@rhinostone/swig-core 2.8.3 → 2.9.0

package/README.md

@@ -1,7 +1,7 @@
 @rhinostone/swig-core
 =====================
 
-[![NPM version](https://img.shields.io/npm/v/@rhinostone/swig-core.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig-core) [![Socket Badge](https://socket.dev/api/badge/npm/package/@rhinostone/swig-core)](https://socket.dev/npm/package/@rhinostone/swig-core)
+[![NPM version](https://img.shields.io/npm/v/@rhinostone/swig-core.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig-core) [![Socket Badge](https://socket.dev/api/badge/npm/package/@rhinostone/swig-core)](https://socket.dev/npm/package/@rhinostone/swig-core) [![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/gina-io/swig?label=openssf%20scorecard&style=flat)](https://scorecard.dev/viewer/?uri=github.com/gina-io/swig)
 
 > **Shared runtime** for the `@rhinostone/swig` family of template engines. Not intended for direct consumption unless you are building a custom frontend. Install [@rhinostone/swig](https://www.npmjs.com/package/@rhinostone/swig) for the default Swig (Jinja2/Django-inspired) flavor, [@rhinostone/swig-twig](https://www.npmjs.com/package/@rhinostone/swig-twig) for the Twig flavor, [@rhinostone/swig-jinja2](https://www.npmjs.com/package/@rhinostone/swig-jinja2) for the Python Jinja2 flavor, or [@rhinostone/swig-django](https://www.npmjs.com/package/@rhinostone/swig-django) for the Django flavor — they all pull this package in pinned to the matching version.
 

package/lib/backend.js

@@ -391,7 +391,8 @@ exports.compile = function (template, parents, options, blockName) {
       // else verbatim string fallback preserves the userland setTag
       // path (compile functions that still hand in raw JS-source
       // fragments). `resolveFrom` is a plain filesystem path that must
-      // be escaped into a string literal — escapeTextValue below (backslash,
+      // be escaped into a string literal (a number is converted to a
+      // string first) — escapeTextValue below (backslash,
       // newline, double-quote) is the single chokepoint that does it for all
       // five node types, every flavor and userland setTag, so no unescaped
       // filename can break out of the literal (GHSA-q89c). `ignoreMissing` wraps
@@ -420,7 +421,7 @@ exports.compile = function (template, parents, options, blockName) {
       }
       out += (node.ignoreMissing ? '  try {\n' : '') +
         '_output += _swig.compileFile(' + incPathJS + ', {' +
-        'resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"' +
+        'resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"' +
         '})(' + incSelector + ');\n' +
         (node.ignoreMissing ? '} catch (e) {}\n' : '');
       return;
@@ -454,7 +455,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         incdSelector = '_utils.extend({}, _ctx, ' + incdCtxJS + ')';
       }
-      var incdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
+      var incdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       out += (node.ignoreMissing ? '  try {\n' : '') +
         '_output += (await (await _swig.getTemplate(' + incdPathJS + ', ' + incdOpts + '))(' + incdSelector + ')).output;\n' +
         (node.ignoreMissing ? '} catch (e) {}\n' : '');
@@ -476,7 +477,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         impdPathJS = node.path;
       }
-      var impdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
+      var impdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       out += '_ctx.' + node.alias + ' = (await (await _swig.getTemplate(' + impdPathJS + ', ' + impdOpts + '))(_ctx)).exports;\n';
       return;
     }
@@ -501,7 +502,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         fromdPathJS = node.path;
       }
-      var fromdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
+      var fromdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       var fromdBindings = '';
       utils.each(fromdImports, function (entry) {
         var bindName = entry.alias || entry.name;
@@ -570,7 +571,7 @@ exports.compile = function (template, parents, options, blockName) {
       } else {
         extPathJS = node.path;
       }
-      var extOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || '') + '"}';
+      var extOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || '')) + '"}';
       out += 'var _parentTpl = await _swig.getTemplate(' + extPathJS + ', ' + extOpts + ');\n';
       out += 'var _parentResult = await _parentTpl(_ctx, _mergedBlocks);\n';
       out += '_output = _parentResult.output;\n';
@@ -909,6 +910,14 @@ function groupOperand(node, js, unary) {
   return js;
 }
 
