@memberjunction/templates 6.2.0-edge.3 → 6.2.0-edge.5

package/README.md

@@ -85,6 +85,10 @@ if (result.Success) {
 }
 ```
 
+Stored templates are HTML-escaped by default. For plain text a model reads (AI prompt templates), pass
+`{ autoescape: false }` as the sixth argument: `Affineur & Owner` then stays `Affineur & Owner`. The raw render keeps
+the registered extensions, and a `{% template %}` embed inside it renders raw too.
+
 ### Simple Template Rendering
 
 For ad-hoc templates not stored in the database:
@@ -109,6 +113,23 @@ const subject = await engine.RenderTemplateSimple(
 // subject.Output: "Acme & Co — your invite"  (no entity encoding)
 ```
 
+### Variables a Template Reads
+
+`GetReferencedVariables()` parses a template's text and returns the top-level variable names it reads:
+
+```typescript
+const result = engine.GetReferencedVariables('{% for r in rows %}{{ r.name }}{% endfor %}{{ user.email }}');
+// result.Names: rows, r, user
+// result.Complete: true
+```
+
+- `Names` holds top-level names only: `{{ user.email }}` gives `user`. It also holds loop, `set`, filter and keyword-argument names, so treat it as a superset of the data keys the template reads.
+- The analysis follows stored templates named by a string literal in `{% include %}`, `{% import %}`, `{% from %}`, `{% extends %}` and `{% template %}`, and reads every content of each one. It does not follow a template named by an expression.
+- Of the custom tags, the analysis follows `{% template %}` and reads the arguments and body of `{% AIPrompt %}`. A tag from any other extension makes the result incomplete, because the extension's code can read data that the template text does not show.
+- `Complete: false` means "unknown", not "none". `Reason` tells why: a template is named by an expression, a named template does not exist or cannot be loaded, the text does not parse, or a tag comes from an extension the analysis does not know. A caller that keeps only the referenced data must keep all of it when the result is incomplete.
+- The engine returns the same frozen result for the same template text until `ClearTemplateCache()`. It does not cache a result with `ParseFailed: true` (the text, or a template it pulls in, does not parse).
+- The method sets up the Nunjucks environment and the registered extensions first, so it gives the same answer before and after the first `Config()`.
+
 ### Custom Nunjucks Filters
 
 The engine provides built-in filters for JSON operations:
@@ -124,6 +145,68 @@ The engine provides built-in filters for JSON operations:
 {% set parsed = jsonString | jsonparse %}
 ```
 
+### Template Sandbox
+
+Users can edit stored templates, so the engine guards nunjucks when this package loads
+(`HardenNunjucksRuntime()`). The guard is process-wide: it also covers nunjucks environments that
+other packages create, and templates loaded through `include` and `import`. It checks templates at
+two points.
+
+**Before a template compiles.** The nunjucks compiler copies names from the template into the code it
+generates, so `AssertTemplateTreeIsSafe()` checks every parsed template first:
+
+- Variable, filter, loop, `set`, macro, import and block names must be plain names: letters,
+  combining marks, digits, connector characters such as `_`, and `$`. A filter name can also contain
+  dots.
+- A test name (`is defined`, `is none`) and an extension's registered name and method must not
+  contain a quote, a backslash or a line break.
+- A name that every object inherits (a member of `Object.prototype`, such as `toString`,
+  `hasOwnProperty` or `constructor`), or `prototype`, must not be used as a dictionary key, a keyword
+  argument, a macro or call-block argument, a `set`, loop, import, macro or block name, or a filter or
+  test name. The code generator also refuses such a name as a dictionary key or keyword argument. Bare
+  names and member reads are not in this rule: `{{ constructor }}` reads only an own key of the render
+  data, and a member read such as `obj.constructor` or `value.toLocaleString()` goes through the
+  render-time member check (see below).
+- The name of a called member, such as `obj["key"]()`, must not contain a backslash or a line break.
