@rhinostone/swig-core 2.8.1 → 2.8.2

package/lib/backend.js

@@ -762,7 +762,7 @@ function checkDangerousSegment(segment, d, node) {
   if (d.dangerousProps.indexOf(segment) !== -1) {
     var line = (node && node.loc && node.loc.line) || undefined;
     var filename = (node && node.loc && node.loc.filename) || undefined;
-    d.throwError('Unsafe access to "' + segment + '" is not allowed in templates (CVE-2023-25345)', line, filename);
+    d.throwError('Unsafe access to "' + segment + '" is not allowed in templates (prototype-chain guard)', line, filename);
   }
 }
 
@@ -880,7 +880,7 @@ function emitAccess(node, d) {
   if (node.key && node.key.type === 'Literal' && node.key.kind === 'string') {
     checkDangerousSegment(node.key.value, d, node);
   }
-  return emitExpr(node.object, d) + '[' + emitExpr(node.key, d) + ']';
+  return groupOperand(node.object, emitExpr(node.object, d), true) + '[' + emitExpr(node.key, d) + ']';
 }
 
 /*!
@@ -893,9 +893,24 @@ function isArithmeticOp(op) {
   return op === '+' || op === '-' || op === '*' || op === '/' || op === '%';
 }
 
+/*!
+ * Parenthesize an operand whose emitted JS could regroup. The IR tree
+ * carries the grouping (`(a + b) * c` parses to a `*` node whose left
+ * operand is the `+` node), so a nested binary node is wrapped or JS
+ * precedence and associativity regroup it (`a + b * c`). `unary` also
+ * wraps a unary operand, for the positions where its prefix would bind
+ * differently (`-(-x)`, `(-x)[0]`). @private
+ */
+function groupOperand(node, js, unary) {
+  if (node && (node.type === 'BinaryOp' || (unary && node.type === 'UnaryOp'))) {
+    return '(' + js + ')';
+  }
+  return js;
+}
+
 function emitBinaryOp(node, d) {
-  var left = emitExpr(node.left, d),
-    right = emitExpr(node.right, d);
+  var left = groupOperand(node.left, emitExpr(node.left, d)),
+    right = groupOperand(node.right, emitExpr(node.right, d));
   if (isArithmeticOp(node.op)) {
     return left + ' ' + node.op + ' ' + right;
   }
@@ -922,11 +937,7 @@ function emitBinaryOp(node, d) {
 }
 
 function emitUnaryOp(node, d) {
-  var operandJS = emitExpr(node.operand, d);
-  if (node.operand && node.operand.type === 'BinaryOp') {
-    operandJS = '(' + operandJS + ')';
-  }
-  return node.op + operandJS;
+  return node.op + groupOperand(node.operand, emitExpr(node.operand, d), true);
 }
 
 function emitConditional(node, d) {

package/lib/engine.js

@@ -21,6 +21,21 @@ var AsyncFunction = Object.getPrototypeOf(async function () {}).constructor;
  */
 function efn() { return ''; }
 
+/**
+ * Cache key for a compiled template. An async-mode compile returns a
+ * different function shape (a Promise of `{ output, exports }`), so it is
+ * stored under its own key: neither mode is served, or replaces, the other
+ * mode's entry for the same file.
+ *
+ * @param  {string} filename  Template identifier (the resolved path for files).
+ * @param  {object} [options] Compile options; `codegenMode` is read.
+ * @return {string}           Cache key.
+ * @private
+ */
+function compileCacheKey(filename, options) {
+  return (options && options.codegenMode === 'async') ? filename + '#async' : filename;
+}
+
 /**
  * Runtime engine plumbing shared across @rhinostone/swig-family frontends.
  *
@@ -537,7 +552,7 @@ exports.install = function (self, frontend) {
   };
 
   self.compile = function (source, options) {
-    var key = options ? options.filename : null,
+    var key = (options && options.filename) ? compileCacheKey(options.filename, options) : null,
       cached = key ? cacheGet(key, options) : null,
       context,
       contextLength,
@@ -591,7 +606,7 @@ exports.install = function (self, frontend) {
     if (!options.filename) {
       options = utils.extend({ filename: pathname }, options);
     }
-    cached = cacheGet(pathname, options);
+    cached = cacheGet(compileCacheKey(pathname, options), options);
 
     if (cached) {
       if (cb) {
@@ -641,11 +656,9 @@ exports.install = function (self, frontend) {
    * load a child template at render time.
    *
    * Cache semantics — bypasses the cache via `options.cache = false` on
-   * the inner compile call. The sync compile cache and the async compile
-   * cache would otherwise share a key (the resolved filename) and serve
-   * a mode-mismatched compiled fn to the wrong caller. Cleaner
-   * namespacing (separate sync/async cache buckets, or a key suffix) is
-   * deferred to a follow-up slice.
+   * the inner compile call. `compile` and `compileFile` keep async-mode
+   * entries under their own key (see `compileCacheKey`), so a compile in
+   * either mode is never served the other mode's function.
    *
    * @param  {string} pathname    Template path; resolved via the active loader.
    * @param  {object} [options]   Per-call options. Honored: `resolveFrom`,

