@rhinostone/swig-core 2.8.1 → 2.8.3

package/lib/backend.js

@@ -391,9 +391,10 @@ exports.compile = function (template, parents, options, blockName) {
       // else verbatim string fallback preserves the userland setTag
       // path (compile functions that still hand in raw JS-source
       // fragments). `resolveFrom` is a plain filesystem path that must
-      // be JSON-escaped into a string literal — the frontend's
-      // include-tag parse handler has already applied a `\\` → `\\\\`
-      // backslash escape before handing it off. `ignoreMissing` wraps
+      // be escaped into a string literal — escapeTextValue below (backslash,
+      // newline, double-quote) is the single chokepoint that does it for all
+      // five node types, every flavor and userland setTag, so no unescaped
+      // filename can break out of the literal (GHSA-q89c). `ignoreMissing` wraps
       // the emission in `try { ... } catch (e) {}` so missing-file
       // errors collapse to the empty string.
       var incPathJS, incCtxJS;
@@ -419,7 +420,7 @@ exports.compile = function (template, parents, options, blockName) {
       }
       out += (node.ignoreMissing ? '  try {\n' : '') +
         '_output += _swig.compileFile(' + incPathJS + ', {' +
-        'resolveFrom: "' + node.resolveFrom + '"' +
+        'resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"' +
         '})(' + incSelector + ');\n' +
         (node.ignoreMissing ? '} catch (e) {}\n' : '');
       return;
@@ -453,7 +454,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         incdSelector = '_utils.extend({}, _ctx, ' + incdCtxJS + ')';
       }
-      var incdOpts = '{resolveFrom: "' + (node.resolveFrom || '') + '"}';
+      var incdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
       out += (node.ignoreMissing ? '  try {\n' : '') +
         '_output += (await (await _swig.getTemplate(' + incdPathJS + ', ' + incdOpts + '))(' + incdSelector + ')).output;\n' +
         (node.ignoreMissing ? '} catch (e) {}\n' : '');
@@ -475,7 +476,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         impdPathJS = node.path;
       }
-      var impdOpts = '{resolveFrom: "' + (node.resolveFrom || '') + '"}';
+      var impdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
       out += '_ctx.' + node.alias + ' = (await (await _swig.getTemplate(' + impdPathJS + ', ' + impdOpts + '))(_ctx)).exports;\n';
       return;
     }
@@ -500,7 +501,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         fromdPathJS = node.path;
       }
-      var fromdOpts = '{resolveFrom: "' + (node.resolveFrom || '') + '"}';
+      var fromdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
       var fromdBindings = '';
       utils.each(fromdImports, function (entry) {
         var bindName = entry.alias || entry.name;
@@ -569,7 +570,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         extPathJS = node.path;
       }
-      var extOpts = '{resolveFrom: "' + (node.resolveFrom || '') + '"}';
+      var extOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
       out += 'var _parentTpl = await _swig.getTemplate(' + extPathJS + ', ' + extOpts + ');\n';
       out += 'var _parentResult = await _parentTpl(_ctx, _mergedBlocks);\n';
       out += '_output = _parentResult.output;\n';
@@ -762,7 +763,7 @@ function checkDangerousSegment(segment, d, node) {
   if (d.dangerousProps.indexOf(segment) !== -1) {
     var line = (node && node.loc && node.loc.line) || undefined;
     var filename = (node && node.loc && node.loc.filename) || undefined;
-    d.throwError('Unsafe access to "' + segment + '" is not allowed in templates (CVE-2023-25345)', line, filename);
+    d.throwError('Unsafe access to "' + segment + '" is not allowed in templates (prototype-chain guard)', line, filename);
   }
 }
 
@@ -880,7 +881,7 @@ function emitAccess(node, d) {
   if (node.key && node.key.type === 'Literal' && node.key.kind === 'string') {
     checkDangerousSegment(node.key.value, d, node);
   }
-  return emitExpr(node.object, d) + '[' + emitExpr(node.key, d) + ']';
+  return groupOperand(node.object, emitExpr(node.object, d), true) + '[' + emitExpr(node.key, d) + ']';
 }
 
 /*!
@@ -893,9 +894,24 @@ function isArithmeticOp(op) {
   return op === '+' || op === '-' || op === '*' || op === '/' || op === '%';
 }
 
