@rhinostone/swig-django 2.8.1 → 2.8.3

package/README.md

@@ -33,7 +33,7 @@ Renders real Django templates — everything below was cross-checked against Dja
 * **Variable resolution** — Django-faithful attribute / dictionary / index lookup. Callable attributes are auto-called (honoring `alters_data` / `do_not_call_in_templates`), numeric indexing works (`{{ list.0 }}`), and dicts iterate via `.keys` / `.values` / `.items`.
 * **Filter arguments** — Django colon syntax (`{{ value|date:"Y-m-d" }}`).
 * **Filters** — 42 built-ins (`add`, `addslashes`, `capfirst`, `center`, `cut`, `date`, `default`, `default_if_none`, `divisibleby`, `escape` / `e`, `escapejs`, `filesizeformat`, `first`, `floatformat`, `force_escape`, `get_digit`, `iriencode`, `join`, `last`, `length`, `linebreaks`, `linebreaksbr`, `linenumbers`, `ljust`, `lower`, `make_list`, `phone2numeric`, `pluralize`, `rjust`, `safe`, `slice`, `slugify`, `striptags`, `time`, `title`, `truncatechars`, `truncatewords`, `upper`, `urlencode`, `wordcount`, `wordwrap`, `yesno`). See `lib/filters.js` for the full list.
-* **Async** — `renderFileAsync` / `compileFileAsync` for async loaders, plus `renderFile(path, locals, cb)` against a loader with `async === true`.
+* **Async** — `renderFile(path, locals, cb)` against a loader with `async === true`, or `compileFile` with `codegenMode: 'async'`; `renderFileAsync` / `compileFileAsync` still work but are deprecated.
 
 Explicitly unsupported (parse-time throw or absent)
 ---------------------------------------------------

package/lib/filters.js

@@ -657,8 +657,18 @@ exports.iriencode = function (input) {
   return out;
 };
 
+/*!
+ * Split a string into code points, keeping a surrogate pair together as
+ * Python's `str` iteration does. @private
+ */
+function codePoints(s) {
+  return s.match(/[\uD800-\uDBFF][\uDC00-\uDFFF]|[\s\S]/g) || [];
+}
+
 /**
- * Join a list with a string (Django's `join`).
+ * Join a list with a string (Django's `join`). A string joins its
+ * characters and a mapping its keys, as Python's `str.join` iterates them;
+ * any other input is returned unchanged.
  *
  * @example
  * {{ list|join:", " }}  // list = ['a', 'b', 'c']
@@ -669,8 +679,15 @@ exports.iriencode = function (input) {
  * @return {*}
  */
 exports.join = function (input, glue) {
+  if (glue === undefined) { glue = ''; }
+  if (typeof input === 'string') {
+    return codePoints(input).join(glue);
+  }
   if (utils.isArray(input)) {
-    return input.join(glue !== undefined ? glue : '');
+    return input.join(glue);
+  }
+  if (input && typeof input === 'object') {
+    return utils.keys(input).join(glue);
   }
   return input;
 };
@@ -861,10 +878,32 @@ exports.phone2numeric = function (input) {
   });
 };
 
+/*!
+ * Parse a string as Python's `float()` does: surrounding whitespace, an
+ * optional sign, then digits (single underscores allowed between them)
+ * with an optional fraction and exponent, or inf / infinity / nan in any
+ * case. Returns undefined where Python raises ValueError. @private
+ */
+function pyFloat(s) {
+  var t = s.replace(/^\s+|\s+$/g, '');
+  if (/^[+-]?(inf|infinity)$/i.test(t)) {
+    return (t.charAt(0) === '-') ? -Infinity : Infinity;
+  }
+  if (/^[+-]?nan$/i.test(t)) {
+    return NaN;
+  }
+  if (!/^[+-]?(\d(_?\d)*(\.(\d(_?\d)*)?)?|\.\d(_?\d)*)([eE][+-]?\d(_?\d)*)?$/.test(t)) {
+    return undefined;
+  }
+  return parseFloat(t.replace(/_/g, ''));
+}
+
 /**
  * Return a plural suffix based on a count (Django's `pluralize`). With no
  * argument the suffix is `"s"`; a `"singular,plural"` argument supplies both
- * forms. The count may be a number or anything with a `length`.
+ * forms. As in Django, a number or boolean is compared with 1, a string must
+ * parse as a Python float (otherwise the result is the empty string), and a
+ * list or mapping counts its items; any other input gives the empty string.
  *
  * @example
  * message{{ 2|pluralize }}
@@ -894,13 +933,22 @@ exports.pluralize = function (input, arg) {
   singular = bits[0];
   plural = bits[1];
 