package/lib/index.js

@@ -7,6 +7,16 @@
  * @rhinostone/swig.
  */
 
+/**
+ * Package version number as a string. The packages of the family are
+ * released together, so they share one version.
+ * @example
+ * if (require('@rhinostone/swig-core').version === "2.8.2") { ... }
+ *
+ * @type {String}
+ */
+exports.version = "2.8.2";
+
 exports.utils = require('./utils');
 exports.security = require('./security');
 exports.ir = require('./ir');

package/lib/tokenparser.js

@@ -166,7 +166,7 @@ TokenParser.prototype = {
       if (lastState === _t.BRACKETOPEN) {
         var strippedMatch = match.replace(/^['"]|['"]$/g, '');
         if (_dangerousProps.indexOf(strippedMatch) !== -1) {
-          utils.throwError('Unsafe access to "' + strippedMatch + '" via bracket notation is not allowed in templates (CVE-2023-25345)', self.line, self.filename);
+          utils.throwError('Unsafe access to "' + strippedMatch + '" via bracket notation is not allowed in templates (prototype-chain guard)', self.line, self.filename);
         }
       }
       self.filterApplyIdx.push(self.out.length);
@@ -372,7 +372,7 @@ TokenParser.prototype = {
       }
       // CVE-2023-25345: block prototype-chain traversal via dot notation
       if (_dangerousProps.indexOf(match) !== -1) {
-        utils.throwError('Unsafe access to "' + match + '" is not allowed in templates (CVE-2023-25345)', self.line, self.filename);
+        utils.throwError('Unsafe access to "' + match + '" is not allowed in templates (prototype-chain guard)', self.line, self.filename);
       }
       self.out.push('.' + match);
       break;
@@ -404,7 +404,7 @@ TokenParser.prototype = {
     // CVE-2023-25345: block prototype-chain property access
     utils.each(match, function (segment) {
       if (_dangerousProps.indexOf(segment) !== -1) {
-        utils.throwError('Unsafe access to "' + segment + '" is not allowed in templates (CVE-2023-25345)', self.line, self.filename);
+        utils.throwError('Unsafe access to "' + segment + '" is not allowed in templates (prototype-chain guard)', self.line, self.filename);
       }
     });
 
@@ -472,12 +472,12 @@ TokenParser.prototype = {
     }
     function guardSegment(segment) {
       if (_dangerousProps.indexOf(segment) !== -1) {
-        bail('Unsafe access to "' + segment + '" is not allowed in templates (CVE-2023-25345)');
+        bail('Unsafe access to "' + segment + '" is not allowed in templates (prototype-chain guard)');
       }
     }
     function guardBracketString(value) {
       if (_dangerousProps.indexOf(value) !== -1) {
-        bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (CVE-2023-25345)');
+        bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (prototype-chain guard)');
       }
     }
 

package/lib/utils.js

@@ -189,9 +189,9 @@ exports.throwError = function (message, line, file) {
  * Inclusive range generator. Mirrors Twig's `..` operator semantics and
  * PHP's range(): numeric bounds produce [from, from±1, ..., to]; single-
  * character string bounds produce a char array across the charCode span.
- * Descending when `from > to`. Mismatched or unsupported argument shapes
- * return an empty array so compiled templates degrade silently rather
- * than throwing at render time.
+ * Descending when `from > to`. Mismatched or unsupported argument shapes,
+ * and a numeric bound that is not finite, return an empty array so
+ * compiled templates degrade silently rather than throwing at render time.
  *
  * @param  {number|string} from
  * @param  {number|string} to
@@ -200,6 +200,13 @@ exports.throwError = function (message, line, file) {
 exports.range = function (from, to) {
   var out = [], i, fc, tc;
   if (typeof from === 'number' && typeof to === 'number') {
+    // An infinite bound is never reached, so the loop below ran until the
+    // array overflowed (seconds, and gigabytes, before a RangeError); plain
+    // JSON yields Infinity for a number such as 1e999. PHP 8.3's range()
+    // rejects such a bound; the range is empty here, as for NaN.
+    if (!isFinite(from) || !isFinite(to)) {
+      return out;
+    }
     if (from <= to) {
       for (i = from; i <= to; i += 1) { out.push(i); }
     } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-core",
-  "version": "2.8.1",
+  "version": "2.8.2",
   "description": "Shared IR, backend, and runtime for the @rhinostone/swig family of template engines.",
   "keywords": [
     "template",