@nci-gis/js-tmpl 0.1.1 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nci-gis/js-tmpl",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "The pure JavaScript templating engine that uses handlebars.",
   "type": "module",
   "bin": {

package/src/config/valuePartials.js

@@ -24,7 +24,7 @@ function placeInTree(tree, chain, value) {
   let cur = tree;
   for (let i = 0; i < chain.length - 1; i++) {
     const seg = chain[i];
-    if (!(seg in cur)) {
+    if (!Object.hasOwn(cur, seg)) {
       cur[seg] = {};
     }
     cur = /** @type {Record<string, unknown>} */ (cur[seg]);

package/src/config/view.js

@@ -48,7 +48,7 @@ export function buildView(args = {}) {
  * @param {string} valuesDir
  */
 function assertReservedEnvNotInPartials(partials, valuesDir) {
-  if (RESERVED_ENV in partials) {
+  if (Object.hasOwn(partials, RESERVED_ENV)) {
     throw new Error(
       `Value partial conflicts with reserved 'env' namespace.\n` +
         `  Source: ${valuesDir} produced a top-level 'env' namespace.\n` +
@@ -73,7 +73,7 @@ function assertNoRootNamespaceCollision(
     if (key === RESERVED_ENV) {
       continue;
     }
-    if (key in partials) {
+    if (Object.hasOwn(partials, key)) {
       throw new Error(
         `Duplicate view key '${key}' — registered by both:\n` +
           `  - ${valuesFile} top-level key\n` +
@@ -87,7 +87,7 @@ function assertNoRootNamespaceCollision(
  * @param {Record<string, unknown>} values
  */
 function warnOnReservedEnvInValuesFile(values) {
-  if (RESERVED_ENV in values) {
+  if (Object.hasOwn(values, RESERVED_ENV)) {
     console.warn(
       'Warning: "env" is a reserved key in js-tmpl and will be overwritten.\n' +
         'Rename the "env" key in your values file to avoid this.',
@@ -109,7 +109,7 @@ export function pickEnv({ keys = [], prefix = '' }, source = process.env) {
   const result = {};
 
   for (const k of keys) {
-    if (k in source) {
+    if (Object.hasOwn(source, k)) {
       result[k] = /** @type {string} */ (source[k]);
     }
   }

package/src/engine/treeWalker.js

@@ -27,6 +27,10 @@ function shouldSkipSubtree(rel, view) {
  * prune the subtree before any filesystem descent (early-exit — no
  * `stat`/`readdir` on skipped paths).
  *
+ * Symbolic links are followed. A directory that resolves to one of its own
+ * ancestors throws instead of looping; the same directory linked from two
+ * places (no cycle) is walked twice.
+ *
  * @param {string} rootDir
  * @param {(string | { ext?: string, view?: Record<string, unknown> })} [optsOrExt]
  *   Options object, or a bare `ext` string for back-compat.
@@ -40,10 +44,13 @@ export async function walkTemplateTree(rootDir, optsOrExt) {
 
   /** @type {import('../types.js').TemplateFile[]} */
   const results = [];
-  const queue = [''];
+  /** @type {Array<{ rel: string, ancestors: Array<{ rel: string, real: string }> }>} */
+  const queue = [{ rel: '', ancestors: [] }];
 
   while (queue.length) {
-    const rel = /** @type {string} */ (queue.shift());
+    const { rel, ancestors } = /** @type {(typeof queue)[number]} */ (
+      queue.shift()
+    );
     const abs = path.join(rootDir, rel);
     const stat = await fs.stat(abs);
 
@@ -51,9 +58,21 @@ export async function walkTemplateTree(rootDir, optsOrExt) {
       if (shouldSkipSubtree(rel, view)) {
         continue;
       }
+      const real = await fs.realpath(abs);
+      const loop = ancestors.find((a) => a.real === real);
+      if (loop) {
+        throw new Error(
+          `Template directory '${rel}' links back to '${loop.rel || '.'}' (a symbolic link cycle in '${rootDir}').\n` +
+            'Remove the link, or point it outside its own parent directories.',
+        );
+      }
+      const chain = [...ancestors, { rel, real }];
       const items = (await fs.readdir(abs)).sort();
       for (const name of items) {
-        queue.push(rel ? path.join(rel, name) : name);
+        queue.push({
+          rel: rel ? path.join(rel, name) : name,
+          ancestors: chain,
+        });
       }
     } else if (path.extname(abs) === ext) {
       results.push({ absPath: abs, relPath: rel });

package/src/utils/namespacing.js

@@ -21,6 +21,11 @@ const FLATTEN_SEGMENT_RE = /^@\w+$/;
  * @param {string} [label='namespace'] - Noun used in the error message (e.g. "partial name").
  */
 export function assertValidSegments(segments, filePath, label = 'namespace') {
+  if (segments.includes('__proto__')) {
+    throw new Error(
+      `Invalid ${label} segment '__proto__' in ${filePath} — reserved name`,
+    );
+  }
   if (!SEGMENT_RE.test(segments.join(''))) {
     throw new Error(
       `Invalid ${label} segment '${segments.join('>')}' in ${filePath} — only alphanumeric and underscore allowed`,