@rhinostone/swig-core 2.8.4 → 2.9.1

package/README.md

@@ -1,7 +1,7 @@
 @rhinostone/swig-core
 =====================
 
-[![NPM version](https://img.shields.io/npm/v/@rhinostone/swig-core.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig-core) [![Socket Badge](https://socket.dev/api/badge/npm/package/@rhinostone/swig-core)](https://socket.dev/npm/package/@rhinostone/swig-core)
+[![NPM version](https://img.shields.io/npm/v/@rhinostone/swig-core.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig-core) [![Socket Badge](https://socket.dev/api/badge/npm/package/@rhinostone/swig-core)](https://socket.dev/npm/package/@rhinostone/swig-core) [![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/gina-io/swig?label=openssf%20scorecard&style=flat)](https://scorecard.dev/viewer/?uri=github.com/gina-io/swig)
 
 > **Shared runtime** for the `@rhinostone/swig` family of template engines. Not intended for direct consumption unless you are building a custom frontend. Install [@rhinostone/swig](https://www.npmjs.com/package/@rhinostone/swig) for the default Swig (Jinja2/Django-inspired) flavor, [@rhinostone/swig-twig](https://www.npmjs.com/package/@rhinostone/swig-twig) for the Twig flavor, [@rhinostone/swig-jinja2](https://www.npmjs.com/package/@rhinostone/swig-jinja2) for the Python Jinja2 flavor, or [@rhinostone/swig-django](https://www.npmjs.com/package/@rhinostone/swig-django) for the Django flavor — they all pull this package in pinned to the matching version.
 

package/lib/backend.js

@@ -910,6 +910,14 @@ function groupOperand(node, js, unary) {
   return js;
 }
 
+/*!
+ * The flavor name `emitBinaryOp` writes into an `_utils.isIn` call: one of
+ * the three names `isIn` knows, never the flag's own text. @private
+ */
+function membershipMode(flag) {
+  return (flag === 'twig' || flag === 'django') ? flag : 'jinja2';
+}
+
 function emitBinaryOp(node, d) {
   var left = groupOperand(node.left, emitExpr(node.left, d)),
     right = groupOperand(node.right, emitExpr(node.right, d));
@@ -917,6 +925,13 @@ function emitBinaryOp(node, d) {
     return left + ' ' + node.op + ' ' + right;
   }
   if (node.op === 'in') {
+    // A Twig, Jinja2 or Django `in` carries its flavor name in
+    // `membership` and calls that engine's membership test, which `negate`
+    // turns into `not in`; native swig keeps the JavaScript `in` operator,
+    // which tests keys.
+    if (node.membership) {
+      return '_utils.isIn(' + left + ', ' + right + ', "' + membershipMode(node.membership) + '"' + (node.negate ? ', true' : '') + ')';
+    }
     return left + ' in ' + right;
   }
   // Twig/Jinja2 `~` is explicit string-concat: both sides coerce to

package/lib/index.js

@@ -15,7 +15,7 @@
  *
  * @type {String}
  */
-exports.version = "2.8.4";
+exports.version = "2.9.1";
 
 exports.utils = require('./utils');
 exports.security = require('./security');

package/lib/ir.js

@@ -446,6 +446,8 @@
  * @property {string} op
  * @property {IRExpr} left
  * @property {IRExpr} right
+ * @property {string} [membership] Opt-in for `in`: "twig", "jinja2" or "django" emits `_utils.isIn(left, right, mode)`, that engine's membership test; without it, the JavaScript `in` operator (native swig).
+ * @property {boolean} [negate] With `membership`: the `not in` form, negated inside `_utils.isIn` (Django reads a test it cannot run as false either way).
  * @property {IRLoc} [loc]
  */
 

package/lib/utils.js

@@ -2,13 +2,104 @@ var security = require('./security');
 
 var isArray;
 