+- A loop variable must not reuse an identifier that the generated loop code uses, such as `context`,
+  `frame`, `runtime`, `env`, `cb`, `next`, `tasks` or `undefined`. A unit test compiles every kind of
+  loop body with nunjucks 3.2.4, including loops inside macros and blocks, and checks this list against
+  the generated code, so a nunjucks upgrade that adds an identifier fails the test.
+- The parse tree may hold only nunjucks nodes, plain values and regular expression literals. This
+  matters only for extensions, which build their own nodes.
+
+**While a template renders.**
+
+- A filter, test or global resolves only to a name that the environment registered itself, never to a
+  member that every object inherits. This also covers the test names that the `select` and `reject`
+  filters receive while the template renders. Such a name must be text, a number or another simple
+  value such as `none`; an object, a function or a symbol is refused.
+- The member names `constructor`, `prototype` and the `__define/lookup Getter/Setter__` accessors read
+  as empty unless they hold an object's own data that is not a function. `__proto__` always reads as
+  empty. This applies to a literal member name (`obj.name`, `obj["name"]`) and to one computed while
+  the template renders (`obj[key]`) alike.
+- A bare name such as `{{ user }}` resolves only to a template variable, an own key of the render data,
+  or an own environment global. It never resolves to a property that the data or the globals inherit,
+  such as `valueOf`.
+- A macro or call-block argument that a call leaves out is filled only from a keyword argument of the
+  same name that the call itself passes, never from a member that the keyword arguments inherit, so
+  otherwise it reads as empty. Keyword arguments written at a call site must be a plain object literal
+  with ordinary names; keyword arguments passed as a value (from render data, for example) are read
+  through a copy of their own keys.
+- A template must not read a member of the render context, an environment, a loader, a frame, a
+  template or a nunjucks module. A lookup or call that would return one of them fails.
+- A template must not reach `Function` (or its async and generator variants), `eval`, `Object`,
+  `Reflect`, `globalThis` or `process`.
+
+A template that breaks one of these rules fails with a `TemplateSandboxError`.
+
+The guard blocks reflection and code injection, not ordinary methods. Pass templates plain data, not
+objects whose methods reach the database or the file system (for example `BaseEntity` instances).
+
+The `RunTemplate` mutation and the `Template.Run` remote operation also apply
+`GetTemplateRunRefusal()` before they load anything: they refuse scope-limited sessions and callers
+without read permission on `MJ: Templates` and `MJ: Template Contents`.
+
 ### Template Extensions
 
 Extensions are registered via the MJ class factory:
@@ -153,9 +236,10 @@ graph LR
 | `Config()` | method | Load metadata and initialize Nunjucks environment |
 | `RenderTemplate()` | method | Render a stored template with validation |
 | `RenderTemplateSimple()` | method | Render an ad-hoc template string |
+| `GetReferencedVariables()` | method | List the top-level variables a template's text reads |
 | `AddTemplate()` | method | Add a template to the Nunjucks loader |
 | `SetupNunjucks()` | method | Re-initialize the Nunjucks environment |
-| `ClearTemplateCache()` | method | Clear cached compiled templates |
+| `ClearTemplateCache()` | method | Clear cached compiled templates and variable analysis results |
 
 ### Rendering Process
 

package/dist/InheritedMemberNames.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview The one list of names that the template sandbox refuses wherever a template names something.
+ * @module @memberjunction/templates
+ */
+/**
+ * True for a name that a template may not use as a dictionary key, a keyword argument, a macro or call-block
+ * argument, a variable, macro or block name, or a filter or test name. nunjucks reads and writes such names
+ * on plain objects, where they reach inherited members or the object's prototype.
+ * @param name the name as nunjucks uses it
+ */
+export declare function IsInheritedMemberName(name: string): boolean;
+//# sourceMappingURL=InheritedMemberNames.d.ts.map

package/dist/InheritedMemberNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InheritedMemberNames.d.ts","sourceRoot":"","sources":["../src/InheritedMemberNames.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/InheritedMemberNames.js

@@ -0,0 +1,19 @@
+/**
+ * @fileoverview The one list of names that the template sandbox refuses wherever a template names something.
