@rhinostone/swig-core 2.8.3 → 2.8.4

package/lib/backend.js

@@ -391,7 +391,8 @@ exports.compile = function (template, parents, options, blockName) {
       // else verbatim string fallback preserves the userland setTag
       // path (compile functions that still hand in raw JS-source
       // fragments). `resolveFrom` is a plain filesystem path that must
-      // be escaped into a string literal — escapeTextValue below (backslash,
+      // be escaped into a string literal (a number is converted to a
+      // string first) — escapeTextValue below (backslash,
       // newline, double-quote) is the single chokepoint that does it for all
       // five node types, every flavor and userland setTag, so no unescaped
       // filename can break out of the literal (GHSA-q89c). `ignoreMissing` wraps
@@ -420,7 +421,7 @@ exports.compile = function (template, parents, options, blockName) {
       }
       out += (node.ignoreMissing ? '  try {\n' : '') +
         '_output += _swig.compileFile(' + incPathJS + ', {' +
-        'resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"' +
+        'resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"' +
         '})(' + incSelector + ');\n' +
         (node.ignoreMissing ? '} catch (e) {}\n' : '');
       return;
@@ -454,7 +455,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         incdSelector = '_utils.extend({}, _ctx, ' + incdCtxJS + ')';
       }
-      var incdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
+      var incdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       out += (node.ignoreMissing ? '  try {\n' : '') +
         '_output += (await (await _swig.getTemplate(' + incdPathJS + ', ' + incdOpts + '))(' + incdSelector + ')).output;\n' +
         (node.ignoreMissing ? '} catch (e) {}\n' : '');
@@ -476,7 +477,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         impdPathJS = node.path;
       }
-      var impdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
+      var impdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       out += '_ctx.' + node.alias + ' = (await (await _swig.getTemplate(' + impdPathJS + ', ' + impdOpts + '))(_ctx)).exports;\n';
       return;
     }
@@ -501,7 +502,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         fromdPathJS = node.path;
       }
-      var fromdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
+      var fromdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       var fromdBindings = '';
       utils.each(fromdImports, function (entry) {
         var bindName = entry.alias || entry.name;
@@ -570,7 +571,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         extPathJS = node.path;
       }
-      var extOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
+      var extOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       out += 'var _parentTpl = await _swig.getTemplate(' + extPathJS + ', ' + extOpts + ');\n';
       out += 'var _parentResult = await _parentTpl(_ctx, _mergedBlocks);\n';
       out += '_output = _parentResult.output;\n';

package/lib/index.js

@@ -15,7 +15,7 @@
  *
  * @type {String}
  */
-exports.version = "2.8.3";
+exports.version = "2.8.4";
 
 exports.utils = require('./utils');
 exports.security = require('./security');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-core",
-  "version": "2.8.3",
+  "version": "2.8.4",
   "description": "Shared IR, backend, and runtime for the @rhinostone/swig family of template engines.",
   "keywords": [
     "template",