@nest-vue/vue-security-patched 2.7.16-patch.2

package/packages/compiler-sfc/src/compileStyle.ts

@@ -0,0 +1,147 @@
+const postcss = require('postcss')
+import { ProcessOptions, LazyResult } from 'postcss'
+import trimPlugin from './stylePlugins/trim'
+import scopedPlugin from './stylePlugins/scoped'
+import {
+  processors,
+  StylePreprocessor,
+  StylePreprocessorResults
+} from './stylePreprocessors'
+import { cssVarsPlugin } from './cssVars'
+
+export interface SFCStyleCompileOptions {
+  source: string
+  filename: string
+  id: string
+  map?: any
+  scoped?: boolean
+  trim?: boolean
+  preprocessLang?: string
+  preprocessOptions?: any
+  postcssOptions?: any
+  postcssPlugins?: any[]
+  isProd?: boolean
+}
+
+export interface SFCAsyncStyleCompileOptions extends SFCStyleCompileOptions {
+  isAsync?: boolean
+}
+
+export interface SFCStyleCompileResults {
+  code: string
+  map: any | void
+  rawResult: LazyResult | void
+  errors: string[]
+}
+
+export function compileStyle(
+  options: SFCStyleCompileOptions
+): SFCStyleCompileResults {
+  return doCompileStyle({ ...options, isAsync: false })
+}
+
+export function compileStyleAsync(
+  options: SFCStyleCompileOptions
+): Promise<SFCStyleCompileResults> {
+  return Promise.resolve(doCompileStyle({ ...options, isAsync: true }))
+}
+
+export function doCompileStyle(
+  options: SFCAsyncStyleCompileOptions
+): SFCStyleCompileResults {
+  const {
+    filename,
+    id,
+    scoped = true,
+    trim = true,
+    isProd = false,
+    preprocessLang,
+    postcssOptions,
+    postcssPlugins
+  } = options
+  const preprocessor = preprocessLang && processors[preprocessLang]
+  const preProcessedSource = preprocessor && preprocess(options, preprocessor)
+  const map = preProcessedSource ? preProcessedSource.map : options.map
+  const source = preProcessedSource ? preProcessedSource.code : options.source
+
+  const plugins = (postcssPlugins || []).slice()
+  plugins.unshift(cssVarsPlugin({ id: id.replace(/^data-v-/, ''), isProd }))
+  if (trim) {
+    plugins.push(trimPlugin())
+  }
+  if (scoped) {
+    plugins.push(scopedPlugin(id))
+  }
+
+  const postCSSOptions: ProcessOptions = {
+    ...postcssOptions,
+    to: filename,
+    from: filename
+  }
+  if (map) {
+    postCSSOptions.map = {
+      inline: false,
+      annotation: false,
+      prev: map
+    }
+  }
+
+  let result, code, outMap
+  const errors: any[] = []
+  if (preProcessedSource && preProcessedSource.errors.length) {
+    errors.push(...preProcessedSource.errors)
+  }
+  try {
+    result = postcss(plugins).process(source, postCSSOptions)
+
+    // In async mode, return a promise.
+    if (options.isAsync) {
+      return result
+        .then(
+          (result: LazyResult): SFCStyleCompileResults => ({
+            code: result.css || '',
+            map: result.map && result.map.toJSON(),
+            errors,
+            rawResult: result
+          })
+        )
+        .catch(
+          (error: Error): SFCStyleCompileResults => ({
+            code: '',
+            map: undefined,
+            errors: [...errors, error.message],
+            rawResult: undefined
+          })
+        )
+    }
+
+    // force synchronous transform (we know we only have sync plugins)
+    code = result.css
+    outMap = result.map
+  } catch (e) {
+    errors.push(e)
+  }
+
+  return {
+    code: code || ``,
+    map: outMap && outMap.toJSON(),
+    errors,
+    rawResult: result
+  }
+}
+
+function preprocess(
+  options: SFCStyleCompileOptions,
+  preprocessor: StylePreprocessor
+): StylePreprocessorResults {
+  return preprocessor(
+    options.source,
+    options.map,
+    Object.assign(
+      {
+        filename: options.filename
+      },
+      options.preprocessOptions
+    )
+  )
+}