+ * @module @memberjunction/templates
+ */
+/**
+ * The members of `Object.prototype`, which every plain object inherits (such as `constructor`, `toString`
+ * and `__proto__`), and `prototype`, which leads from a constructor to what its instances inherit.
+ */
+const INHERITED_MEMBER_NAMES = new Set([...Object.getOwnPropertyNames(Object.prototype), 'prototype']);
+/**
+ * True for a name that a template may not use as a dictionary key, a keyword argument, a macro or call-block
+ * argument, a variable, macro or block name, or a filter or test name. nunjucks reads and writes such names
+ * on plain objects, where they reach inherited members or the object's prototype.
+ * @param name the name as nunjucks uses it
+ */
+export function IsInheritedMemberName(name) {
+    return INHERITED_MEMBER_NAMES.has(name);
+}
+//# sourceMappingURL=InheritedMemberNames.js.map

package/dist/InheritedMemberNames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InheritedMemberNames.js","sourceRoot":"","sources":["../src/InheritedMemberNames.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AAE5H;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAC9C,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/dist/NunjucksCompileGuard.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Checks a parsed nunjucks template, and throws a {@link TemplateSandboxError} if a name in it could
+ * change the code the compiler generates:
+ * - every variable, filter, loop, `set`, macro, import and block name must be a plain name (letters,
+ *   combining marks, digits, connector punctuation such as `_`, and `$`); a filter name can also contain dots
+ * - a test name, and an extension's registered name and method, must not contain a quote, a backslash or a line break
+ * - a name that every object inherits (`toString`, `hasOwnProperty`, ...), or `prototype`, must not be a
+ *   dictionary key, a keyword argument, a macro or call-block argument, a `set`, loop, import, macro or
+ *   block name, or a filter or test name
+ * - the name of a called member must not contain a backslash or a line break
+ * - a loop variable must not reuse an identifier that the generated loop code uses (`context`, `frame`,
+ *   `runtime`, `tasks`, `undefined`, ...)
+ * - the tree must hold only nunjucks nodes, plain values and regular expression literals
+ * @param tree the root node the nunjucks parser returns
+ */
+export declare function AssertTemplateTreeIsSafe(tree: unknown): void;
+//# sourceMappingURL=NunjucksCompileGuard.d.ts.map

package/dist/NunjucksCompileGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NunjucksCompileGuard.d.ts","sourceRoot":"","sources":["../src/NunjucksCompileGuard.ts"],"names":[],"mappings":"AA6DA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE5D"}

package/dist/NunjucksCompileGuard.js

@@ -0,0 +1,273 @@
+/**
+ * @fileoverview Refuses nunjucks templates whose names could change the code nunjucks compiles.
+ *
+ * The nunjucks 3.2.4 compiler copies template-controlled names into the JavaScript it generates
+ * without escaping them. That covers variable, filter, test and loop names; the names that `set`,
+ * `macro`, `import` and `from` bind; and the name of a called member. The generated code runs when
+ * the template renders, so the runtime guard in `NunjucksSandbox.ts` never sees it. nunjucks also
+ * reads and writes template names as keys of plain objects, so a name that every object inherits is
+ * refused as a key, an argument or a binding. Bare names and member reads are left to the runtime guard.
+ * {@link AssertTemplateTreeIsSafe} checks a parsed template before it compiles.
+ * @module @memberjunction/templates
+ */
+import nunjucks from 'nunjucks';
+import { IsInheritedMemberName } from './InheritedMemberNames.js';
+import { TemplateSandboxError } from './TemplateSandboxError.js';
+const NUNJUCKS = nunjucks;
+/**
+ * Letters, combining marks, decimal digits, connector punctuation (such as `_`) and `$`. Each one is safe
+ * inside a JavaScript string. In a raw identifier, a character that cannot start it (a digit, a mark, or
+ * connector punctuation other than `_`) or cannot appear in it at all (U+2E2F) only makes the generated
+ * code fail with a SyntaxError.
