@automattic/vip 4.1.5 → 4.1.6

package/node_modules/ejs/bin/cli.js

@@ -17,202 +17,264 @@
  *
 */
 
-let path = require('path');
+'use strict';
 
+let path = require('path');
+let fs = require('fs');
 let { Parser } = require('../lib/cjs/parseargs');
-
 let ejs = require('../lib/cjs/ejs');
-let { hyphenToCamel } = require('../lib/cjs/utils');
-let fs = require('fs');
-let args = process.argv.slice(2);
-let usage = fs.readFileSync(`${__dirname}/../usage.txt`).toString();
-
-function die(msg) {
-  console.log(msg);
-  process.stdout.write('', function () {
-    process.stderr.write('', function () {
-      process.exit();
-    });
+let pkg = require('../package.json');
+
+let hasOwn = function (obj, key) { return Object.prototype.hasOwnProperty.call(obj, key); };
+
+// If the consumer closes our output pipe (e.g. `ejs ... | head`), writing gets
+// EPIPE. Exit quietly rather than dumping an uncaught stack trace.
+function handlePipeError(stream) {
+  stream.on('error', function (err) {
+    if (err && err.code === 'EPIPE') { process.exit(0); }
+    throw err;
   });
 }
+handlePipeError(process.stdout);
+handlePipeError(process.stderr);
+
+// Exit codes: 2 = usage error, 1 = runtime failure, 0 = success.
+let EXIT_USAGE = 2;
+let EXIT_RUNTIME = 1;
 
-const CLI_OPTS = [
-  { full: 'output-file',
-    abbr: 'o',
-    expectValue: true,
-  },
-  { full: 'data-file',
-    abbr: 'f',
-    expectValue: true,
-  },
-  { full: 'data-input',
-    abbr: 'i',
-    expectValue: true,
-  },
-  { full: 'delimiter',
-    abbr: 'm',
-    expectValue: true,
-    passThrough: true,
-  },
-  { full: 'open-delimiter',
-    abbr: 'p',
-    expectValue: true,
-    passThrough: true,
-  },
-  { full: 'close-delimiter',
-    abbr: 'c',
-    expectValue: true,
-    passThrough: true,
-  },
-  { full: 'strict',
-    abbr: 's',
-    expectValue: false,
-    allowValue: false,
-    passThrough: true,
-  },
-  { full: 'no-with',
-    abbr: 'n',
-    expectValue: false,
-    allowValue: false,
-  },
-  { full: 'locals-name',
-    abbr: 'l',
-    expectValue: true,
-    passThrough: true,
-  },
-  { full: 'rm-whitespace',
-    abbr: 'w',
-    expectValue: false,
-    allowValue: false,
-    passThrough: true,
-  },
-  { full: 'debug',
-    abbr: 'd',
-    expectValue: false,
-    allowValue: false,
-    passThrough: true,
-  },
-  { full: 'help',
-    abbr: 'h',
-    passThrough: true,
-  },
-  { full: 'version',
-    abbr: 'V',
-    passThrough: true,
-  },
-  // Alias lowercase v
-  { full: 'version',
-    abbr: 'v',
-    passThrough: true,
-  },
+let CLI_OPTS = [
+  { full: 'output-file',    abbr: 'o', expectValue: true },
+  { full: 'data-file',      abbr: 'f', expectValue: true },
+  { full: 'data-input',     abbr: 'i', expectValue: true },
+  { full: 'delimiter',      abbr: 'm', expectValue: true },
+  { full: 'open-delimiter', abbr: 'p', expectValue: true },
+  { full: 'close-delimiter', abbr: 'c', expectValue: true },
+  { full: 'locals-name',    abbr: 'l', expectValue: true },
+  { full: 'strict',         abbr: 's' },
+  { full: 'no-with',        abbr: 'n' },
+  { full: 'rm-whitespace',  abbr: 'w' },
+  { full: 'debug',          abbr: 'd' },
+  { full: 'help',           abbr: 'h' },
+  { full: 'version',        abbr: 'V' },
+  { full: 'version',        abbr: 'v' },
 ];
 
-let preempts = {
-  version: function () {
-    die(ejs.VERSION);
-  },
-  help: function () {
-    die(usage);
-  }
+let usage = function () {
+  return fs.readFileSync(path.join(__dirname, '../usage.txt')).toString();
 };
 
