@rhinostone/swig-core 2.8.2 → 2.8.4

package/lib/backend.js

@@ -391,9 +391,11 @@ exports.compile = function (template, parents, options, blockName) {
       // else verbatim string fallback preserves the userland setTag
       // path (compile functions that still hand in raw JS-source
       // fragments). `resolveFrom` is a plain filesystem path that must
-      // be JSON-escaped into a string literal — the frontend's
-      // include-tag parse handler has already applied a `\\` → `\\\\`
-      // backslash escape before handing it off. `ignoreMissing` wraps
+      // be escaped into a string literal (a number is converted to a
+      // string first) — escapeTextValue below (backslash,
+      // newline, double-quote) is the single chokepoint that does it for all
+      // five node types, every flavor and userland setTag, so no unescaped
+      // filename can break out of the literal (GHSA-q89c). `ignoreMissing` wraps
       // the emission in `try { ... } catch (e) {}` so missing-file
       // errors collapse to the empty string.
       var incPathJS, incCtxJS;
@@ -419,7 +421,7 @@ exports.compile = function (template, parents, options, blockName) {
       }
       out += (node.ignoreMissing ? '  try {\n' : '') +
         '_output += _swig.compileFile(' + incPathJS + ', {' +
-        'resolveFrom: "' + node.resolveFrom + '"' +
+        'resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"' +
         '})(' + incSelector + ');\n' +
         (node.ignoreMissing ? '} catch (e) {}\n' : '');
       return;
@@ -453,7 +455,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         incdSelector = '_utils.extend({}, _ctx, ' + incdCtxJS + ')';
       }
-      var incdOpts = '{resolveFrom: "' + (node.resolveFrom || '') + '"}';
+      var incdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       out += (node.ignoreMissing ? '  try {\n' : '') +
         '_output += (await (await _swig.getTemplate(' + incdPathJS + ', ' + incdOpts + '))(' + incdSelector + ')).output;\n' +
         (node.ignoreMissing ? '} catch (e) {}\n' : '');
@@ -475,7 +477,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         impdPathJS = node.path;
       }
-      var impdOpts = '{resolveFrom: "' + (node.resolveFrom || '') + '"}';
+      var impdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       out += '_ctx.' + node.alias + ' = (await (await _swig.getTemplate(' + impdPathJS + ', ' + impdOpts + '))(_ctx)).exports;\n';
       return;
     }
@@ -500,7 +502,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         fromdPathJS = node.path;
       }
-      var fromdOpts = '{resolveFrom: "' + (node.resolveFrom || '') + '"}';
+      var fromdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       var fromdBindings = '';
       utils.each(fromdImports, function (entry) {
         var bindName = entry.alias || entry.name;
@@ -569,7 +571,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         extPathJS = node.path;
       }
-      var extOpts = '{resolveFrom: "' + (node.resolveFrom || '') + '"}';
+      var extOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       out += 'var _parentTpl = await _swig.getTemplate(' + extPathJS + ', ' + extOpts + ');\n';
       out += 'var _parentResult = await _parentTpl(_ctx, _mergedBlocks);\n';
       out += '_output = _parentResult.output;\n';

package/lib/index.js

@@ -15,7 +15,7 @@
  *
  * @type {String}
  */
-exports.version = "2.8.2";
+exports.version = "2.8.4";
 
 exports.utils = require('./utils');
 exports.security = require('./security');

package/lib/ir.js

@@ -153,7 +153,7 @@
  * @property {IRExpr} [context]               Explicit locals for the included template.
  * @property {boolean} [isolated]             Maps to Twig's `only`.
  * @property {boolean} [ignoreMissing]        Swallow loader errors when the file is missing.
- * @property {string} [resolveFrom]           Including template's filename (backslash-escaped) for loader-relative resolution.
+ * @property {string} [resolveFrom]           Including template's filename (escaped at emit time) for loader-relative resolution.
  * @property {IRLoc} [loc]
  */
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-core",
-  "version": "2.8.2",
+  "version": "2.8.4",
   "description": "Shared IR, backend, and runtime for the @rhinostone/swig family of template engines.",
   "keywords": [
     "template",