@rhinostone/swig-core 2.7.1 → 2.7.3

package/lib/loaders/filesystem.js

@@ -17,7 +17,12 @@ module.exports = function (basepath, encoding, allowOutsideRoot) {
   var ret = {};
 
   encoding = encoding || 'utf8';
-  basepath = (basepath) ? path.normalize(basepath) : null;
+  // Resolve (not merely normalize) basepath to an absolute path. The root
+  // check in resolve() compares it against path.resolve()'d template paths,
+  // which are always absolute, so a relative basepath must be made absolute
+  // too -- otherwise every in-root path is wrongly rejected (CVE-2023-25345
+  // confinement must not break the legitimate relative-basepath mode).
+  basepath = (basepath) ? path.resolve(basepath) : null;
 
   /**
    * Resolves <var>to</var> to an absolute path or unique identifier. This is used for building correct, normalized, and absolute paths to a given template.

package/lib/tokenparser.js

@@ -591,6 +591,11 @@ TokenParser.prototype = {
             bail('Invalid filter "' + fname + '"');
           }
           var fargs;
+          // `fargs` must be reset each iteration — `var` is function-scoped
+          // (a bare declaration does not reset it), so without this an
+          // arg-bearing filter earlier in the chain would leak its args onto
+          // a later no-arg filter (e.g. `x|replace("a","b")|upper`).
+          fargs = undefined;
           if (tok.type === _t.FILTER) {
             fargs = parseArgList(_t.PARENCLOSE);
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-core",
-  "version": "2.7.1",
+  "version": "2.7.3",
   "description": "Shared IR, backend, and runtime for the @rhinostone/swig family of template engines.",
   "keywords": [
     "template",