+ */
+const PLAIN_NAME = /^[\p{L}\p{Mn}\p{Mc}\p{Nd}\p{Pc}$]+$/u;
+/** A filter name can also contain dots (`{{ x | ns.filter }}`). */
+const PLAIN_FILTER_NAME = /^[\p{L}\p{Mn}\p{Mc}\p{Nd}\p{Pc}$]+(?:\.[\p{L}\p{Mn}\p{Mc}\p{Nd}\p{Pc}$]+)*$/u;
+/** Characters that end a double-quoted JavaScript string, or escape out of it. */
+const UNSAFE_STRING_CHARACTERS = /["\\\r\n\u2028\u2029]/;
+/** The compiler escapes `"` in a called member's name, so only these characters can end that string. */
+const UNSAFE_CALL_NAME_CHARACTERS = /[\\\r\n\u2028\u2029]/;
+/**
+ * Identifiers that the generated code of a loop body uses (nunjucks 3.2.4). An async loop binds its loop
+ * variables as raw function parameters, so a loop variable with one of these names shadows them.
+ * `NunjucksCompileGuard.test.ts` compiles every kind of loop body and checks this list against the
+ * generated code.
+ */
+const RESERVED_LOOP_NAMES = new Set([
+    'env', 'context', 'frame', 'runtime', 'cb', 'next', 'lineno', 'colno', 'output', 'tasks',
+    'parentTemplate', 'callerFrame', 'kwargs', 'Object', 'Math', 'Error', 'undefined', 'Infinity',
+]);
+/** Prefixes of generated identifiers: temporaries (`t_3`, `macro_t_3`, `hole_0`), blocks (`b_`), macro arguments (`l_`). */
+const RESERVED_LOOP_NAME_PREFIX = /^(?:t|macro_t|hole|b|l)_/;
+/**
+ * Checks a parsed nunjucks template, and throws a {@link TemplateSandboxError} if a name in it could
+ * change the code the compiler generates:
+ * - every variable, filter, loop, `set`, macro, import and block name must be a plain name (letters,
+ *   combining marks, digits, connector punctuation such as `_`, and `$`); a filter name can also contain dots
+ * - a test name, and an extension's registered name and method, must not contain a quote, a backslash or a line break
+ * - a name that every object inherits (`toString`, `hasOwnProperty`, ...), or `prototype`, must not be a
+ *   dictionary key, a keyword argument, a macro or call-block argument, a `set`, loop, import, macro or
+ *   block name, or a filter or test name
+ * - the name of a called member must not contain a backslash or a line break
+ * - a loop variable must not reuse an identifier that the generated loop code uses (`context`, `frame`,
+ *   `runtime`, `tasks`, `undefined`, ...)
+ * - the tree must hold only nunjucks nodes, plain values and regular expression literals
+ * @param tree the root node the nunjucks parser returns
+ */
+export function AssertTemplateTreeIsSafe(tree) {
+    new TemplateTreeCheck().Visit(tree);
+}
+/**
+ * One pass over a parse tree. It visits every own property of every node, not only the fields
+ * nunjucks lists, because the parser stores some compiled parts outside them (the body of a `set` block).
+ */
+class TemplateTreeCheck {
+    constructor() {
+        this.visited = new WeakSet();
+        this.filterNames = new WeakSet();
+    }
+    /**
+     * Checks a value of the tree and everything under it.
