@rhinostone/swig-django 2.7.0

package/lib/tags/verbatim.js

@@ -0,0 +1,51 @@
+/*!
+ * Django `{% verbatim %}…{% endverbatim %}` tag.
+ *
+ * Preserves arbitrary template-like content as literal output. Inside a
+ * verbatim block, `{{ … }}`, `{% … %}` (other than `{% endverbatim %}`), and
+ * `{# … #}` are NOT parsed — the splitter in `parser.js` flips an `inRaw`
+ * flag (set on the `verbatim` tag name, cleared on `{% endverbatim %}`) that
+ * bypasses the variable / tag / comment branches and wraps each chunk as
+ * `ir.text`, so the content array handed to this tag's compile is already a
+ * list of IRText nodes.
+ *
+ * Takes no arguments. Extra tokens after `verbatim` are rejected at parse
+ * time with a filename-aware throw.
+ */
+
+var utils = require('@rhinostone/swig-core/lib/utils');
+
+exports.ends = true;
+exports.block = false;
+
+/**
+ * Reject any tokens after the `verbatim` keyword. The splitter owns all
+ * content-capture behaviour via its `inRaw` flag, so this handler only has
+ * to validate the tag's own argument list (which must be empty).
+ *
+ * @param  {string} str    Tag body (everything after `verbatim`).
+ * @param  {number} line   Source line of the opening `{%`.
+ * @param  {object} parser The Django parser module (unused).
+ * @param  {object} types  Django lexer token-type enum (unused).
+ * @param  {Array}  stack  Open-tag stack (parser.js manages the push).
+ * @param  {object} opts   Per-call options (honors `opts.filename`).
+ * @return {boolean}       Always `true` on success. Throws otherwise.
+ */
+exports.parse = function (str, line, parser, types, stack, opts) {
+  var stripped = utils.strip(str || '');
+  if (stripped.length > 0) {
+    utils.throwError('Unexpected token "' + stripped + '" after "verbatim"', line, opts.filename);
+  }
+  return true;
+};
+
+/**
+ * Return the captured content array unchanged. Each item is already an
+ * IRText node (the splitter wrapped it while `inRaw` was set), so the
+ * backend's emit loop can iterate and emit without any further wrapping.
+ *
+ * @return {Array} Content node list.
+ */
+exports.compile = function (compiler, args, content) {
+  return content;
+};