package/packages/compiler-sfc/src/compileTemplate.ts

@@ -0,0 +1,205 @@
+import { BindingMetadata, TemplateCompiler } from './types'
+import assetUrlsModule, {
+  AssetURLOptions,
+  TransformAssetUrlsOptions
+} from './templateCompilerModules/assetUrl'
+import srcsetModule from './templateCompilerModules/srcset'
+import consolidate from '@vue/consolidate'
+import * as _compiler from 'web/entry-compiler'
+import { prefixIdentifiers } from './prefixIdentifiers'
+import { CompilerOptions, WarningMessage } from 'types/compiler'
+
+export interface SFCTemplateCompileOptions {
+  source: string
+  filename: string
+  compiler?: TemplateCompiler
+  compilerOptions?: CompilerOptions
+  transformAssetUrls?: AssetURLOptions | boolean
+  transformAssetUrlsOptions?: TransformAssetUrlsOptions
+  preprocessLang?: string
+  preprocessOptions?: any
+  transpileOptions?: any
+  isProduction?: boolean
+  isFunctional?: boolean
+  optimizeSSR?: boolean
+  prettify?: boolean
+  isTS?: boolean
+  bindings?: BindingMetadata
+}
+
+export interface SFCTemplateCompileResults {
+  ast: Object | undefined
+  code: string
+  source: string
+  tips: (string | WarningMessage)[]
+  errors: (string | WarningMessage)[]
+}
+
+export function compileTemplate(
+  options: SFCTemplateCompileOptions
+): SFCTemplateCompileResults {
+  const { preprocessLang } = options
+  const preprocessor = preprocessLang && consolidate[preprocessLang]
+  if (preprocessor) {
+    return actuallyCompile(
+      Object.assign({}, options, {
+        source: preprocess(options, preprocessor)
+      })
+    )
+  } else if (preprocessLang) {
+    return {
+      ast: {},
+      code: `var render = function () {}\n` + `var staticRenderFns = []\n`,
+      source: options.source,
+      tips: [
+        `Component ${options.filename} uses lang ${preprocessLang} for template. Please install the language preprocessor.`
+      ],
+      errors: [
+        `Component ${options.filename} uses lang ${preprocessLang} for template, however it is not installed.`
+      ]
+    }
+  } else {
+    return actuallyCompile(options)
+  }
+}
+
+function preprocess(
+  options: SFCTemplateCompileOptions,
+  preprocessor: any
+): string {
+  const { source, filename, preprocessOptions } = options
+
+  const finalPreprocessOptions = Object.assign(
+    {
+      filename
+    },
+    preprocessOptions
+  )
+
+  // Consolidate exposes a callback based API, but the callback is in fact
+  // called synchronously for most templating engines. In our case, we have to
+  // expose a synchronous API so that it is usable in Jest transforms (which
+  // have to be sync because they are applied via Node.js require hooks)
+  let res: any, err
+  preprocessor.render(
+    source,
+    finalPreprocessOptions,
+    (_err: Error | null, _res: string) => {
+      if (_err) err = _err
+      res = _res
+    }
+  )
+
+  if (err) throw err
+  return res
+}
+
+function actuallyCompile(
+  options: SFCTemplateCompileOptions
+): SFCTemplateCompileResults {
+  const {
+    source,
+    compiler = _compiler,
+    compilerOptions = {},
+    transpileOptions = {},
+    transformAssetUrls,
+    transformAssetUrlsOptions,
+    isProduction = process.env.NODE_ENV === 'production',
+    isFunctional = false,
+    optimizeSSR = false,
+    prettify = true,
+    isTS = false,
+    bindings
+  } = options
+
+  const compile =
+    optimizeSSR && compiler.ssrCompile ? compiler.ssrCompile : compiler.compile
+
+  let finalCompilerOptions = compilerOptions
+  if (transformAssetUrls) {
+    const builtInModules = [
+      transformAssetUrls === true
+        ? assetUrlsModule(undefined, transformAssetUrlsOptions)
+        : assetUrlsModule(transformAssetUrls, transformAssetUrlsOptions),
+      srcsetModule(transformAssetUrlsOptions)
+    ]
+    finalCompilerOptions = Object.assign({}, compilerOptions, {
+      modules: [...builtInModules, ...(compilerOptions.modules || [])],
+      filename: options.filename
+    })
+  }
+  finalCompilerOptions.bindings = bindings
+
+  const { ast, render, staticRenderFns, tips, errors } = compile(
+    source,
+    finalCompilerOptions
+  )
+
+  if (errors && errors.length) {
+    return {
+      ast,
+      code: `var render = function () {}\n` + `var staticRenderFns = []\n`,
+      source,
+      tips,
+      errors
+    }
+  } else {
+    // stripping `with` usage
+    let code =
+      `var __render__ = ${prefixIdentifiers(
+        `function render(${isFunctional ? `_c,_vm` : ``}){${render}\n}`,
+        isFunctional,
+        isTS,
+        transpileOptions,
+        bindings
+      )}\n` +
+      `var __staticRenderFns__ = [${staticRenderFns.map(code =>
+        prefixIdentifiers(
+          `function (${isFunctional ? `_c,_vm` : ``}){${code}\n}`,
+          isFunctional,
+          isTS,
+          transpileOptions,
+          bindings
+        )
+      )}]` +
+      `\n`
+
+    // #23 we use __render__ to avoid `render` not being prefixed by the
+    // transpiler when stripping with, but revert it back to `render` to
+    // maintain backwards compat
+    code = code.replace(/\s__(render|staticRenderFns)__\s/g, ' $1 ')
+
+    if (!isProduction) {
+      // mark with stripped (this enables Vue to use correct runtime proxy
+      // detection)
+      code += `render._withStripped = true`
+
+      if (prettify) {
+        try {
+          code = require('prettier').format(code, {
+            semi: false,
+            parser: 'babel'
+          })
+        } catch (e: any) {
+          if (e.code === 'MODULE_NOT_FOUND') {
+            tips.push(
+              'The `prettify` option is on, but the dependency `prettier` is not found.\n' +
+                'Please either turn off `prettify` or manually install `prettier`.'
+            )
+          }
+          tips.push(
+            `Failed to prettify component ${options.filename} template source after compilation.`
+          )
+        }
+      }
+    }
+
+    return {
+      ast,
+      code,
+      source,
+      tips,
+      errors
+    }
+  }
+}