+/*!
+ * The flavor name `emitBinaryOp` writes into an `_utils.isIn` call: one of
+ * the three names `isIn` knows, never the flag's own text. @private
+ */
+function membershipMode(flag) {
+  return (flag === 'twig' || flag === 'django') ? flag : 'jinja2';
+}
+
 function emitBinaryOp(node, d) {
   var left = groupOperand(node.left, emitExpr(node.left, d)),
     right = groupOperand(node.right, emitExpr(node.right, d));
@@ -916,6 +925,13 @@ function emitBinaryOp(node, d) {
     return left + ' ' + node.op + ' ' + right;
   }
   if (node.op === 'in') {
+    // A Twig, Jinja2 or Django `in` carries its flavor name in
+    // `membership` and calls that engine's membership test, which `negate`
+    // turns into `not in`; native swig keeps the JavaScript `in` operator,
+    // which tests keys.
+    if (node.membership) {
+      return '_utils.isIn(' + left + ', ' + right + ', "' + membershipMode(node.membership) + '"' + (node.negate ? ', true' : '') + ')';
+    }
     return left + ' in ' + right;
   }
   // Twig/Jinja2 `~` is explicit string-concat: both sides coerce to

package/lib/index.js

@@ -15,7 +15,7 @@
  *
  * @type {String}
  */
-exports.version = "2.8.3";
+exports.version = "2.9.0";
 
 exports.utils = require('./utils');
 exports.security = require('./security');

package/lib/ir.js

@@ -446,6 +446,8 @@
  * @property {string} op
  * @property {IRExpr} left
  * @property {IRExpr} right
+ * @property {string} [membership] Opt-in for `in`: "twig", "jinja2" or "django" emits `_utils.isIn(left, right, mode)`, that engine's membership test; without it, the JavaScript `in` operator (native swig).
+ * @property {boolean} [negate] With `membership`: the `not in` form, negated inside `_utils.isIn` (Django reads a test it cannot run as false either way).
  * @property {IRLoc} [loc]
  */
 

package/lib/utils.js

@@ -388,3 +388,95 @@ exports.resolve = function (obj, path) {
   }
   return cur;
 };
+
+/*!
+ * Item equality for `isIn`. Jinja2 and Django compare with `===` and treat
+ * null and a missing value as equal (Django reads both as None). Twig
+ * compares two scalars with `==`, as swig-twig's `==` does, and anything
+ * else by identity. @private
+ */
+function sameItem(a, b, twig) {
+  if (a === b) {
+    return true;
+  }
+  if (!twig) {
+    return (a === null || a === undefined) && (b === null || b === undefined);
+  }
+  if ((a !== null && typeof a === 'object') || (b !== null && typeof b === 'object') ||
+      typeof a === 'function' || typeof b === 'function') {
+    return false;
+  }
+  return a == b;
+}
+
+/*!
+ * The membership test of `isIn`: true or false, or null when Jinja2 and
+ * Django cannot run it, where Python raises a TypeError: a container that is
+ * not a list, a string or a mapping, a needle that is not a string tested
+ * against a string, or a list or an object tested against a mapping's keys.
+ * Twig runs every test. @private
+ */
+function membership(needle, haystack, twig) {
+  var keys, i;
+  if (typeof haystack === 'string') {
+    if (typeof needle === 'string' || (twig && typeof needle === 'number')) {
+      return haystack.indexOf(String(needle)) !== -1;
+    }
+    return twig ? false : null;
+  }
+  if (haystack === null || typeof haystack !== 'object') {
+    return twig ? false : null;
+  }
+  if (exports.isArray(haystack)) {
+    for (i = 0; i < haystack.length; i += 1) {
+      if (sameItem(needle, haystack[i], twig)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  if (twig) {
+    keys = Object.keys(haystack);
+    for (i = 0; i < keys.length; i += 1) {
+      if (sameItem(needle, haystack[keys[i]], true)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  if (typeof needle === 'string' || typeof needle === 'number') {
+    return Object.prototype.hasOwnProperty.call(haystack, String(needle));
+  }
+  return (needle !== null && typeof needle === 'object') ? null : false;
+}
+
+/**
+ * Membership test behind the `in` operator of the Twig, Jinja2 and Django
+ * frontends, which set `IRBinaryOp.membership` to their flavor name; native
+ * swig keeps the JavaScript `in` operator, which tests keys. Each flavor
+ * follows its reference engine:
+ *
+ * - Jinja2 and Django (Python's `in`): a list holds an equal item, a string
+ *   a substring (the needle must be a string), a mapping a key (a number
+ *   needle tests the key with the same digits).
+ * - Twig: a list or a mapping holds an equal value, compared loosely; a
+ *   string holds a string or number needle as a substring.
+ *
+ * A test the engine cannot run (Jinja2 raises; Django's if tag reads it as
+ * false) gives false, as does any other container, rather than an error.
+ * With `negate` (the `not in` operator) the result is negated, except that
+ * Django reads a test it cannot run as false for `not in` too.
+ *
+ * @param  {*}       needle
+ * @param  {*}       haystack
+ * @param  {string}  mode      "twig", "jinja2" or "django".
+ * @param  {boolean} [negate]  The `not in` form.
+ * @return {boolean}
+ */
+exports.isIn = function (needle, haystack, mode, negate) {
+  var found = membership(needle, haystack, mode === 'twig');
+  if (found === null) {
+    return negate === true && mode !== 'django';
+  }
+  return negate === true ? !found : found;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-core",
-  "version": "2.8.3",
+  "version": "2.9.0",
   "description": "Shared IR, backend, and runtime for the @rhinostone/swig family of template engines.",
   "keywords": [
     "template",