-  n = parseFloat(input);
-  if (typeof input === 'number' || (typeof input === 'string' && input.replace(/^\s+|\s+$/g, '') !== '' && !isNaN(n))) {
+  if (typeof input === 'number' || typeof input === 'boolean') {
+    return Number(input) === 1 ? singular : plural;
+  }
+  if (typeof input === 'string') {
+    n = pyFloat(input);
+    if (n === undefined) {
+      return '';
+    }
     return n === 1 ? singular : plural;
   }
-  if (input !== null && input !== undefined && typeof input.length === 'number') {
+  if (utils.isArray(input)) {
     return input.length === 1 ? singular : plural;
   }
+  if (Object.prototype.toString.call(input) === '[object Object]') {
+    return utils.keys(input).length === 1 ? singular : plural;
+  }
   return '';
 };
 
@@ -1055,9 +1103,31 @@ exports.title = function (input) {
   });
 };
 
+/*!
+ * Convert a count as Python's `int()` does: a number truncates toward
+ * zero, a boolean gives 0 or 1, and a string must be an optionally signed
+ * run of digits (single underscores allowed between them, surrounding
+ * whitespace allowed). Returns NaN where Python raises. @private
+ */
+function pyInt(arg) {
+  if (typeof arg === 'number') {
+    if (!isFinite(arg)) { return NaN; }
+    return (arg < 0) ? Math.ceil(arg) : Math.floor(arg);
+  }
+  if (typeof arg === 'boolean') {
+    return arg ? 1 : 0;
+  }
+  if (typeof arg === 'string' && /^\s*[+-]?\d(_?\d)*\s*$/.test(arg)) {
+    return parseInt(arg.replace(/_/g, ''), 10);
+  }
+  return NaN;
+}
+
 /**
  * Truncate the value to a number of characters, ending with an ellipsis
  * (Django's `truncatechars`). The ellipsis (`…`) counts toward the length.
+ * A length of 0 or less gives the empty string; a length Python's `int()`
+ * cannot read (such as `"3abc"` or `"2.5"`) returns the value unchanged.
  *
  * @example
  * {{ "Joel is a slug"|truncatechars:7 }}
@@ -1069,20 +1139,24 @@ exports.title = function (input) {
  */
 exports.truncatechars = function (input, arg) {
   var s = String(input),
-    n = parseInt(arg, 10);
+    n = pyInt(arg);
   if (isNaN(n)) {
     return s;
   }
+  if (n <= 0) {
+    return '';
+  }
   if (s.length <= n) {
     return s;
   }
-  return s.substr(0, n - 1 < 0 ? 0 : n - 1) + '…';
+  return s.substr(0, n - 1) + '…';
 };
 
 /**
  * Truncate the value to a number of words, ending with a space + ellipsis
  * (Django's `truncatewords`). Whitespace runs within the kept portion are
- * collapsed to single spaces.
+ * collapsed to single spaces. A count of 0 or less gives the empty string;
+ * a count Python's `int()` cannot read returns the value unchanged.
  *
  * @example
  * {{ "Joel is a slug"|truncatewords:2 }}
@@ -1093,11 +1167,14 @@ exports.truncatechars = function (input, arg) {
  * @return {string}
  */
 exports.truncatewords = function (input, arg) {
-  var n = parseInt(arg, 10),
+  var n = pyInt(arg),
     words;
   if (isNaN(n)) {
     return String(input);
   }
+  if (n <= 0) {
+    return '';
+  }
   words = String(input).replace(/^\s+|\s+$/g, '').split(/\s+/);
   if (words.length === 1 && words[0] === '') {
     return '';

package/lib/index.js

@@ -24,6 +24,16 @@ var utils = require('@rhinostone/swig-core/lib/utils'),
 
 exports.name = 'django';
 