package/packages/compiler-sfc/src/cssVars.ts

@@ -0,0 +1,179 @@
+import { BindingMetadata } from './types'
+import { SFCDescriptor } from './parseComponent'
+import { PluginCreator } from 'postcss'
+import hash from 'hash-sum'
+import { prefixIdentifiers } from './prefixIdentifiers'
+
+export const CSS_VARS_HELPER = `useCssVars`
+
+export function genCssVarsFromList(
+  vars: string[],
+  id: string,
+  isProd: boolean,
+  isSSR = false
+): string {
+  return `{\n  ${vars
+    .map(
+      key => `"${isSSR ? `--` : ``}${genVarName(id, key, isProd)}": (${key})`
+    )
+    .join(',\n  ')}\n}`
+}
+
+function genVarName(id: string, raw: string, isProd: boolean): string {
+  if (isProd) {
+    return hash(id + raw)
+  } else {
+    return `${id}-${raw.replace(/([^\w-])/g, '_')}`
+  }
+}
+
+function normalizeExpression(exp: string) {
+  exp = exp.trim()
+  if (
+    (exp[0] === `'` && exp[exp.length - 1] === `'`) ||
+    (exp[0] === `"` && exp[exp.length - 1] === `"`)
+  ) {
+    return exp.slice(1, -1)
+  }
+  return exp
+}
+
+const vBindRE = /v-bind\s*\(/g
+
+export function parseCssVars(sfc: SFCDescriptor): string[] {
+  const vars: string[] = []
+  sfc.styles.forEach(style => {
+    let match
+    // ignore v-bind() in comments /* ... */
+    const content = style.content.replace(/\/\*([\s\S]*?)\*\//g, '')
+    while ((match = vBindRE.exec(content))) {
+      const start = match.index + match[0].length
+      const end = lexBinding(content, start)
+      if (end !== null) {
+        const variable = normalizeExpression(content.slice(start, end))
+        if (!vars.includes(variable)) {
+          vars.push(variable)
+        }
+      }
+    }
+  })
+  return vars
+}
+
+const enum LexerState {
+  inParens,
+  inSingleQuoteString,
+  inDoubleQuoteString
+}
+
+function lexBinding(content: string, start: number): number | null {
+  let state: LexerState = LexerState.inParens
+  let parenDepth = 0
+
+  for (let i = start; i < content.length; i++) {
+    const char = content.charAt(i)
+    switch (state) {
+      case LexerState.inParens:
+        if (char === `'`) {
+          state = LexerState.inSingleQuoteString
+        } else if (char === `"`) {
+          state = LexerState.inDoubleQuoteString
+        } else if (char === `(`) {
+          parenDepth++
+        } else if (char === `)`) {
+          if (parenDepth > 0) {
+            parenDepth--
+          } else {
+            return i
+          }
+        }
+        break
+      case LexerState.inSingleQuoteString:
+        if (char === `'`) {
+          state = LexerState.inParens
+        }
+        break
+      case LexerState.inDoubleQuoteString:
+        if (char === `"`) {
+          state = LexerState.inParens
+        }
+        break
+    }
+  }
+  return null
+}
+
+// for compileStyle
+export interface CssVarsPluginOptions {
+  id: string
+  isProd: boolean
+}
+
+export const cssVarsPlugin: PluginCreator<CssVarsPluginOptions> = opts => {
+  const { id, isProd } = opts!
+  return {
+    postcssPlugin: 'vue-sfc-vars',