+/*!
+ * What a \s regex atom matches, tested one code unit at a time.
+ * @private
+ */
+var whitespace = /\s/;
+
 /**
- * Strip leading and trailing whitespace from a string.
+ * Strip leading and trailing whitespace from a string. Linear in the input
+ * length.
  * @param  {string} input
  * @return {string}       Stripped input.
  */
 exports.strip = function (input) {
-  return input.replace(/^\s+|\s+$/g, '');
+  // A /\s+$/ alternative takes quadratic time on a long run of whitespace
+  // that does not end the string; the trailing run is found by trimEnd.
+  // return input.replace(/^\s+|\s+$/g, '');
+  return exports.trimEnd(input.replace(/^\s+/, ''));
+};
+
+/**
+ * Remove trailing characters from a string: whitespace (what `\s` matches)
+ * when `chars` is omitted, otherwise every UTF-16 code unit that `chars`
+ * contains, as a regex character class built from `chars` would. Linear in
+ * the input length, where a `/[...]+$/` regex takes quadratic time on a long
+ * run of those characters that does not end the string. Used by the flavor
+ * filters.
+ * @param  {string} input
+ * @param  {string} [chars] Characters to remove; whitespace when omitted.
+ * @return {string}
+ */
+exports.trimEnd = function (input, chars) {
+  var end = input.length;
+  if (chars === undefined) {
+    while (end > 0 && whitespace.test(input.charAt(end - 1))) {
+      end -= 1;
+    }
+  } else {
+    while (end > 0 && chars.indexOf(input.charAt(end - 1)) !== -1) {
+      end -= 1;
+    }
+  }
+  return input.slice(0, end);
+};
+
+/**
+ * Remove every `<...>` span from a string, with the output of
+ * `input.replace(/<[^>]+>/g, '')`, or of `/<[^>]*>/g` (which also removes
+ * `<>`) when `allowEmpty` is true. Linear in the input length, where those
+ * regexes take quadratic time when many `<` have no `>` after them. Used by
+ * the flavor filters.
+ * @param  {string}  input
+ * @param  {boolean} [allowEmpty] Remove `<>` too.
+ * @return {string}
+ */
+exports.stripTags = function (input, allowEmpty) {
+  var out = '',
+    from = 0,
+    lt = input.indexOf('<'),
+    gt;
+  while (lt !== -1) {
+    gt = input.indexOf('>', lt + 1);
+    if (gt === -1) {
+      break;
+    }
+    if (gt === lt + 1 && !allowEmpty) {
+      lt = input.indexOf('<', lt + 1);
+      continue;
+    }
+    out += input.slice(from, lt);
+    from = gt + 1;
+    lt = input.indexOf('<', from);
+  }
+  return out + input.slice(from);
+};
+
+/**
+ * Remove every `<!-- ... -->` comment from a string, with the output of
+ * `input.replace(/<!--[\s\S]*?-->/g, '')`. Linear in the input length, where
+ * that regex takes quadratic time when many `<!--` have no `-->` after them.
+ * Used by the flavor filters.
+ * @param  {string} input
+ * @return {string}
+ */
+exports.stripComments = function (input) {
+  var out = '',
+    from = 0,
+    open = input.indexOf('<!--'),
+    close;
+  while (open !== -1) {
+    close = input.indexOf('-->', open + 4);
+    if (close === -1) {
+      break;
+    }
+    out += input.slice(from, open);
+    from = close + 3;
+    open = input.indexOf('<!--', from);
+  }
+  return out + input.slice(from);
 };
 
 /**
@@ -388,3 +479,95 @@ exports.resolve = function (obj, path) {
   }
   return cur;
 };
+
+/*!
+ * Item equality for `isIn`. Jinja2 and Django compare with `===` and treat
+ * null and a missing value as equal (Django reads both as None). Twig
+ * compares two scalars with `==`, as swig-twig's `==` does, and anything
+ * else by identity. @private
+ */
+function sameItem(a, b, twig) {
+  if (a === b) {
+    return true;
+  }
+  if (!twig) {
+    return (a === null || a === undefined) && (b === null || b === undefined);
+  }
+  if ((a !== null && typeof a === 'object') || (b !== null && typeof b === 'object') ||
+      typeof a === 'function' || typeof b === 'function') {
+    return false;
+  }
+  return a == b;
+}
+
+/*!
+ * The membership test of `isIn`: true or false, or null when Jinja2 and
+ * Django cannot run it, where Python raises a TypeError: a container that is
+ * not a list, a string or a mapping, a needle that is not a string tested
+ * against a string, or a list or an object tested against a mapping's keys.
+ * Twig runs every test. @private
+ */
+function membership(needle, haystack, twig) {
+  var keys, i;
+  if (typeof haystack === 'string') {
+    if (typeof needle === 'string' || (twig && typeof needle === 'number')) {
+      return haystack.indexOf(String(needle)) !== -1;
+    }
+    return twig ? false : null;
+  }
+  if (haystack === null || typeof haystack !== 'object') {
+    return twig ? false : null;
+  }
+  if (exports.isArray(haystack)) {
+    for (i = 0; i < haystack.length; i += 1) {
+      if (sameItem(needle, haystack[i], twig)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  if (twig) {
+    keys = Object.keys(haystack);
+    for (i = 0; i < keys.length; i += 1) {
+      if (sameItem(needle, haystack[keys[i]], true)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  if (typeof needle === 'string' || typeof needle === 'number') {
+    return Object.prototype.hasOwnProperty.call(haystack, String(needle));
+  }
+  return (needle !== null && typeof needle === 'object') ? null : false;
+}
+
+/**
+ * Membership test behind the `in` operator of the Twig, Jinja2 and Django
+ * frontends, which set `IRBinaryOp.membership` to their flavor name; native
+ * swig keeps the JavaScript `in` operator, which tests keys. Each flavor
+ * follows its reference engine:
+ *
+ * - Jinja2 and Django (Python's `in`): a list holds an equal item, a string
+ *   a substring (the needle must be a string), a mapping a key (a number
+ *   needle tests the key with the same digits).
+ * - Twig: a list or a mapping holds an equal value, compared loosely; a
+ *   string holds a string or number needle as a substring.
+ *
+ * A test the engine cannot run (Jinja2 raises; Django's if tag reads it as
+ * false) gives false, as does any other container, rather than an error.
+ * With `negate` (the `not in` operator) the result is negated, except that
+ * Django reads a test it cannot run as false for `not in` too.
+ *
+ * @param  {*}       needle
+ * @param  {*}       haystack
+ * @param  {string}  mode      "twig", "jinja2" or "django".
+ * @param  {boolean} [negate]  The `not in` form.
+ * @return {boolean}
+ */
+exports.isIn = function (needle, haystack, mode, negate) {
+  var found = membership(needle, haystack, mode === 'twig');
+  if (found === null) {
+    return negate === true && mode !== 'django';
+  }
+  return negate === true ? !found : found;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-core",
-  "version": "2.8.4",
+  "version": "2.9.1",
   "description": "Shared IR, backend, and runtime for the @rhinostone/swig family of template engines.",
   "keywords": [
     "template",