+     * @param owner the node whose field holds the value
+     * @param field the name of that field
+     */
+    Visit(value, owner, field) {
+        if (Array.isArray(value)) {
+            asArray(value).forEach((item) => this.Visit(item, owner, field));
+            return;
+        }
+        if (!isNode(value)) {
+            if (!isPlainValue(value) && !isPatternLiteral(value, owner, field)) {
+                throw refusal('Template parse trees may only hold nunjucks nodes, plain values and regular expressions', owner);
+            }
+            return;
+        }
+        if (this.visited.has(value)) {
+            return;
+        }
+        this.visited.add(value);
+        this.checkNode(value);
+        for (const key of Object.keys(value)) {
+            this.Visit(property(value, key), value, key);
+        }
+    }
+    checkNode(node) {
+        switch (node.typename) {
+            case 'Symbol':
+                return this.checkName(node, node, this.filterNames.has(node) ? PLAIN_FILTER_NAME : PLAIN_NAME);
+            case 'Pair':
+                return this.refuseInheritedName(nameValue(property(node, 'key')), node, 'a dictionary key or keyword argument');
+            case 'Filter':
+            case 'FilterAsync':
+                return this.checkFilterName(node);
+            case 'Is':
+                return this.checkTestName(node);
+            case 'FunCall':
+                return this.checkCallName(node);
+            case 'Set':
+                return asArray(property(node, 'targets')).forEach((target) => this.checkBindingName(target, node));
+            case 'For':
+            case 'AsyncEach':
+            case 'AsyncAll':
+                return this.checkLoopNames(node);
+            case 'Macro':
+            case 'Caller':
+                return this.checkMacroNames(node);
+            case 'Import':
+                return this.checkBindingName(property(node, 'target'), node);
+            case 'FromImport':
+                return this.checkImportedNames(node);
+            case 'Block':
+                return this.checkBindingName(property(node, 'name'), node);
+            case 'Super':
+                return this.checkName(property(node, 'blockName'), node);
+            case 'CallExtension':
+            case 'CallExtensionAsync':
+                return this.checkExtensionCall(node);
+            default:
+                return;
+        }
+    }
+    /** A name the compiler copies as written: a symbol or a quoted string that is a plain name. */
+    checkName(nameNode, owner, pattern = PLAIN_NAME) {
+        const name = nameValue(nameNode);
+        if (name === undefined || !pattern.test(name)) {
+            throw refusal('Templates may only use plain names (letters, marks, digits, _ and $)', owner);
+        }
+    }
+    /** The one rule for every position that names something: a name that `IsInheritedMemberName` matches is refused. */
+    refuseInheritedName(name, owner, position) {
+        if (name !== undefined && IsInheritedMemberName(name)) {
+            throw refusal(`Templates may not use "${name}" as ${position}`, owner);
+        }
+    }
+    /** A name that `set`, a loop, `import`, `from` or `macro` binds as a variable, or a block name. */
+    checkBindingName(nameNode, owner) {
+        this.checkName(nameNode, owner);
+        this.refuseInheritedName(nameValue(nameNode), owner, 'a variable, macro or block name');
+    }
+    /** nunjucks finds a filter in a plain object, so a name it inherits would resolve to the inherited member. */
+    checkFilterName(node) {
+        const name = property(node, 'name');
+        if (isNode(name)) {
+            this.filterNames.add(name);
+        }
+        this.checkName(name, node, PLAIN_FILTER_NAME);
+        this.refuseInheritedName(nameValue(name), node, 'a filter or test name');
+    }
+    /** The compiler writes the test name into a double-quoted string, as text and without escaping it. */
+    checkTestName(node) {
+        const name = testName(node);
+        if (UNSAFE_STRING_CHARACTERS.test(name)) {
+            throw refusal('Templates may not use a test name that contains a quote, a backslash or a line break', node);
+        }
+        this.refuseInheritedName(name, node, 'a filter or test name');
+    }
+    /** The compiler writes the called expression's name, built by its own `_getNodeName`, into a string. */
+    checkCallName(node) {
+        let name;