+    Declaration(decl) {
+      // rewrite CSS variables
+      const value = decl.value
+      if (vBindRE.test(value)) {
+        vBindRE.lastIndex = 0
+        let transformed = ''
+        let lastIndex = 0
+        let match
+        while ((match = vBindRE.exec(value))) {
+          const start = match.index + match[0].length
+          const end = lexBinding(value, start)
+          if (end !== null) {
+            const variable = normalizeExpression(value.slice(start, end))
+            transformed +=
+              value.slice(lastIndex, match.index) +
+              `var(--${genVarName(id, variable, isProd)})`
+            lastIndex = end + 1
+          }
+        }
+        decl.value = transformed + value.slice(lastIndex)
+      }
+    }
+  }
+}
+cssVarsPlugin.postcss = true
+
+export function genCssVarsCode(
+  vars: string[],
+  bindings: BindingMetadata,
+  id: string,
+  isProd: boolean
+) {
+  const varsExp = genCssVarsFromList(vars, id, isProd)
+  return `_${CSS_VARS_HELPER}((_vm, _setup) => ${prefixIdentifiers(
+    `(${varsExp})`,
+    false,
+    false,
+    undefined,
+    bindings
+  )})`
+}
+
+// <script setup> already gets the calls injected as part of the transform
+// this is only for single normal <script>
+export function genNormalScriptCssVarsCode(
+  cssVars: string[],
+  bindings: BindingMetadata,
+  id: string,
+  isProd: boolean
+): string {
+  return (
+    `\nimport { ${CSS_VARS_HELPER} as _${CSS_VARS_HELPER} } from 'vue'\n` +
+    `const __injectCSSVars__ = () => {\n${genCssVarsCode(
+      cssVars,
+      bindings,
+      id,
+      isProd
+    )}}\n` +
+    `const __setup__ = __default__.setup\n` +
+    `__default__.setup = __setup__\n` +
+    `  ? (props, ctx) => { __injectCSSVars__();return __setup__(props, ctx) }\n` +
+    `  : __injectCSSVars__\n`
+  )
+}

package/packages/compiler-sfc/src/index.ts

@@ -0,0 +1,31 @@
+// API
+export { parse } from './parse'
+export { compileTemplate } from './compileTemplate'
+export { compileStyle, compileStyleAsync } from './compileStyle'
+export { compileScript } from './compileScript'
+export { generateCodeFrame } from 'compiler/codeframe'
+export { rewriteDefault } from './rewriteDefault'
+
+// For backwards compat only. Some existing tools like
+// fork-ts-checker-webpack-plugin relies on its presence for differentiating
+// between Vue 2 and Vue 3.
+// ref #12719
+// ref https://github.com/TypeStrong/fork-ts-checker-webpack-plugin/issues/765
+export { parseComponent } from './parseComponent'
+
+// types
+export { SFCParseOptions } from './parse'
+export { CompilerOptions, WarningMessage } from 'types/compiler'
+export { TemplateCompiler } from './types'
+export {
+  SFCBlock,
+  SFCCustomBlock,
+  SFCScriptBlock,
+  SFCDescriptor
+} from './parseComponent'
+export {
+  SFCTemplateCompileOptions,
+  SFCTemplateCompileResults
+} from './compileTemplate'
+export { SFCStyleCompileOptions, SFCStyleCompileResults } from './compileStyle'
+export { SFCScriptCompileOptions } from './compileScript'

