_and_return do
+            template[0].public_send(template[1], context, blocks)
+          end.to_s.html_safe
+        rescue Error::Base => e
+          unless e.source_context
+            e.source_context = template[0].source_context
+          end
+
+          if e.lineno == -1
+            e.guess
+          end
+
+          raise e
+        rescue StandardError => e
+          # Rails wraps exceptions that happened using render
+          if e.respond_to?(:cause) && e.cause.is_a?(Error::Base)
+            e = e.cause
+            unless e.source_context
+              e.source_context = template[0].source_context
+            end
+          end
+
+          exception = Error::Runtime.new(
+            "An exception has been thrown during the rendering of a template (#{e})",
+            -1,
+            template[0].source_context,
+            e
+          )
+          exception.guess
+
+          raise exception
+        end
+      elsif (parent = get_parent(context))
+        parent.render_block(name, context, self.blocks.merge(blocks), use_blocks: false, template_context:)
+      elsif blocks.key?(name)
+        raise Error::Runtime.new(
+          "Block \"#{name}\" should not call parent() in \"#{blocks[name][0].template_name}\" " \
+          "as the block does not exist in the parent template \"#{template_name}\".",
+          -1,
+          blocks[name][0].source_context
+        )
+      else
+        raise Error::Runtime.new(
+          "Block \"#{name}\" on template \"#{template_name}\" does not exist.",
+          -1,
+          template_context.source_context
+        )
+      end
+    end
+
+    def block?(name, context, blocks = {})
+      name = name.to_sym
+      if blocks.key?(name) && blocks[name][0].is_a?(Template)
+        return true
+      end
+
+      if @blocks&.key?(name)
+        return true
+      end
+
+      if (parent = get_parent(context))
+        return parent.block?(name, context)
+      end
+
+      false
     end
 
-    def yield_block(name, context = {}, blocks = {})
-      object = self
+    def render_parent_block(name, context, blocks = {})
+      if @traits.key?(name.to_sym)
+        @traits[name.to_sym][0].render_block(@trait_aliases[name.to_sym] || name, context, blocks, use_blocks: false)
+      elsif (parent = get_parent(context))
+        parent.render_block(name, context, blocks, use_blocks: false)
+      else
+        raise Error::Runtime.new(
+          "The template has no parent and no traits defining the #{name} block.",
+          -1,
+          source_context
+        )
+      end
+    end
 
-      if blocks.key?(name)
-        object = blocks[name]
+    # @return [Template, false]
+    def get_parent(context)
+      if @parent
+        return @parent
       end
 
-      object.public_send(:"block_#{name}", context, blocks)
+      unless (parent = do_get_parent(context))
+        return false
+      end
+
+      if parent.is_a?(Template)
+        return @parents[parent.source_context.name] = parent
+      end
+
+      unless @parents.key?(parent)
+        @parents[parent] = load(parent, -1)
+      end
+
+      @parents[parent]
+    end
+
+    def macro?(name, context)
+      if respond_to?(name.to_sym)
+        return true
+      end
+
+      unless (parent = get_parent(context))
+        return false
+      end
+
+      parent.macro?(name, context)
+    end
+
+    def render_macro(name, context, args, lineno, source)
+      macro_method = macro_template_reference(name, context, lineno, source)
+      macro_arguments = macro_method.parameters.select { |arg| arg[0] == :key }.map { |_, arg| arg }
+      mapped_arguments = AutoHash.new
+      kwarg = false
+
+      args.each do |key, value|
+        if !kwarg && key.is_a?(Integer)
+          if key >= 0 && key < macro_arguments.length
+            mapped_key = macro_arguments[key]
+          else
+            mapped_arguments.add(value)
+
+            next
+          end
+        elsif kwarg && key.is_a?(Integer)
+          raise Error::Runtime.new('Cannot place a positional argument after a keyword argument.', lineno, source)
+        else
+          kwarg = true
+          mapped_key = key.to_sym
+        end
+
+        if mapped_arguments.key?(mapped_key)
+          raise Error::Runtime.new("Argument \"#{mapped_key.inspect}\" passed twice.", lineno, source)
+        end
+
+        mapped_arguments[mapped_key] = value
+      end
+
+      macro_method.call(context.call_context, **mapped_arguments)
+    end
+
+    # @return [Method]
+    def macro_template_reference(name, context, lineno, source)
+      if respond_to?(name.to_sym)
+        return method(name.to_sym)
+      end
+
+      parent = self
+      while (parent = parent.get_parent(context))
+        if parent.respond_to?(name.to_sym)
+          return parent.method(name.to_sym)
+        end
+      end
+
+      raise Error::Runtime.new(
+        "Macro \"#{name.delete_prefix('macro_')}\" is not defined in template \"#{template_name}\".",
+        lineno,
+        source
+      )
+    end
+
+    def source_context
+      raise NotImplementedError
+    end
+
+    def traitable?
+      true
+    end
+
+    def unwrap
+      self
     end
 
     private
 
-    # @param [String] name
-    # @return ]Template]
-    def load_template(name, template_name = '', template_line = nil)
-      env.load_template(name, call_context: @call_context, output_buffer: @output_buffer)
+    # @param [String, TemplateWrapper] template
+    # @return [Template]
+    def load(template, line, index = nil)
+      if template.is_a?(Array)
+        return env.resolve_template(template).unwrap
+      end
+
+      if template.is_a?(TemplateWrapper)
+        return template.unwrap
+      end
+
+      if template == template_name
+        klass = self.class.name
+
+        if (pos = klass.rindex('___'))
+          klass = klass[0...pos]
+        end
+      else
+        klass = env.template_class(template)
+      end
+
+      env.load_template(klass, template, index:)
+    rescue Error::Base => e
+      unless e.source_context
+        e.source_context = source_context
+      end
+
+      if e.lineno.positive?
+        raise e
+      end
+
+      if line == -1
+        e.guess
+      else
+        e.lineno = line
+      end
+
+      raise e
+    end
+
+    # Overloaded by children
+    def do_get_parent(context)
+      false
     end
 
     # @return [Environment]