-let stdin = '';
-process.stdin.setEncoding('utf8');
-process.stdin.on('readable', () => {
-  let chunk;
-  while ((chunk = process.stdin.read()) !== null) {
-    stdin += chunk;
+let errorMessage = function (e) {
+  switch (e.code) {
+  case 'unknown-option':
+    return "unrecognized option '" + e.arg + "'";
+  case 'missing-value':
+    return "option '" + e.arg + "' requires a value";
+  case 'unexpected-value':
+    return "option '" + e.arg + "' does not take a value";
+  default:
+    return 'bad argument: ' + e.arg;
   }
-});
+};
 
-function run() {
+let usageError = function (msg) {
+  process.stderr.write('ejs: ' + msg + '\n');
+  process.stderr.write("Try 'ejs -h' for more information.\n");
+  process.exitCode = EXIT_USAGE;
+};
 
-  let parser = new Parser(CLI_OPTS);
-  let result = parser.parse(args);
+let runtimeError = function (msg) {
+  process.stderr.write('ejs: ' + msg + '\n');
+  process.exitCode = EXIT_RUNTIME;
+};
 
-  let templatePath = result.taskNames[0];
-  let pVals = result.envVars;
-  let pOpts = {};
+// Build the ejs render options from parsed CLI options.
+let renderOpts = function (opts, template) {
+  let o = { filename: path.resolve(process.cwd(), template) };
+  if (hasOwn(opts, 'delimiter')) { o.delimiter = opts['delimiter']; }
+  if (hasOwn(opts, 'open-delimiter')) { o.openDelimiter = opts['open-delimiter']; }
+  if (hasOwn(opts, 'close-delimiter')) { o.closeDelimiter = opts['close-delimiter']; }
+  if (hasOwn(opts, 'locals-name')) { o.localsName = opts['locals-name']; }
+  if (opts['strict']) { o.strict = true; }
+  if (opts['rm-whitespace']) { o.rmWhitespace = true; }
+  if (opts['debug']) { o.debug = true; }
+  // --strict implies not using `with`, matching the historical CLI behavior.
+  if (opts['strict'] || opts['no-with']) { o._with = false; }
+  return o;
+};
 
-  for (let p in result.opts) {
-    let name = hyphenToCamel(p);
-    pOpts[name] = result.opts[p];
+// Classify the operands after the template into name=value data. Returns a
+// null-prototype object, or throws for an operand that is not a data pair.
+let classifyData = function (operands) {
+  let data = Object.create(null);
+  for (let k = 0; k < operands.length; k++) {
+    let o = operands[k];
+    let eq = o.indexOf('=');
+    if (eq === -1) {
+      throw new Error("unexpected argument '" + o + "' (data must be name=value)");
+    }
+    data[o.slice(0, eq)] = o.slice(eq + 1);
   }
+  return data;
+};
 
-  let opts = {};
-  let vals = {};
-
-  // Same-named 'passthrough' opts
-  CLI_OPTS.forEach((opt) => {
-    let optName = hyphenToCamel(opt.full);
-    if (opt.passThrough && typeof pOpts[optName] != 'undefined') {
-      opts[optName] = pOpts[optName];
-    }
+// Merge without triggering prototype-pollution via setters.
+let safeAssign = function (target, key, value) {
+  Object.defineProperty(target, key, {
+    value: value, writable: true, enumerable: true, configurable: true
   });
+};
 
-  // Bail out for help/version
-  for (let p in opts) {
-    if (preempts[p]) {
-      return preempts[p]();
-    }
+// Read all of stdin, unless it is a TTY (interactive) — then there is nothing
+// piped in. Async so a slow/chunked pipe is fully collected before we resolve
+// data. Help/version/usage errors are dispatched before this is ever called.
+let readStdin = function (cb) {
+  if (process.stdin.isTTY) {
+    cb(null, '');
+    return;
   }
+  let data = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', function (d) { data += d; });
+  process.stdin.on('end', function () { cb(null, data); });
+  process.stdin.on('error', function (err) { cb(err); });
+  process.stdin.resume();
+};
 