package/lib/tags/with.js

@@ -0,0 +1,157 @@
+/*!
+ * Django `{% with %}` tag.
+ *
+ *   {% with a=1 b=total %}…{% endwith %}      (modern — space-separated pairs)
+ *   {% with business.total as t %}…{% endwith %}  (legacy single-binding form)
+ *
+ * Binds one or more names in a new inner scope for the body. Each value is
+ * lowered through `parser.parseExpr` and collected into an object literal
+ * that the backend's `With` branch merges over a shallow copy of the outer
+ * context — so an assignment's value sees the enclosing scope (not its
+ * sibling assignments), and the inner bindings do not leak past
+ * `{% endwith %}`. The region is never isolated (Django has no `only` here).
+ *
+ * The modern form uses space-separated `name=value` pairs (Django's shape,
+ * NOT Jinja2's comma-separated list). The legacy form is a single
+ * `<expr> as <name>`. Each assignment target is a bare identifier — dotted
+ * paths and CVE-2023-25345 prototype-chain names are rejected before the
+ * binding lands.
+ */
+
+var ir = require('@rhinostone/swig-core/lib/ir');
+var utils = require('@rhinostone/swig-core/lib/utils');
+var _dangerousProps = require('@rhinostone/swig-core/lib/security').dangerousProps;
+
+var lexer = require('../lexer');
+
+/*!
+ * Strip WHITESPACE tokens from both ends of a slice range. @private
+ */
+function sliceTrim(tokens, start, end, types) {
+  while (start < end && tokens[start].type === types.WHITESPACE) { start += 1; }
+  while (end > start && tokens[end - 1].type === types.WHITESPACE) { end -= 1; }
+  return tokens.slice(start, end);
+}
+
+/*!
+ * Find the first depth-0 VAR token whose match equals `word`. @private
+ */
+function findKeyword(tokens, types, word) {
+  var depth = 0, i, tk;
+  for (i = 0; i < tokens.length; i += 1) {
+    tk = tokens[i];
+    if (tk.type === types.PARENOPEN || tk.type === types.BRACKETOPEN ||
+        tk.type === types.CURLYOPEN || tk.type === types.FUNCTION) { depth += 1; continue; }
+    if (tk.type === types.PARENCLOSE || tk.type === types.BRACKETCLOSE ||
+        tk.type === types.CURLYCLOSE) { depth -= 1; continue; }
+    if (depth !== 0 || tk.type !== types.VAR) { continue; }
+    if (tk.match === word) { return i; }
+  }
+  return -1;
+}
+
+/*!
+ * Validate an assignment target name (bare identifier, not a dangerous
+ * prototype-chain property). @private
+ */
+function guardName(name, line, opts) {
+  if (name.indexOf('.') !== -1) {
+    utils.throwError('"with" assignment target "' + name + '" must be a bare identifier', line, opts.filename);
+  }
+  if (_dangerousProps.indexOf(name) !== -1) {
+    utils.throwError('Unsafe "with" assignment to "' + name + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+  }
+}
+
+/*!
+ * Parse space-separated `name = value` pairs from a token slice into IR
+ * object properties. Mirrors the include tag's k=v parsing: each value is
+ * one expression (parseExpr stops at the next bare name). @private
+ */
+function parsePairs(tokens, parser, types, line, opts) {
+  var props = [];
+  var pos = 0;
+  function skipWS() { while (pos < tokens.length && tokens[pos].type === types.WHITESPACE) { pos += 1; } }
+
+  while (true) {
+    skipWS();
+    if (pos >= tokens.length) { break; }
+    var nameTok = tokens[pos];
+    if (nameTok.type !== types.VAR) {
+      utils.throwError('Expected an assignment name in "with" tag', line, opts.filename);
+    }
+    var j = pos + 1;
+    while (j < tokens.length && tokens[j].type === types.WHITESPACE) { j += 1; }
+    if (!(j < tokens.length && tokens[j].type === types.ASSIGNMENT && tokens[j].match === '=')) {
+      utils.throwError('Expected "=" after "' + nameTok.match + '" in "with" tag', line, opts.filename);
+    }
+    guardName(nameTok.match, line, opts);
+    pos = j + 1;
+    skipWS();
+    var posOut = {};
+    var valExpr = parser.parseExpr(tokens.slice(pos), {}, posOut);
+    pos += posOut.pos;
+    props.push(ir.objectProperty(ir.literal('string', nameTok.match), valExpr));
+  }
+  return props;
+}
+
+exports.ends = true;
+exports.block = false;
+
+/**
+ * Parse the `{% with %}` tag body into an object literal on `token.irExpr`.
+ * Supports both the modern space-separated `name=value` form and the legacy
+ * `<expr> as <name>` form.
+ *
+ * @param  {string} str    Tag body.
+ * @param  {number} line   Source line of the opening `{%`.
+ * @param  {object} parser The Django parser module (exposes `parseExpr`).
+ * @param  {object} types  Django lexer token-type enum.
+ * @param  {Array}  stack  Open-tag stack (parser.js manages the push).
+ * @param  {object} opts   Per-call options (honors `opts.filename`).
+ * @param  {object} swig   Swig instance (unused).
+ * @param  {object} token  In-progress TagToken. Gets `token.irExpr`.
+ * @return {boolean}       Always `true` on success. Throws otherwise.
+ */
+exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
+  var tokens = lexer.read(utils.strip(str));
+  if (!tokens.length) {
+    utils.throwError('Expected at least one assignment in "with" tag', line, opts.filename);
+  }
+
+  var props;
+  var asIdx = findKeyword(tokens, types, 'as');
+
+  if (asIdx !== -1) {
+    // Legacy `<expr> as <name>` form.
+    var exprTokens = sliceTrim(tokens, 0, asIdx, types);
+    var nameTokens = sliceTrim(tokens, asIdx + 1, tokens.length, types);
+    if (!exprTokens.length) {
+      utils.throwError('Expected an expression before "as" in "with" tag', line, opts.filename);
+    }
+    if (nameTokens.length !== 1 || nameTokens[0].type !== types.VAR) {
+      utils.throwError('Expected a single variable name after "as" in "with" tag', line, opts.filename);
+    }
+    guardName(nameTokens[0].match, line, opts);
+    props = [ir.objectProperty(ir.literal('string', nameTokens[0].match), parser.parseExpr(exprTokens))];
+  } else {
+    props = parsePairs(tokens, parser, types, line, opts);
+  }
+
+  token.irExpr = ir.objectLiteral(props);
+  return true;
+};
+
+/**
+ * Emit an IRWith node carrying the assignment object literal and the
+ * recursively-compiled body wrapped in IRLegacyJS. The region is never
+ * isolated; the backend's `With` branch merges the context over a shallow
+ * copy of `_ctx` for the body's lexical scope.
+ *
+ * @return {object} IRWith node.
+ */
+exports.compile = function (compiler, args, content, parents, options, blockName, token) {
+  var bodyJS = compiler(content, parents, options, blockName);
+  return ir.withStmt(token.irExpr, false, [ir.legacyJS(bodyJS)]);
+};

