@rhinostone/swig-django 2.8.4 → 2.9.1

package/README.md

@@ -1,7 +1,7 @@
 @rhinostone/swig-django
 =======================
 
-[![NPM version](https://img.shields.io/npm/v/@rhinostone/swig-django.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig-django) [![Socket Badge](https://socket.dev/api/badge/npm/package/@rhinostone/swig-django)](https://socket.dev/npm/package/@rhinostone/swig-django)
+[![NPM version](https://img.shields.io/npm/v/@rhinostone/swig-django.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig-django) [![Socket Badge](https://socket.dev/api/badge/npm/package/@rhinostone/swig-django)](https://socket.dev/npm/package/@rhinostone/swig-django) [![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/gina-io/swig?label=openssf%20scorecard&style=flat)](https://scorecard.dev/viewer/?uri=github.com/gina-io/swig)
 
 Django Template Language frontend for the [@rhinostone/swig-core](https://www.npmjs.com/package/@rhinostone/swig-core) template engine. Part of the multi-flavor architecture introduced in `2.0.0` — see [ROADMAP.md](https://github.com/gina-io/swig/blob/develop/ROADMAP.md) for the release narrative.
 

package/lib/filters.js

@@ -559,7 +559,10 @@ exports.floatformat = function (input, arg) {
   if (arg === undefined || arg === null || arg === '') {
     p = -1;
   } else {
-    a = String(arg).replace(/[gu]+$/, '');
+    // A /[gu]+$/ regex takes quadratic time on a long run of g or u not at the
+    // end; trimEnd removes the same characters in linear time.
+    // a = String(arg).replace(/[gu]+$/, '');
+    a = utils.trimEnd(String(arg), 'gu');
     p = parseInt(a, 10);
     if (isNaN(p)) {
       return String(input);
@@ -885,7 +888,10 @@ exports.phone2numeric = function (input) {
  * case. Returns undefined where Python raises ValueError. @private
  */
 function pyFloat(s) {
-  var t = s.replace(/^\s+|\s+$/g, '');
+  // A trailing \s+$ takes quadratic time on a long run of whitespace inside
+  // the value; utils.strip gives the same output in linear time.
+  // var t = s.replace(/^\s+|\s+$/g, '');
+  var t = utils.strip(s);
   if (/^[+-]?(inf|infinity)$/i.test(t)) {
     return (t.charAt(0) === '-') ? -Infinity : Infinity;
   }
@@ -1050,7 +1056,10 @@ exports.slugify = function (input) {
     value = value.normalize('NFKD').replace(/[\u0300-\u036f]/g, '');
   }
   value = value.toLowerCase().replace(/[^\w\s-]/g, '');
-  return value.replace(/[-\s]+/g, '-').replace(/^[-_]+|[-_]+$/g, '');
+  // A trailing [-_]+$ takes quadratic time on a long run of _ inside the
+  // value; trimEnd removes the same characters in linear time.
+  // return value.replace(/[-\s]+/g, '-').replace(/^[-_]+|[-_]+$/g, '');
+  return utils.trimEnd(value.replace(/[-\s]+/g, '-').replace(/^[-_]+/, ''), '-_');
 };
 
 /**
@@ -1064,7 +1073,11 @@ exports.slugify = function (input) {
  * @return {string}
  */
 exports.striptags = function (input) {
-  return String(input).replace(/(<([^>]+)>)/ig, '');
+  // This regex takes time quadratic in the input length on many < with no >
+  // after them (about 5 s for 100 000 characters); stripTags gives the same
+  // output in linear time.
+  // return String(input).replace(/(<([^>]+)>)/ig, '');
+  return utils.stripTags(String(input));
 };
 
 /**
@@ -1175,7 +1188,10 @@ exports.truncatewords = function (input, arg) {
   if (n <= 0) {
     return '';
   }
-  words = String(input).replace(/^\s+|\s+$/g, '').split(/\s+/);
+  // A trailing \s+$ takes quadratic time on a long run of whitespace inside
+  // the value; utils.strip gives the same output in linear time.
+  // words = String(input).replace(/^\s+|\s+$/g, '').split(/\s+/);
+  words = utils.strip(String(input)).split(/\s+/);
   if (words.length === 1 && words[0] === '') {
     return '';
   }

package/lib/index.js

@@ -32,7 +32,7 @@ exports.name = 'django';
  *
  * @type {String}
  */
-exports.version = "2.8.4";
+exports.version = "2.9.1";
 
 /**
  * Expression-level parser — Pratt-style recursive descent that consumes

package/lib/lexer.js

@@ -115,7 +115,7 @@ var rules = [
   {
     type: TYPES.COMPARATOR,
     regex: [
-      /^(===|==|\!==|\!=|<=|<|>=|>|in\s)\s*/
+      /^(===|==|\!==|\!=|<=|<|>=|>|not\s+in\s|in\s)\s*/
     ],
     idx: 1
   },

package/lib/parser.js

@@ -21,6 +21,27 @@ function escapeRegExp(str) {
  */
 var _reserved = ['break', 'case', 'catch', 'continue', 'debugger', 'default', 'delete', 'do', 'else', 'finally', 'for', 'function', 'if', 'in', 'instanceof', 'new', 'return', 'switch', 'this', 'throw', 'try', 'typeof', 'var', 'void', 'while', 'with'];
 
+/**
+ * Build the IR of `left in right`, or of `left not in right` when `negate`
+ * is set: a BinaryOp `in` flagged with this flavor's name, so swig-core
+ * emits Django's membership test (`_utils.isIn`) instead of the JavaScript
+ * `in` operator, which tests keys.
+ *
+ * @param  {object}  left     The needle.
+ * @param  {object}  right    The container.
+ * @param  {boolean} [negate] The `not in` form.
+ * @return {object}           IRBinaryOp.
+ * @private
+ */
+function membership(left, right, negate) {
+  var node = ir.binaryOp('in', left, right);
+  node.membership = 'django';
+  if (negate) {
+    node.negate = true;
+  }
+  return node;
+}
+
 /**
  * Build a VarRef IR node flagged for Django-style runtime resolution. The
  * `resolve` flag makes swig-core's emitVarRef emit `_utils.resolve(_ctx,
@@ -135,6 +156,9 @@ exports.parseExpr = function (tokens, filters, _posOut) {
       if (m === '===' || m === '!==' || m === '==' || m === '!=') {
         return { op: m, prec: 3 };
       }
+      if (/^not\s+in$/.test(m)) {
+        return { op: 'not in', prec: 4 };
+      }
       return { op: m, prec: 4 };
     }
     // Django `is` / `is not` are *identity* comparisons (not Jinja2 test
@@ -453,7 +477,7 @@ exports.parseExpr = function (tokens, filters, _posOut) {
         continue;
       }
       var right = parseExpression(info.prec + 1);
-      left = ir.binaryOp(info.op, left, right);
+      left = (info.op === 'in' || info.op === 'not in') ? membership(left, right, info.op === 'not in') : ir.binaryOp(info.op, left, right);
     }
     return left;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-django",
-  "version": "2.8.4",
+  "version": "2.9.1",
   "description": "Django-syntax frontend for the @rhinostone/swig-core template engine. Part of the @rhinostone/swig multi-flavor family.",
   "keywords": [
     "template",
@@ -22,7 +22,7 @@
     "node": ">=12"
   },
   "peerDependencies": {
-    "@rhinostone/swig-core": "2.8.4"
+    "@rhinostone/swig-core": "2.9.1"
   },
   "publishConfig": {
     "access": "public"