-  // Ensure there's a template to render
-  if (!templatePath) {
-    throw new Error('Please provide a template path. (Run ejs -h for help)');
-  }
+function main() {
+  let parsed = new Parser(CLI_OPTS).parse(process.argv.slice(2));
+  let opts = parsed.opts;
 
-  if (opts.strict) {
-    pOpts.noWith = true;
+  // Precedence: help/version win over everything, including parse errors.
+  if (opts['help']) {
+    process.stdout.write(usage());
+    return;
   }
-  if (pOpts.noWith) {
-    opts._with = false;
+  if (opts['version']) {
+    process.stdout.write(pkg.version + '\n');
+    return;
+  }
+  if (parsed.errors.length) {
+    parsed.errors.forEach(function (e) {
+      process.stderr.write('ejs: ' + errorMessage(e) + '\n');
+    });
+    process.stderr.write("Try 'ejs -h' for more information.\n");
+    process.exitCode = EXIT_USAGE;
+    return;
   }
 
-  // Grab and parse any input data, in order of precedence:
-  // 1. Stdin
-  // 2. CLI arg via -i
-  // 3. Data file via -f
-  // Any individual vals passed at the end (e.g., foo=bar) will override
-  // any vals previously set
-  let input;
-  let err = new Error('Please do not pass data multiple ways. Pick one of stdin, -f, or -i.');
-  if (stdin) {
-    input = stdin;
+  // The template is always the first operand; the rest are name=value data.
+  let template = parsed.operands[0];
+  if (template === undefined) {
+    usageError('please provide a template path');
+    return;
   }
-  else if (pOpts.dataInput) {
-    if (input) {
-      throw err;
+
+  let dataArgs = parsed.operands.slice(1);
+  let bare = dataArgs.filter(function (o) { return o.indexOf('=') === -1; });
+  if (bare.length) {
+    // A bare (no '=') operand after the template is not data. If the template
+    // itself looks like name=value, the args are almost certainly reversed.
+    if (template.indexOf('=') !== -1) {
+      usageError("the template path must come first, before data values (got '" +
+        template + "')");
     }
-    input = decodeURIComponent(pOpts.dataInput);
+    else {
+      usageError("unexpected argument '" + bare[0] + "' (data must be name=value)");
+    }
+    return;
+  }
+  let positional = classifyData(dataArgs);
+
+  // -i and -f are the two explicit JSON sources; passing both is a conflict.
+  let hasInput = hasOwn(opts, 'data-input');
+  let hasFile = hasOwn(opts, 'data-file');
+  if (hasInput && hasFile) {
+    usageError('please pass data only one way: stdin, -i, or -f');
+    return;
   }
-  else if (pOpts.dataFile) {
-    if (input) {
-      throw err;
+
+  // stdin is the fallback JSON base: read it ONLY when no other data was given
+  // (no -i, no -f, no name=value). This matches `cat data.json | ejs tpl.ejs`,
+  // and — crucially — means we never block on stdin when data came another way.
+  let needStdin = !hasInput && !hasFile && Object.keys(positional).length === 0;
+  if (!needStdin) {
+    finish(opts, template, positional, '');
+    return;
+  }
+  readStdin(function (streamErr, stdinStr) {
+    if (streamErr) {
+      runtimeError('could not read stdin: ' + streamErr.message);
+      return;
     }
-    input = fs.readFileSync(pOpts.dataFile).toString();
+    finish(opts, template, positional, stdinStr);
+  });
+}
+
+function finish(opts, template, positional, stdinStr) {
+  // Exactly one JSON base source can be present here (main() gates the rest):
+  // stdin only when nothing else was given, and -i/-f are mutually exclusive.
+  let hasStdin = stdinStr.length > 0;
+  let hasInput = hasOwn(opts, 'data-input');
+  let hasFile = hasOwn(opts, 'data-file');
+
+  let raw;
+  try {
+    if (hasStdin) { raw = stdinStr; }
+    else if (hasInput) { raw = decodeURIComponent(opts['data-input']); }
+    else if (hasFile) { raw = fs.readFileSync(opts['data-file'], 'utf8'); }
+  }
+  catch (err) {
+    runtimeError(err.message);
+    return;
   }
 
