@rhinostone/swig-django 2.9.7 → 2.9.9

package/README.md

@@ -43,7 +43,7 @@ Explicitly unsupported (parse-time throw or absent)
 * `{% url %}`, `{% static %}`, `{% csrf_token %}`, `{% trans %}`, `{% blocktrans %}` — framework infrastructure, out of scope.
 * No whitespace-control (`{%- … -%}`) — not part of the Django Template Language.
 * No `is` tests — Django's `is` is identity comparison, not Jinja2-style tests.
-* `{{ block.super }}`, `{% for … reversed %}`, and one-variable `{% for x in dict.items %}` are deferred (clear parse-time errors).
+* `{% for … reversed %}` is deferred (a clear parse-time error). `{{ block.super }}` is deferred too, and renders an empty string with no error.
 * Deferred filters — `dictsort` / `dictsortreversed`, `stringformat`, `random`, `urlize` / `urlizetrunc`, `timesince` / `timeuntil`, `unordered_list`, `json_script`, `truncatechars_html` / `truncatewords_html`, `safeseq`, `pprint`.
 
 Repository

package/lib/index.js

@@ -32,7 +32,7 @@ exports.name = 'django';
  *
  * @type {String}
  */
-exports.version = "2.9.7";
+exports.version = "2.9.9";
 
 /**
  * Expression-level parser — Pratt-style recursive descent that consumes

package/lib/lexer.js

@@ -35,12 +35,15 @@ var TYPES = require('./tokentypes');
  *
  *   - FILTEREMPTY / FUNCTION above VAR — `|name` and `name(` must be
  *     consumed as filter / function tokens before VAR's `^[a-zA-Z_$]\w*`
- *     pattern gobbles the bare identifier.
+ *     pattern gobbles the bare identifier. FUNCTION and FUNCTIONEMPTY skip
+ *     `and`, `or`, `not` and `in`, so `not(x)` reads as `not (x)`.
  *   - LOGIC (`and` / `or`), NOT (`not`), BOOL (`True` / `False`), NONE
  *     (`None`), and the `is` / `is not` keywords above VAR — same reason:
  *     bake the keyword sequence into its own token rather than emit an
  *     identifier. The `\b` word boundary keeps identifiers like `Truthy`,
- *     `Nonexistent`, or `island` from matching.
+ *     `Nonexistent`, or `island` from matching; the `and`, `or`, `not` and
+ *     `in` rules take whitespace or `(` after the keyword, so an object key
+ *     such as `{and: 1}` stays a name.
  *
  * Rules are tried in order; first match wins. Patterns are anchored at
  * start-of-string because the consumer slices `str` before each dispatch.
@@ -71,14 +74,14 @@ var rules = [
   {
     type: TYPES.FUNCTIONEMPTY,
     regex: [
-      /^\s*(\w+)\(\)/
+      /^\s*(?!(?:and|or|not|in)\()(\w+)\(\)/
     ],
     idx: 1
   },
   {
     type: TYPES.FUNCTION,
     regex: [
-      /^\s*(\w+)\(/
+      /^\s*(?!(?:and|or|not|in)\()(\w+)\(/
     ],
     idx: 1
   },
@@ -104,7 +107,7 @@ var rules = [
     type: TYPES.LOGIC,
     regex: [
       /^(&&|\|\|)\s*/,
-      /^(and|or)\s+/
+      /^(and|or)(?=[\s(])\s*/
     ],
     idx: 1,
     replace: {
@@ -115,7 +118,7 @@ var rules = [
   {
     type: TYPES.COMPARATOR,
     regex: [
-      /^(===|==|\!==|\!=|<=|<|>=|>|not\s+in\s|in\s)\s*/
+      /^(===|==|\!==|\!=|<=|<|>=|>|not\s+in(?=[\s(])|in(?=[\s(]))\s*/
     ],
     idx: 1
   },
@@ -129,7 +132,7 @@ var rules = [
     type: TYPES.NOT,
     regex: [
       /^\!\s*/,
-      /^not\s+/
+      /^not(?=[\s(])\s*/
     ],
     replace: {
       'not': '!'

package/lib/parser.js

@@ -42,6 +42,24 @@ function membership(left, right, negate) {
   return node;
 }
 
+/**
+ * Build the IR of a call to one of the engine's own helpers (an `_ext` test,
+ * an `_utils` function, a `Math` function), flagged so swig-core reads the
+ * callee from the compiled template's scope and never from the template
+ * context, where a locals key such as `_ext`, `_utils` or `Math` would
+ * replace it.
+ *
+ * @param  {string[]} path  Callee path (`['_utils', 'range']`).
+ * @param  {object[]} args  Argument expressions.
+ * @return {object}         IRFnCall with `closure === true`.
+ * @private
+ */
+function helperCall(path, args) {
+  var node = ir.fnCall(ir.varRef(path), args);
+  node.closure = true;
+  return node;
+}
+
 /**
  * Build a VarRef IR node flagged for Django-style runtime resolution. The
  * `resolve` flag makes swig-core's emitVarRef emit `_utils.resolve(_ctx,
@@ -62,6 +80,30 @@ function mkVar(path) {
   return n;
 }
 