+/*!
+ * Parenthesize an operand whose emitted JS could regroup. The IR tree
+ * carries the grouping (`(a + b) * c` parses to a `*` node whose left
+ * operand is the `+` node), so a nested binary node is wrapped or JS
+ * precedence and associativity regroup it (`a + b * c`). `unary` also
+ * wraps a unary operand, for the positions where its prefix would bind
+ * differently (`-(-x)`, `(-x)[0]`). @private
+ */
+function groupOperand(node, js, unary) {
+  if (node && (node.type === 'BinaryOp' || (unary && node.type === 'UnaryOp'))) {
+    return '(' + js + ')';
+  }
+  return js;
+}
+
 function emitBinaryOp(node, d) {
-  var left = emitExpr(node.left, d),
-    right = emitExpr(node.right, d);
+  var left = groupOperand(node.left, emitExpr(node.left, d)),
+    right = groupOperand(node.right, emitExpr(node.right, d));
   if (isArithmeticOp(node.op)) {
     return left + ' ' + node.op + ' ' + right;
   }
@@ -922,11 +938,7 @@ function emitBinaryOp(node, d) {
 }
 
 function emitUnaryOp(node, d) {
-  var operandJS = emitExpr(node.operand, d);
-  if (node.operand && node.operand.type === 'BinaryOp') {
-    operandJS = '(' + operandJS + ')';
-  }
-  return node.op + operandJS;
+  return node.op + groupOperand(node.operand, emitExpr(node.operand, d), true);
 }
 
 function emitConditional(node, d) {

package/lib/engine.js

@@ -21,6 +21,21 @@ var AsyncFunction = Object.getPrototypeOf(async function () {}).constructor;
  */
 function efn() { return ''; }
 
+/**
+ * Cache key for a compiled template. An async-mode compile returns a
+ * different function shape (a Promise of `{ output, exports }`), so it is
+ * stored under its own key: neither mode is served, or replaces, the other
+ * mode's entry for the same file.
+ *
+ * @param  {string} filename  Template identifier (the resolved path for files).
+ * @param  {object} [options] Compile options; `codegenMode` is read.
+ * @return {string}           Cache key.
+ * @private
+ */
+function compileCacheKey(filename, options) {
+  return (options && options.codegenMode === 'async') ? filename + '#async' : filename;
+}
+
 /**
  * Runtime engine plumbing shared across @rhinostone/swig-family frontends.
  *
@@ -537,7 +552,7 @@ exports.install = function (self, frontend) {
   };
 
   self.compile = function (source, options) {
-    var key = options ? options.filename : null,
+    var key = (options && options.filename) ? compileCacheKey(options.filename, options) : null,
       cached = key ? cacheGet(key, options) : null,
       context,
       contextLength,
@@ -591,7 +606,7 @@ exports.install = function (self, frontend) {
     if (!options.filename) {
       options = utils.extend({ filename: pathname }, options);
     }
-    cached = cacheGet(pathname, options);
+    cached = cacheGet(compileCacheKey(pathname, options), options);
 
     if (cached) {
       if (cb) {
@@ -641,11 +656,9 @@ exports.install = function (self, frontend) {
    * load a child template at render time.
    *
    * Cache semantics — bypasses the cache via `options.cache = false` on
-   * the inner compile call. The sync compile cache and the async compile
-   * cache would otherwise share a key (the resolved filename) and serve
-   * a mode-mismatched compiled fn to the wrong caller. Cleaner
-   * namespacing (separate sync/async cache buckets, or a key suffix) is
-   * deferred to a follow-up slice.
+   * the inner compile call. `compile` and `compileFile` keep async-mode
+   * entries under their own key (see `compileCacheKey`), so a compile in
+   * either mode is never served the other mode's function.
    *
    * @param  {string} pathname    Template path; resolved via the active loader.
    * @param  {object} [options]   Per-call options. Honored: `resolveFrom`,

package/lib/index.js

@@ -7,6 +7,16 @@
  * @rhinostone/swig.
  */
 
+/**
+ * Package version number as a string. The packages of the family are
+ * released together, so they share one version.
+ * @example
+ * if (require('@rhinostone/swig-core').version === "2.8.2") { ... }
+ *
+ * @type {String}
+ */
+exports.version = "2.8.3";
+
 exports.utils = require('./utils');
 exports.security = require('./security');
 exports.ir = require('./ir');