-  if (input) {
-    vals = JSON.parse(input);
+  let vals = Object.create(null);
+  if (raw !== undefined && raw !== '') {
+    let parsedData;
+    try {
+      parsedData = JSON.parse(raw);
+    }
+    catch (err) {
+      runtimeError('could not parse data as JSON: ' + err.message);
+      return;
+    }
+    // Ignore JSON null / primitives — there are no locals to spread from them.
+    if (parsedData !== null && typeof parsedData === 'object') {
+      Object.keys(parsedData).forEach(function (k) {
+        safeAssign(vals, k, parsedData[k]);
+      });
+    }
   }
 
-  // Override / set any individual values passed from the command line
-  for (let p in pVals) {
-    vals[p] = pVals[p];
+  // name=value operands override data-source values.
+  Object.keys(positional).forEach(function (k) {
+    safeAssign(vals, k, positional[k]);
+  });
+
+  let output;
+  try {
+    let tpl = fs.readFileSync(path.resolve(process.cwd(), template), 'utf8');
+    output = ejs.render(tpl, vals, renderOpts(opts, template));
+  }
+  catch (err) {
+    runtimeError(err.message);
+    return;
   }
 
-  opts.filename = path.resolve(process.cwd(), templatePath);
-  let template = fs.readFileSync(opts.filename).toString();
-  let output = ejs.render(template, vals, opts);
-  if (pOpts.outputFile) {
-    fs.writeFileSync(pOpts.outputFile, output);
+  if (hasOwn(opts, 'output-file')) {
+    try {
+      fs.writeFileSync(opts['output-file'], output);
+    }
+    catch (err) {
+      runtimeError(err.message);
+      return;
+    }
   }
   else {
     process.stdout.write(output);
   }
-  process.exit();
+  // Success: leave process.exitCode at its default (0) and let the process exit
+  // naturally so stdout flushes fully (process.exit() can truncate a pipe).
 }
 
-// Defer execution so that stdin can be read if necessary
-setImmediate(run);
+main();