package/lib/tokentypes.js

@@ -0,0 +1,87 @@
+/**
+ * Django lexer token type enum — the contract between the Django lexer and
+ * the Django parser in @rhinostone/swig-django.
+ *
+ * Numeric IDs in the shared range (0–25, 100) mirror
+ * @rhinostone/swig-core/lib/tokentypes by design: Django and native Swig
+ * lower to the same swig-core IR, and aligning the IDs keeps shared
+ * consumers (e.g. CVE-2023-25345 `_dangerousProps` enforcement) flavor-
+ * agnostic. The Django parser is its own module — it does not inherit from
+ * swig-core's TokenParser — but the cognitive overhead of re-mapping IDs
+ * across flavors is not worth the freedom.
+ *
+ * Django-only IDs (30+) are reserved here. The Django Template Language has
+ * none of Jinja2's `~` concat, `**` power, or `//` floor-division operators
+ * (so those Jinja2-only IDs are absent), but it does have `is` / `is not` —
+ * as an *identity* comparison, not Jinja2's test calls — so IS / ISNOT keep
+ * the same IDs as the Jinja2 sibling for consistency. `None` lexes to its
+ * own NONE token (Django's null literal), distinct from BOOL (`True` /
+ * `False`).
+ *
+ * @readonly
+ * @enum {number}
+ */
+module.exports = {
+  /** Whitespace */
+  WHITESPACE: 0,
+  /** Plain string literal */
+  STRING: 1,
+  /** Variable filter call with arguments — `|name(...)` (unused by Django; kept for ID alignment) */
+  FILTER: 2,
+  /** Variable filter call — `|name` (Django filters grab an optional `:arg` in the parser) */
+  FILTEREMPTY: 3,
+  /** Function call with arguments — `name(...)` */
+  FUNCTION: 4,
+  /** Function call with no arguments — `name()` */
+  FUNCTIONEMPTY: 5,
+  /** Open parenthesis */
+  PARENOPEN: 6,
+  /** Close parenthesis */
+  PARENCLOSE: 7,
+  /** Comma */
+  COMMA: 8,
+  /** Variable identifier */
+  VAR: 9,
+  /** Numeric literal */
+  NUMBER: 10,
+  /** Math operator (+, -, *, /, %) */
+  OPERATOR: 11,
+  /** Open square bracket */
+  BRACKETOPEN: 12,
+  /** Close square bracket */
+  BRACKETCLOSE: 13,
+  /** Dot-key accessor — `.key` */
+  DOTKEY: 14,
+  /** Open square bracket at the start of an array literal */
+  ARRAYOPEN: 15,
+  /** Open curly brace */
+  CURLYOPEN: 17,
+  /** Close curly brace */
+  CURLYCLOSE: 18,
+  /** Colon — object-literal key/value separator, slice subscript, and Django filter argument separator (`|date:"Y"`) */
+  COLON: 19,
+  /** JavaScript-valid comparator (==, !=, <=, etc.) */
+  COMPARATOR: 20,
+  /** Boolean logic (`and`, `or`, `&&`, `||`) */
+  LOGIC: 21,
+  /** Boolean negation (`not`, `!`) */
+  NOT: 22,
+  /** Boolean literal (`True`, `False`) */
+  BOOL: 23,
+  /** Variable assignment (`=`, `+=`, `-=`, `*=`, `/=`) */
+  ASSIGNMENT: 24,
+  /** Method call open — internal */
+  METHODOPEN: 25,
+
+  /* ---- Django-only token IDs ---- */
+
+  /** Django identity operator — `is` (lowers to `===`, NOT a Jinja2-style test call) */
+  IS: 33,
+  /** Django negated identity operator — `is not` (lowers to `!==`) */
+  ISNOT: 34,
+  /** Django null literal — `None` (lowers to a JS `null` literal) */
+  NONE: 35,
+
+  /** Unknown token */
+  UNKNOWN: 100
+};

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@rhinostone/swig-django",
+  "version": "2.7.0",
+  "description": "Django-syntax frontend for the @rhinostone/swig-core template engine. Part of the @rhinostone/swig multi-flavor family.",
+  "keywords": [
+    "template",
+    "templating",
+    "django",
+    "swig",
+    "swig-django",
+    "frontend"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/gina-io/swig.git",
+    "directory": "packages/swig-django"
+  },
+  "author": "Rhinostone <contact@gina.io>",
+  "license": "MIT",
+  "main": "lib/index.js",
+  "engines": {
+    "node": ">=12"
+  },
+  "peerDependencies": {
+    "@rhinostone/swig-core": "2.7.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}