+/**
+ * Apply Django's string_if_invalid ("") to the variable an expression starts
+ * with: the input of its filter chain, or the expression itself. Django
+ * resolves that variable first and gives a failed lookup the value "" before
+ * any filter runs, in `{{ }}` outputs and in the values of `with`, `cycle`
+ * and include-with; `if`, `for` and `firstof` read a failed lookup as None
+ * and do not call this. Sets the VarRef's opt-in `missingAsEmpty` flag (the
+ * backend then passes "" as `_utils.resolve`'s third argument); any other
+ * start (a literal, a subscript) is left as it is.
+ *
+ * @param  {object} expr  IRExpr tree from parseExpr.
+ * @return {object}       The same tree.
+ */
+exports.missingAsEmpty = function (expr) {
+  var head = expr;
+  while (head && head.type === 'FilterCall') {
+    head = head.input;
+  }
+  if (head && head.type === 'VarRef') {
+    head.missingAsEmpty = true;
+  }
+  return expr;
+};
+
 /**
  * Django expression parser — Pratt-style recursive descent.
  *
@@ -145,6 +187,10 @@ exports.parseExpr = function (tokens, filters, _posOut) {
     }
   }
 
+  // Levels follow Django's smartif: `or` 1, `and` 2, then `not` (parsed in
+  // parseUnary, with an operand at level 4), `in` / `not in` 4, and the
+  // comparisons with `is` / `is not` 5, so `not x == y` is `not (x == y)` and
+  // `a == b in c` is `(a == b) in c`. Arithmetic (6, 8) is a swig extension.
   function getBinaryOpInfo(tok) {
     var m;
     if (tok.type === _t.LOGIC) {
@@ -153,22 +199,22 @@ exports.parseExpr = function (tokens, filters, _posOut) {
     }
     if (tok.type === _t.COMPARATOR) {
       m = tok.match;
-      if (m === '===' || m === '!==' || m === '==' || m === '!=') {
-        return { op: m, prec: 3 };
-      }
       if (/^not\s+in$/.test(m)) {
         return { op: 'not in', prec: 4 };
       }
-      return { op: m, prec: 4 };
+      if (m === 'in') {
+        return { op: m, prec: 4 };
+      }
+      return { op: m, prec: 5 };
     }
     // Django `is` / `is not` are *identity* comparisons (not Jinja2 test
     // calls): lowered to `===` / `!==` in parseExpression. Same precedence
     // level as `==` so `x is None` / `x is not None` group naturally.
     if (tok.type === _t.IS) {
-      return { op: 'is', prec: 3 };
+      return { op: 'is', prec: 5 };
     }
     if (tok.type === _t.ISNOT) {
-      return { op: 'is not', prec: 3 };
+      return { op: 'is not', prec: 5 };
     }
     if (tok.type === _t.OPERATOR) {
       m = tok.match;
@@ -330,7 +376,7 @@ exports.parseExpr = function (tokens, filters, _posOut) {
       }
     }
     expectBracketClose();
-    return ir.fnCall(ir.varRef(['_utils', 'slice']), [
+    return helperCall(['_utils', 'slice'], [
       obj,
       startExpr || undefinedLiteral(),
       stopExpr || undefinedLiteral(),
@@ -437,7 +483,9 @@ exports.parseExpr = function (tokens, filters, _posOut) {
     var tok = peek();
     if (tok && tok.type === _t.NOT) {
       consume();
-      return ir.unaryOp('!', parseUnary());
+      // Django's `not` takes in, not in, the comparisons and is into its
+      // operand, and stops at `and` / `or`.
+      return ir.unaryOp('!', parseExpression(4));
     }
     if (tok && tok.type === _t.OPERATOR && (tok.match === '+' || tok.match === '-')) {
       consume();
@@ -603,7 +651,7 @@ exports.parse = function (swig, source, opts, tags, filters) {
         }
       }
     });
-    var expr = exports.parseExpr(lexed, filters);
+    var expr = exports.missingAsEmpty(exports.parseExpr(lexed, filters));
     var tail;
     var esc = escapeStack[escapeStack.length - 1];
     if (esc && !sawSafe) {