package/node_modules/ejs/ejs.js

@@ -55,12 +55,6 @@ var _DEFAULT_CLOSE_DELIMITER = '>';
 var _DEFAULT_DELIMITER = '%';
 var _DEFAULT_LOCALS_NAME = 'locals';
 var _REGEX_STRING = '(<%%|%%>|<%=|<%-|<%_|<%#|<%|%>|-%>|_%>)';
-var _OPTS_PASSABLE_WITH_DATA = ['delimiter', 'scope', 'context', 'debug', 'compileDebug',
-    '_with', 'rmWhitespace', 'strict', 'filename', 'async'];
-// We don't allow 'cache' option to be passed in the data obj for
-// the normal `render` call, but this is where Express 2 & 3 put it
-// so we make an exception for `renderFile`
-var _OPTS_PASSABLE_WITH_DATA_EXPRESS = _OPTS_PASSABLE_WITH_DATA.concat('cache');
 var _BOM = /^\uFEFF/;
 var _JS_IDENTIFIER = /^[a-zA-Z_$][0-9a-zA-Z_$]*$/;
 /**
@@ -289,7 +283,8 @@ function includeFile(path, options) {
             if (includerResult.filename) {
                 opts.filename = includerResult.filename;
             }
-            if (includerResult.template) {
+            // An empty string is a valid (empty) template, not "no template"
+            if (includerResult.template || includerResult.template === '') {
                 return handleCache(opts, includerResult.template);
             }
         }
@@ -375,11 +370,6 @@ ejs.compile = function compile(template, opts) {
 ejs.render = function (template, d, o) {
     var data = d || utils_js_1.default.createNullProtoObjWherePossible();
     var opts = o || utils_js_1.default.createNullProtoObjWherePossible();
-    // No options object -- if there are optiony names
-    // in the data, copy them to options
-    if (arguments.length == 2) {
-        utils_js_1.default.shallowCopyFromList(opts, data, _OPTS_PASSABLE_WITH_DATA);
-    }
     return handleCache(opts, template)(data);
 };
 /**
@@ -400,42 +390,30 @@ ejs.renderFile = function () {
     var cb;
     var opts = { filename: filename };
     var data;
-    var viewOpts;
     // Do we have a callback?
     if (typeof arguments[arguments.length - 1] == 'function') {
         cb = args.pop();
     }
     // Do we have data/opts?
     if (args.length) {
-        // Should always have data obj
+        // Should always have data obj; null/undefined means no data
         data = args.shift();
+        if (data == null) {
+            data = utils_js_1.default.createNullProtoObjWherePossible();
+        }
         // Normal passed opts (data obj + opts obj)
         if (args.length) {
             // Use shallowCopy so we don't pollute passed in opts obj with new vals
             utils_js_1.default.shallowCopy(opts, args.pop());
         }
-        // Special casing for Express (settings + opts-in-data)
-        else {
-            // Express 3 and 4
-            if (utils_js_1.default.hasOwn(data, 'settings') && data.settings) {
-                // Pull a few things from known locations
-                if (data.settings.views) {
-                    opts.views = data.settings.views;
-                }
-                if (data.settings['view cache']) {
-                    opts.cache = true;
-                }
-                // Undocumented after Express 2, but still usable, esp. for
-                // items that are unsafe to be passed along with data, like `root`
-                viewOpts = data.settings['view options'];
-                if (viewOpts) {
-                    utils_js_1.default.shallowCopy(opts, viewOpts);
-                }
+        // Express passes app settings in with the data
+        else if (utils_js_1.default.hasOwn(data, 'settings') && data.settings) {
+            if (data.settings.views) {
+                opts.views = data.settings.views;
+            }
+            if (data.settings['view cache']) {
+                opts.cache = true;
             }
-            // Express 2 and lower, values set in app.locals, or people who just
-            // want to pass options in their data. NOTE: These values will override
-            // anything previously set in settings  or settings['view options']
-            utils_js_1.default.shallowCopyFromList(opts, data, _OPTS_PASSABLE_WITH_DATA_EXPRESS);
         }
         opts.filename = filename;
     }
@@ -496,6 +474,34 @@ function Template(text, optsParam) {
     }
     this.opts = options;
     this.regex = this.createRegex();
+    this.tags = buildTags(options);
+}
+// The tag strings for a set of delimiters, built once per template rather
+// than on every scanned token.
+function buildTags(opts) {
+    var o = opts.openDelimiter;
+    var d = opts.delimiter;
+    var c = opts.closeDelimiter;
+    return {
+        eval: o + d,
+        evalSlurp: o + d + '_',
+        escaped: o + d + '=',
+        raw: o + d + '-',
+        comment: o + d + '#',
+        literalOpen: o + d + d,
+        close: d + c,
+        closeTrim: '-' + d + c,
+        closeSlurp: '_' + d + c,
+        literalClose: d + d + c
+    };
+}
+// Count '\n' without allocating an array per token (as split() would).
+function countNewlines(str) {
+    var count = 0;
+    for (var i = str.indexOf('\n'); i !== -1; i = str.indexOf('\n', i + 1)) {
+        count++;
+    }
+    return count;
 }
 Template.modes = {
     EVAL: 'eval',
@@ -667,15 +673,12 @@ Template.prototype = {
                 this.templateText.replace(/[\r\n]+/g, '\n').replace(/^\s+|\s+$/gm, '');
         }
         var self = this;
-        var d = this.opts.delimiter;
-        var o = this.opts.openDelimiter;