+        try {
+            const compiler = NUNJUCKS.compiler.Compiler.prototype;
+            name = compiler._getNodeName.call(compiler, property(node, 'name'));
+        }
+        catch {
+            name = undefined;
+        }
+        if (typeof name !== 'string' || UNSAFE_CALL_NAME_CHARACTERS.test(name)) {
+            throw refusal('Templates may not call a member whose name contains a backslash or a line break', node);
+        }
+    }
+    checkLoopNames(node) {
+        const name = property(node, 'name');
+        const loopNames = isNode(name) && name.typename === 'Array' ? asArray(property(name, 'children')) : [name];
+        for (const loopName of loopNames) {
+            this.checkBindingName(loopName, node);
+            const value = nameValue(loopName) ?? '';
+            if (RESERVED_LOOP_NAMES.has(value) || RESERVED_LOOP_NAME_PREFIX.test(value)) {
+                throw refusal(`Templates may not use "${value}" as a loop variable`, node);
+            }
+        }
+    }
+    /** Positional arguments, and the keys of a trailing keyword-argument dictionary, become names. */
+    checkMacroNames(node) {
+        this.checkBindingName(property(node, 'name'), node);
+        const args = asArray(property(property(node, 'args'), 'children'));
+        args.forEach((arg, index) => {
+            const isKeywordArguments = index === args.length - 1 && isNode(arg) && (arg.typename === 'Dict' || arg.typename === 'KeywordArgs');
+            if (!isKeywordArguments) {
+                this.checkArgumentName(arg, node);
+                return;
+            }
+            asArray(property(arg, 'children')).forEach((pair) => this.checkArgumentName(property(pair, 'key'), node));
+        });
+    }
+    /**
+     * A macro or call-block argument. When a call leaves out a positional argument, nunjucks fills it from the
+     * call's keyword arguments, so an argument named after a member every object inherits would read that member.
+     */
+    checkArgumentName(nameNode, owner) {
+        this.checkName(nameNode, owner);
+        this.refuseInheritedName(nameValue(nameNode), owner, 'a macro or call-block argument');
+    }
+    /** The names `from ... import` reads from the imported template, and the names it binds. */
+    checkImportedNames(node) {
+        for (const entry of asArray(property(property(node, 'names'), 'children'))) {
+            if (isNode(entry) && entry.typename === 'Pair') {
+                this.checkBindingName(property(entry, 'key'), node);
+                this.checkBindingName(property(entry, 'value'), node);
+            }
+            else {
+                this.checkBindingName(entry, node);
+            }
+        }
+    }
+    /** The compiler writes an extension tag's registered name and method into double-quoted strings. */
+    checkExtensionCall(node) {
+        for (const value of [property(node, 'extName'), property(node, 'prop')]) {
+            if (typeof value !== 'string' || UNSAFE_STRING_CHARACTERS.test(value)) {
+                throw refusal('Template extensions must have names without a quote, a backslash or a line break', node);
+            }
+        }
+    }
+}
+/**
+ * The test name as the compiler writes it: the text of the called name's value for `is test(...)`,
+ * else the text of the test's own value. `is none` gives `"null"`.
+ */
+function testName(node) {
+    const test = property(node, 'right');
+    const calledName = property(test, 'name');
+    return String(calledName ? property(calledName, 'value') : property(test, 'value'));
+}
+function isNode(value) {
+    return value instanceof NUNJUCKS.nodes.Node;
+}
+/** `undefined`, `null`, a string, a number or a boolean. */
+function isPlainValue(value) {
+    return value === undefined || value === null || typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean';
+}
+/** A regular expression literal (`r/.../`), which the parser stores as the value of a Literal node. */
+function isPatternLiteral(value, owner, field) {
+    return value instanceof RegExp && owner?.typename === 'Literal' && field === 'value';
+}
+/** A node's field, or `undefined` when the value is not a node. */
+function property(node, key) {
+    return isNode(node) ? node[key] : undefined;
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+/** The text of a symbol or of a quoted string, or `undefined` for any other node. */
+function nameValue(node) {