package/lib/tags/cycle.js

@@ -75,7 +75,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
     while (pos < tokens.length && tokens[pos].type === types.WHITESPACE) { pos += 1; }
     if (pos >= tokens.length) { break; }
     var posOut = {};
-    var expr = parser.parseExpr(tokens.slice(pos), {}, posOut);
+    var expr = parser.missingAsEmpty(parser.parseExpr(tokens.slice(pos), {}, posOut));
     pos += posOut.pos;
     args.push(expr);
   }
@@ -96,7 +96,10 @@ exports.compile = function (compiler, args, content, parents, options, blockName
 
   var key = ('__cycle' + Math.random()).replace(/\./g, '');
   var value = '__cv[_ctx.' + key + ' % __cv.length]';
-  var emit = token.escape ? '_filters["e"](' + value + ')' : '_utils.coerceOutput(' + value + ')';
+  // A string escape strategy (the `autoescape: 'js'` option) goes to the
+  // `e` filter as its argument, as firstof and `{{ }}` pass it.
+  var strategy = (typeof token.escape === 'string') ? ', ' + backend.emitExpr(ir.literal('string', token.escape)) : '';
+  var emit = token.escape ? '_filters["e"](' + value + strategy + ')' : '_utils.coerceOutput(' + value + ')';
 
   return ir.legacyJS(
     '(function () {\n' +

package/lib/tags/else.js

@@ -22,6 +22,10 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
   if (!top || top.name !== 'if') {
     utils.throwError('"else" is only valid inside an "if" tag', line, opts.filename);
   }
+  // Django rejects anything after else (`{% else if b %}` is not elif).
+  if (utils.strip(str || '')) {
+    utils.throwError('"else" does not accept arguments (found "' + utils.strip(str) + '")', line, opts.filename);
+  }
   return true;
 };
 

package/lib/tags/empty.js

@@ -20,6 +20,9 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
   if (!top || top.name !== 'for') {
     utils.throwError('"empty" is only valid inside a "for" tag', line, opts.filename);
   }
+  if (utils.strip(str || '')) {
+    utils.throwError('"empty" does not accept arguments (found "' + utils.strip(str) + '")', line, opts.filename);
+  }
   return true;
 };
 

package/lib/tags/for.js

@@ -20,7 +20,7 @@
  * mapping's keys). An item that does not hold two values binds what it holds,
  * a missing value rendering empty, where Django raises. Two names over a
  * mapping bind the key and the value, a swig extension (Django iterates the
- * keys and unpacks each one) that the `.items` rewrite relies on.
+ * keys and unpacks each one) that a two-name `.items` loop relies on.
  *
  * Loop variable names must be bare identifiers — dotted paths are rejected
  * at parse time, and the CVE-2023-25345 `_dangerousProps` guard runs on
@@ -31,9 +31,11 @@
  * compile splits the content at it into the loop body and the empty body.
  *
  * Django's dict-iteration pseudo-methods are supported on the iterable —
- * `{% for k in d.keys %}`, `{% for v in d.values %}`, and the canonical
- * `{% for key, value in d.items %}` (see rewriteDictIterable). The one-name
- * `{% for pair in d.items %}` tuple form is rejected with a clear message.
+ * `{% for k in d.keys %}`, `{% for v in d.values %}`, the canonical
+ * `{% for key, value in d.items %}`, and the one-name
+ * `{% for pair in d.items %}`, which binds each [key, value] pair. As in
+ * Django, a mapping's own key of that name is read first (see
+ * rewriteDictIterable).
  *
  * The `reversed` modifier (`{% for x in items reversed %}`) is not yet
  * supported; it is detected and rejected with a clear message rather than
@@ -83,30 +85,31 @@ function resolveVar(path) {
  * `.keys` / `.values` / `.items` would otherwise resolve to a (usually
  * missing) object property, yielding an empty loop.
  *
- *   - `.keys`   → `_utils.keys(obj)` (a plain key array; a one-name `for`
- *                 binds each key).
- *   - `.values` → `_utils.values(obj)` (a plain value array; a one-name `for`
- *                 binds each value).
- *   - `.items`  → the object itself, walked with the two-name form, so swig
- *                 binds key + value per entry exactly as Django's two-name
- *                 `{% for k, v in d.items %}`. The one-name tuple form is
- *                 rejected (there is no `_utils.entries` to synthesize a
- *                 (key, value) tuple sequence flavor-locally).
+ * The iterable becomes the mapping (the path without its last segment), and
+ * `token.dictIter` records the name, which compile sets on the IRFor node.
+ * At render the backend passes the mapping to `_utils.dictIter`, which reads
+ * the mapping's own key of that name first, as Django's dictionary lookup
+ * does (so `{% for item in page.data.items %}` iterates the list stored under
+ * `items`), and otherwise applies the method:
+ *
+ *   - `.keys`   → the keys (a one-name `for` binds each key).
+ *   - `.values` → the values (a one-name `for` binds each value).
+ *   - `.items`  → the mapping itself, so two names bind key + value per entry
+ *                 exactly as Django's `{% for k, v in d.items %}`; with one
+ *                 name (`pairs`), each [key, value] pair, Django's
+ *                 (key, value) tuple, and nothing for a value that is not a
+ *                 mapping.
  *
  * Anything that is not a resolved user-variable path of length >= 2 ending in
- * one of the three names is returned unchanged. Documented divergence: the
- * interception is unconditional, so if `obj` has a literal key named
- * `keys` / `values` / `items`, the pseudo-method wins (Django's dict-key
- * precedence is not honored for those three names).
+ * one of the three names is returned unchanged.
  *
  * @param  {object}  it          Parsed iterable IRExpr.
  * @param  {boolean} hasTwoNames Whether the loop declared `key, val`.
- * @param  {number}  line        Source line, for error reporting.
- * @param  {string}  filename    Template filename, for error reporting.
+ * @param  {object}  token       In-progress TagToken; gets `dictIter`.
  * @return {object}              The (possibly rewritten) iterable IRExpr.
  * @private
  */
-function rewriteDictIterable(it, hasTwoNames, line, filename) {
+function rewriteDictIterable(it, hasTwoNames, token) {
   if (!it || it.type !== 'VarRef' || !it.resolve || it.path.length < 2) {
     return it;
   }
@@ -114,21 +117,11 @@ function rewriteDictIterable(it, hasTwoNames, line, filename) {
   if (!DICT_PSEUDO_METHODS.hasOwnProperty(lastSeg)) {
     return it;
   }
-  var objPath = it.path.slice(0, -1);
-  if (lastSeg === 'keys') {
-    // The synthetic `_utils.keys` callee is intentionally NOT resolve-flagged
-    // (emitFnCall reads a callee path directly, never through emitVarRef).
-    return ir.fnCall(ir.varRef(['_utils', 'keys']), [resolveVar(objPath)]);
-  }
-  if (lastSeg === 'values') {
-    return ir.fnCall(ir.varRef(['_utils', 'values']), [resolveVar(objPath)]);
-  }
+  token.dictIter = { name: lastSeg };
   if (lastSeg === 'items' && !hasTwoNames) {
-    utils.throwError('The "items" pseudo-method in a "for" tag requires two loop variables — use {% for key, value in ' + objPath.join('.') + '.items %}', line, filename);
+    token.dictIter.pairs = true;
   }
-  // `.items` walks the object directly: two names over a mapping bind the key
-  // and the value.
-  return resolveVar(objPath);
+  return resolveVar(it.path.slice(0, -1));
 }
 