package/lib/ir.js

@@ -153,7 +153,7 @@
  * @property {IRExpr} [context]               Explicit locals for the included template.
  * @property {boolean} [isolated]             Maps to Twig's `only`.
  * @property {boolean} [ignoreMissing]        Swallow loader errors when the file is missing.
- * @property {string} [resolveFrom]           Including template's filename (backslash-escaped) for loader-relative resolution.
+ * @property {string} [resolveFrom]           Including template's filename (escaped at emit time) for loader-relative resolution.
  * @property {IRLoc} [loc]
  */
 

package/lib/tokenparser.js

@@ -166,7 +166,7 @@ TokenParser.prototype = {
       if (lastState === _t.BRACKETOPEN) {
         var strippedMatch = match.replace(/^['"]|['"]$/g, '');
         if (_dangerousProps.indexOf(strippedMatch) !== -1) {
-          utils.throwError('Unsafe access to "' + strippedMatch + '" via bracket notation is not allowed in templates (CVE-2023-25345)', self.line, self.filename);
+          utils.throwError('Unsafe access to "' + strippedMatch + '" via bracket notation is not allowed in templates (prototype-chain guard)', self.line, self.filename);
         }
       }
       self.filterApplyIdx.push(self.out.length);
@@ -372,7 +372,7 @@ TokenParser.prototype = {
       }
       // CVE-2023-25345: block prototype-chain traversal via dot notation
       if (_dangerousProps.indexOf(match) !== -1) {
-        utils.throwError('Unsafe access to "' + match + '" is not allowed in templates (CVE-2023-25345)', self.line, self.filename);
+        utils.throwError('Unsafe access to "' + match + '" is not allowed in templates (prototype-chain guard)', self.line, self.filename);
       }
       self.out.push('.' + match);
       break;
@@ -404,7 +404,7 @@ TokenParser.prototype = {
     // CVE-2023-25345: block prototype-chain property access
     utils.each(match, function (segment) {
       if (_dangerousProps.indexOf(segment) !== -1) {
-        utils.throwError('Unsafe access to "' + segment + '" is not allowed in templates (CVE-2023-25345)', self.line, self.filename);
+        utils.throwError('Unsafe access to "' + segment + '" is not allowed in templates (prototype-chain guard)', self.line, self.filename);
       }
     });
 
@@ -472,12 +472,12 @@ TokenParser.prototype = {
     }
     function guardSegment(segment) {
       if (_dangerousProps.indexOf(segment) !== -1) {
-        bail('Unsafe access to "' + segment + '" is not allowed in templates (CVE-2023-25345)');
+        bail('Unsafe access to "' + segment + '" is not allowed in templates (prototype-chain guard)');
       }
     }
     function guardBracketString(value) {
       if (_dangerousProps.indexOf(value) !== -1) {
-        bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (CVE-2023-25345)');
+        bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (prototype-chain guard)');
       }
     }
 

package/lib/utils.js

@@ -189,9 +189,9 @@ exports.throwError = function (message, line, file) {
  * Inclusive range generator. Mirrors Twig's `..` operator semantics and
  * PHP's range(): numeric bounds produce [from, from±1, ..., to]; single-
  * character string bounds produce a char array across the charCode span.
- * Descending when `from > to`. Mismatched or unsupported argument shapes
- * return an empty array so compiled templates degrade silently rather
- * than throwing at render time.
+ * Descending when `from > to`. Mismatched or unsupported argument shapes,
+ * and a numeric bound that is not finite, return an empty array so
+ * compiled templates degrade silently rather than throwing at render time.
  *
  * @param  {number|string} from
  * @param  {number|string} to
@@ -200,6 +200,13 @@ exports.throwError = function (message, line, file) {
 exports.range = function (from, to) {
   var out = [], i, fc, tc;
   if (typeof from === 'number' && typeof to === 'number') {
+    // An infinite bound is never reached, so the loop below ran until the
+    // array overflowed (seconds, and gigabytes, before a RangeError); plain
+    // JSON yields Infinity for a number such as 1e999. PHP 8.3's range()
+    // rejects such a bound; the range is empty here, as for NaN.
+    if (!isFinite(from) || !isFinite(to)) {
+      return out;
+    }
     if (from <= to) {
       for (i = from; i <= to; i += 1) { out.push(i); }
     } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-core",
-  "version": "2.8.1",
+  "version": "2.8.3",
   "description": "Shared IR, backend, and runtime for the @rhinostone/swig family of template engines.",
   "keywords": [
     "template",