-        var c = this.opts.closeDelimiter;
+        var tags = this.tags;
         // Slurp spaces and tabs before opening whitespace slurp tag and after closing whitespace slurp tag
-        // Build the tags using custom delimiters: openDelimiter + delimiter + '_' and '_' + delimiter + closeDelimiter
-        var openWhitespaceSlurpTag = utils_js_1.default.escapeRegExpChars(o + d + '_');
-        var closeWhitespaceSlurpTag = utils_js_1.default.escapeRegExpChars('_' + d + c);
-        var openWhitespaceSlurpReplacement = o + d + '_';
-        var closeWhitespaceSlurpReplacement = '_' + d + c;
+        var openWhitespaceSlurpTag = utils_js_1.default.escapeRegExpChars(tags.evalSlurp);
+        var closeWhitespaceSlurpTag = utils_js_1.default.escapeRegExpChars(tags.closeSlurp);
+        var openWhitespaceSlurpReplacement = tags.evalSlurp;
+        var closeWhitespaceSlurpReplacement = tags.closeSlurp;
         this.templateText =
             this.templateText.replace(new RegExp('[ \\t]*' + openWhitespaceSlurpTag, 'gm'), openWhitespaceSlurpReplacement)
                 .replace(new RegExp(closeWhitespaceSlurpTag + '[ \\t]*', 'gm'), closeWhitespaceSlurpReplacement);
@@ -687,10 +690,10 @@ Template.prototype = {
                 // FIXME: May end up with some false positives here
                 // Better to store modes as k/v with openDelimiter + delimiter as key
                 // Then this can simply check against the map
-                if (line.indexOf(o + d) === 0 // If it is a tag
-                    && line.indexOf(o + d + d) !== 0) { // and is not escaped
+                if (line.indexOf(tags.eval) === 0 // If it is a tag
+                    && line.indexOf(tags.literalOpen) !== 0) { // and is not escaped
                     closing = matches[index + 2];
-                    if (!(closing == d + c || closing == '-' + d + c || closing == '_' + d + c)) {
+                    if (!(closing == tags.close || closing == tags.closeTrim || closing == tags.closeSlurp)) {
                         throw new Error('Could not find matching close tag for "' + line + '".');
                     }
                 }
@@ -744,36 +747,34 @@ Template.prototype = {
     },
     scanLine: function (line) {
         var self = this;
-        var d = this.opts.delimiter;
-        var o = this.opts.openDelimiter;
-        var c = this.opts.closeDelimiter;
-        var newLineCount = 0;
-        newLineCount = (line.split('\n').length - 1);
+        var tags = this.tags;
+        var newLineCount = countNewlines(line);
         switch (line) {
-            case o + d:
-            case o + d + '_':
+            case tags.eval:
+            case tags.evalSlurp:
                 this.mode = Template.modes.EVAL;
                 break;
-            case o + d + '=':
+            case tags.escaped:
                 this.mode = Template.modes.ESCAPED;
                 break;
-            case o + d + '-':
+            case tags.raw:
                 this.mode = Template.modes.RAW;
                 break;
-            case o + d + '#':
+            case tags.comment:
                 this.mode = Template.modes.COMMENT;
                 break;
-            case o + d + d:
+            case tags.literalOpen:
                 this.mode = Template.modes.LITERAL;
-                this.source += '    ; __append("' + line.replace(o + d + d, o + d) + '")' + '\n';
+                // JSON.stringify quotes delimiter chars like " and \ safely
+                this.source += '    ; __append(' + JSON.stringify(tags.eval) + ')' + '\n';
                 break;
-            case d + d + c:
+            case tags.literalClose:
                 this.mode = Template.modes.LITERAL;
-                this.source += '    ; __append("' + line.replace(d + d + c, d + c) + '")' + '\n';
+                this.source += '    ; __append(' + JSON.stringify(tags.close) + ')' + '\n';
                 break;
-            case d + c:
-            case '-' + d + c:
-            case '_' + d + c:
+            case tags.close:
+            case tags.closeTrim:
+            case tags.closeSlurp:
                 if (this.mode == Template.modes.LITERAL) {
                     this._addOutput(line);
                 }
@@ -989,37 +990,6 @@ utils.shallowCopy = function (to, from) {
     }
     return to;
 };
-/**
- * Naive copy of a list of key names, from one object to another.
- * Only copies property if it is actually defined
- * Does not recurse into non-scalar properties
- *
- * @param  {Object} to   Destination object
- * @param  {Object} from Source object
- * @param  {Array} list List of properties to copy
- * @return {Object}      Destination object
- * @static
- * @private
- */
-utils.shallowCopyFromList = function (to, from, list) {
-    list = list || [];
-    from = from || {};
-    if ((to !== null) && (to !== undefined)) {
-        for (var i = 0; i < list.length; i++) {
-            var p = list[i];
-            if (typeof from[p] != 'undefined') {
-                if (!hasOwn(from, p)) {
-                    continue;
-                }
-                if (p === '__proto__' || p === 'constructor') {
-                    continue;
-                }
-                to[p] = from[p];
-            }
-        }
-    }
-    return to;
-};
 /**
  * Simple in-process cache implementation. Does not implement limits of any
  * sort.