+    if (!isNode(node) || (node.typename !== 'Symbol' && node.typename !== 'Literal')) {
+        return undefined;
+    }
+    const value = property(node, 'value');
+    return typeof value === 'string' ? value : undefined;
+}
+/** The error for a refused template, with the node's position when the node has one. */
+function refusal(reason, node) {
+    const hasPosition = node !== undefined && Number.isInteger(node.lineno) && Number.isInteger(node.colno);
+    return new TemplateSandboxError(hasPosition ? `${reason} (line ${node.lineno + 1}, column ${node.colno + 1})` : reason);
+}
+//# sourceMappingURL=NunjucksCompileGuard.js.map

package/dist/NunjucksCompileGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NunjucksCompileGuard.js","sourceRoot":"","sources":["../src/NunjucksCompileGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAc9D,MAAM,QAAQ,GAAG,QAAwC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAE1D,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,8EAA8E,CAAC;AAEzG,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAEzD,wGAAwG;AACxG,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACrD,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO;IACxF,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU;CAChG,CAAC,CAAC;AAEH,4HAA4H;AAC5H,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAE7D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAa;IAClD,IAAI,iBAAiB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB;IAAvB;QACqB,YAAO,GAAG,IAAI,OAAO,EAAgB,CAAC;QACtC,gBAAW,GAAG,IAAI,OAAO,EAAgB,CAAC;IA+K/D,CAAC;IA7KG;;;;OAIG;IACI,KAAK,CAAC,KAAc,EAAE,KAAoB,EAAE,KAAc;QAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YACjE,OAAO;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,OAAO,CAAC,yFAAyF,EAAE,KAAK,CAAC,CAAC;YACpH,CAAC;YACD,OAAO;QACX,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,IAAkB;QAChC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,KAAK,QAAQ;gBACT,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACnG,KAAK,MAAM;gBACP,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,sCAAsC,CAAC,CAAC;YACpH,KAAK,QAAQ,CAAC;YACd,KAAK,aAAa;gBACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACtC,KAAK,IAAI;gBACL,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACpC,KAAK,SAAS;gBACV,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACpC,KAAK,KAAK;gBACN,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YACvG,KAAK,KAAK,CAAC;YACX,KAAK,WAAW,CAAC;YACjB,KAAK,UAAU;gBACX,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACrC,KAAK,OAAO,CAAC;YACb,KAAK,QAAQ;gBACT,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACtC,KAAK,QAAQ;gBACT,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;YACjE,KAAK,YAAY;gBACb,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACzC,KAAK,OAAO;gBACR,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YAC/D,KAAK,OAAO;gBACR,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7D,KAAK,eAAe,CAAC;YACrB,KAAK,oBAAoB;gBACrB,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACzC;gBACI,OAAO;QACf,CAAC;IACL,CAAC;IAED,+FAA+F;IACvF,SAAS,CAAC,QAAiB,EAAE,KAAmB,EAAE,UAAkB,UAAU;QAClF,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,OAAO,CAAC,sEAAsE,EAAE,KAAK,CAAC,CAAC;QACjG,CAAC;IACL,CAAC;IAED,oHAAoH;IAC5G,mBAAmB,CAAC,IAAwB,EAAE,KAAmB,EAAE,QAAgB;QACvF,IAAI,IAAI,KAAK,SAAS,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,CAAC,0BAA0B,IAAI,QAAQ,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;IACL,CAAC;IAED,mGAAmG;IAC3F,gBAAgB,CAAC,QAAiB,EAAE,KAAmB;QAC3D,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,iCAAiC,CAAC,CAAC;IAC5F,CAAC;IAED,8GAA8G;IACtG,eAAe,CAAC,IAAkB;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC9C,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC7E,CAAC;IAED,sGAAsG;IAC9F,aAAa,CAAC,IAAkB;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,CAAC,sFAAsF,EAAE,IAAI,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAClE,CAAC;IAED,wGAAwG;IAChG,aAAa,CAAC,IAAkB;QACpC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YACtD,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACL,IAAI,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,OAAO,CAAC,iFAAiF,EAAE,IAAI,CAAC,CAAC;QAC3G,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,IAAkB;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3G,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,OAAO,CAAC,0BAA0B,KAAK,sBAAsB,EAAE,IAAI,CAAC,CAAC;YAC/E,CAAC;QACL,CAAC;IACL,CAAC;IAED,kGAAkG;IAC1F,eAAe,CAAC,IAAkB;QACtC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACxB,MAAM,kBAAkB,GAAG,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC;YACnI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACtB,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAClC,OAAO;YACX,CAAC;YACD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9G,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,QAAiB,EAAE,KAAmB;QAC5D,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,gCAAgC,CAAC,CAAC;IAC3F,CAAC;IAED,4FAA4F;IACpF,kBAAkB,CAAC,IAAkB;QACzC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACzE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC7C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;gBACpD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC;QACL,CAAC;IACL,CAAC;IAED,oGAAoG;IAC5F,kBAAkB,CAAC,IAAkB;QACzC,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpE,MAAM,OAAO,CAAC,kFAAkF,EAAE,IAAI,CAAC,CAAC;YAC5G,CAAC;QACL,CAAC;IACL,CAAC;CACJ;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,IAAkB;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC1B,OAAO,KAAK,YAAY,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY,CAAC,KAAc;IAChC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,CAAC;AACzI,CAAC;AAED,uGAAuG;AACvG,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAA+B,EAAE,KAAyB;IAChG,OAAO,KAAK,YAAY,MAAM,IAAI,KAAK,EAAE,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC;AACzF,CAAC;AAED,mEAAmE;AACnE,SAAS,QAAQ,CAAC,IAAa,EAAE,GAAW;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAyD,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtG,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,IAAa;IAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QAC/E,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,wFAAwF;AACxF,SAAS,OAAO,CAAC,MAAc,EAAE,IAA8B;IAC3D,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxG,OAAO,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,IAAI,CAAC,MAAM,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5H,CAAC"}

package/dist/NunjucksSandbox.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Guards the nunjucks parser, code generator and runtime used by every nunjucks environment in this process. After this call:
+ * - a template whose names could change the compiled code fails to compile (see `AssertTemplateTreeIsSafe`)
+ * - a macro or call-block argument that a call leaves out is filled only from a keyword argument that the
+ *   call itself passes under that name, never from a member the keyword arguments inherit, so otherwise it
+ *   reads as empty
+ * - keyword arguments written at a call site must be an ordinary object literal: ones that inherit from anything
+ *   but `Object.prototype`, or that use a name that every object inherits (or `prototype`), throw, and the code
+ *   generator refuses such a name as a dictionary key or keyword argument too; keyword arguments passed as a
+ *   value (from render data, for example) are read through a copy of their own keys
+ * - a filter, test or global resolves only to a name the environment registered itself, never to a member
+ *   that every object inherits (such as `hasOwnProperty`); an object, a function or a symbol is refused as the name
+ * - a member named `constructor`, `prototype`, `__proto__` or one of the `__define/lookup Getter/Setter__`
+ *   accessors, written literally or computed while rendering, reads as `undefined`, unless it is an object's
+ *   own data that is not a function; `__proto__` always reads as `undefined`
+ * - a bare name resolves only to a template variable, an own key of the render data, or an own environment
+ *   global, never to a property that the render data or the globals inherit
+ * - a template may not read a member of the render context, an environment, a loader, a frame, a
+ *   template or a nunjucks module, and a lookup or call that would return one of them throws
+ * - a lookup or call that would produce or use `Function` (or its async and generator variants), `eval`,
+ *   `Object`, `Reflect`, `globalThis` or `process` throws a {@link TemplateSandboxError}
+ *
+ * Safe to call any number of times: a hook that already carries the guard is left as it is.
+ */
+export declare function HardenNunjucksRuntime(): void;
+//# sourceMappingURL=NunjucksSandbox.d.ts.map

package/dist/NunjucksSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NunjucksSandbox.d.ts","sourceRoot":"","sources":["../src/NunjucksSandbox.ts"],"names":[],"mappings":"AAiIA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAY5C"}