+/**
+ * Package version number as a string. The packages of the family are
+ * released together, so they share one version.
+ * @example
+ * if (django.version === "2.8.2") { ... }
+ *
+ * @type {String}
+ */
+exports.version = "2.8.3";
+
 /**
  * Expression-level parser — Pratt-style recursive descent that consumes
  * Django lexer tokens and returns swig-core IRExpr nodes, plus the top-level
@@ -81,7 +91,7 @@ function validateOptions(options) {
     if (!options.hasOwnProperty(key)) {
       return;
     }
-    if (!utils.isArray(options[key]) || options[key].length !== 2) {
+    if (!utils.isArray(options[key]) || options[key].length !== 2 || typeof options[key][0] !== 'string' || typeof options[key][1] !== 'string') {
       throw new Error('Option "' + key + '" must be an array containing 2 different control strings.');
     }
     if (options[key][0] === options[key][1]) {
@@ -89,7 +99,7 @@ function validateOptions(options) {
     }
     utils.each(options[key], function (a, i) {
       if (a.length < 2) {
-        throw new Error('Option "' + key + '" ' + ((i) ? 'open ' : 'close ') + 'control must be at least 2 characters. Saw "' + a + '" instead.');
+        throw new Error('Option "' + key + '" ' + ((i) ? 'close ' : 'open ') + 'control must be at least 2 characters. Saw "' + a + '" instead.');
       }
     });
   });
@@ -158,7 +168,14 @@ exports.Django = function (opts) {
     filters: _filters,
     validateOptions: validateOptions,
     onCompileError: function (err, options) {
-      utils.throwError(err, null, options.filename);
+      var filename = options && options.filename;
+      // An error with no file name to add, or one whose message already
+      // names the file (a tag's own throwError does), is rethrown
+      // unchanged instead of being wrapped a second time.
+      if (err instanceof Error && (!filename || err.message.indexOf(' in file ' + filename) !== -1)) {
+        throw err;
+      }
+      utils.throwError(err, null, filename);
     }
   });
 

package/lib/parser.js

@@ -115,12 +115,12 @@ exports.parseExpr = function (tokens, filters, _posOut) {
 
   function guardSegment(segment) {
     if (_dangerousProps.indexOf(segment) !== -1) {
-      bail('Unsafe access to "' + segment + '" is not allowed in templates (CVE-2023-25345)');
+      bail('Unsafe access to "' + segment + '" is not allowed in templates (prototype-chain guard)');
     }
   }
   function guardBracketString(value) {
     if (_dangerousProps.indexOf(value) !== -1) {
-      bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (CVE-2023-25345)');
+      bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (prototype-chain guard)');
     }
   }
 

package/lib/tags/block.js

@@ -66,7 +66,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
     utils.throwError('Block name "' + nameTok.match + '" must be a bare identifier', line, opts.filename);
   }
   if (_dangerousProps.indexOf(nameTok.match) !== -1) {
-    utils.throwError('Unsafe block name "' + nameTok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+    utils.throwError('Unsafe block name "' + nameTok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
   }
 
   pos += 1;

package/lib/tags/for.js

@@ -163,7 +163,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
       utils.throwError('Loop variable "' + tok.match + '" must be a bare identifier in "for" tag', line, opts.filename);
     }
     if (_dangerousProps.indexOf(tok.match) !== -1) {
-      utils.throwError('Unsafe loop variable "' + tok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe loop variable "' + tok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
     return tok.match;
   }

package/lib/tags/include.js

@@ -107,7 +107,7 @@ function parsePairs(clause, parser, types, line, opts) {
       utils.throwError('"with" assignment target "' + nameTok.match + '" must be a bare identifier in "include" tag', line, opts.filename);
     }
     if (_dangerousProps.indexOf(nameTok.match) !== -1) {
-      utils.throwError('Unsafe "with" assignment to "' + nameTok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe "with" assignment to "' + nameTok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
     pos = j + 1;
     skipWS();
@@ -178,7 +178,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
   }
   var pathExpr = parser.parseExpr(pathTokens);
 
-  var resolveFrom = (opts.filename || '').replace(/\\/g, '\\\\');
+  var resolveFrom = (opts.filename || '');
   token.irExpr = ir.include(pathExpr, ctxExpr, isolated, false, resolveFrom);
   return true;
 };

package/lib/tags/with.js

@@ -59,7 +59,7 @@ function guardName(name, line, opts) {
     utils.throwError('"with" assignment target "' + name + '" must be a bare identifier', line, opts.filename);
   }
   if (_dangerousProps.indexOf(name) !== -1) {
-    utils.throwError('Unsafe "with" assignment to "' + name + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+    utils.throwError('Unsafe "with" assignment to "' + name + '" is not allowed (prototype-chain guard)', line, opts.filename);
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-django",
-  "version": "2.8.1",
+  "version": "2.8.3",
   "description": "Django-syntax frontend for the @rhinostone/swig-core template engine. Part of the @rhinostone/swig multi-flavor family.",
   "keywords": [
     "template",
@@ -22,7 +22,7 @@
     "node": ">=12"
   },
   "peerDependencies": {
-    "@rhinostone/swig-core": "2.8.1"
+    "@rhinostone/swig-core": "2.8.3"
   },
   "publishConfig": {
     "access": "public"