package/packages/compiler-sfc/src/parse.ts

@@ -0,0 +1,129 @@
+import { SourceMapGenerator } from 'source-map'
+import { RawSourceMap, TemplateCompiler } from './types'
+import {
+  parseComponent,
+  VueTemplateCompilerParseOptions,
+  SFCDescriptor,
+  DEFAULT_FILENAME
+} from './parseComponent'
+
+import hash from 'hash-sum'
+import LRU from 'lru-cache'
+import { hmrShouldReload } from './compileScript'
+import { parseCssVars } from './cssVars'
+
+const cache = new LRU<string, SFCDescriptor>(100)
+
+const splitRE = /\r?\n/g
+const emptyRE = /^(?:\/\/)?\s*$/
+
+export interface SFCParseOptions {
+  source: string
+  filename?: string
+  compiler?: TemplateCompiler
+  compilerParseOptions?: VueTemplateCompilerParseOptions
+  sourceRoot?: string
+  sourceMap?: boolean
+  /**
+   * @deprecated use `sourceMap` instead.
+   */
+  needMap?: boolean
+}
+
+export function parse(options: SFCParseOptions): SFCDescriptor {
+  const {
+    source,
+    filename = DEFAULT_FILENAME,
+    compiler,
+    compilerParseOptions = { pad: false } as VueTemplateCompilerParseOptions,
+    sourceRoot = '',
+    needMap = true,
+    sourceMap = needMap
+  } = options
+  const cacheKey = hash(
+    filename + source + JSON.stringify(compilerParseOptions)
+  )
+
+  let output = cache.get(cacheKey)
+  if (output) {
+    return output
+  }
+
+  if (compiler) {
+    // user-provided compiler
+    output = compiler.parseComponent(source, compilerParseOptions)
+  } else {
+    // use built-in compiler
+    output = parseComponent(source, compilerParseOptions)
+  }
+
+  output.filename = filename
+
+  // parse CSS vars
+  output.cssVars = parseCssVars(output)
+
+  output.shouldForceReload = prevImports =>
+    hmrShouldReload(prevImports, output!)
+
+  if (sourceMap) {
+    if (output.script && !output.script.src) {
+      output.script.map = generateSourceMap(
+        filename,
+        source,
+        output.script.content,
+        sourceRoot,
+        compilerParseOptions.pad
+      )
+    }
+    if (output.styles) {
+      output.styles.forEach(style => {
+        if (!style.src) {
+          style.map = generateSourceMap(
+            filename,
+            source,
+            style.content,
+            sourceRoot,
+            compilerParseOptions.pad
+          )
+        }
+      })
+    }
+  }
+
+  cache.set(cacheKey, output)
+  return output
+}
+
+function generateSourceMap(
+  filename: string,
+  source: string,
+  generated: string,
+  sourceRoot: string,
+  pad?: 'line' | 'space' | boolean
+): RawSourceMap {
+  const map = new SourceMapGenerator({
+    file: filename.replace(/\\/g, '/'),
+    sourceRoot: sourceRoot.replace(/\\/g, '/')
+  })
+  let offset = 0
+  if (!pad) {
+    offset = source.split(generated).shift()!.split(splitRE).length - 1
+  }
+  map.setSourceContent(filename, source)
+  generated.split(splitRE).forEach((line, index) => {
+    if (!emptyRE.test(line)) {
+      map.addMapping({
+        source: filename,
+        original: {
+          line: index + 1 + offset,
+          column: 0
+        },
+        generated: {
+          line: index + 1,
+          column: 0
+        }
+      })
+    }
+  })
+  return JSON.parse(map.toString())
+}