 exports.ends = true;
@@ -214,7 +207,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
   }
 
   token.args = key !== undefined ? [key, val] : [val];
-  token.irExpr = rewriteDictIterable(parser.parseExpr(iterableTokens), key !== undefined, line, opts.filename);
+  token.irExpr = rewriteDictIterable(parser.parseExpr(iterableTokens), key !== undefined, token);
   return true;
 };
 
@@ -275,5 +268,9 @@ exports.compile = function (compiler, args, content, parents, options, blockName
   } else {
     node.mapKeys = true;
   }
+  // A dict pseudo-method on the iterable (see rewriteDictIterable).
+  if (token.dictIter) {
+    node.dictIter = token.dictIter;
+  }
   return node;
 };

package/lib/tags/include.js

@@ -112,7 +112,7 @@ function parsePairs(clause, parser, types, line, opts) {
     pos = j + 1;
     skipWS();
     var posOut = {};
-    var valExpr = parser.parseExpr(clause.slice(pos), {}, posOut);
+    var valExpr = parser.missingAsEmpty(parser.parseExpr(clause.slice(pos), {}, posOut));
     pos += posOut.pos;
     props.push(ir.objectProperty(ir.literal('string', nameTok.match), valExpr));
   }

package/lib/tags/with.js

@@ -89,7 +89,7 @@ function parsePairs(tokens, parser, types, line, opts) {
     pos = j + 1;
     skipWS();
     var posOut = {};
-    var valExpr = parser.parseExpr(tokens.slice(pos), {}, posOut);
+    var valExpr = parser.missingAsEmpty(parser.parseExpr(tokens.slice(pos), {}, posOut));
     pos += posOut.pos;
     props.push(ir.objectProperty(ir.literal('string', nameTok.match), valExpr));
   }
@@ -134,7 +134,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
       utils.throwError('Expected a single variable name after "as" in "with" tag', line, opts.filename);
     }
     guardName(nameTokens[0].match, line, opts);
-    props = [ir.objectProperty(ir.literal('string', nameTokens[0].match), parser.parseExpr(exprTokens))];
+    props = [ir.objectProperty(ir.literal('string', nameTokens[0].match), parser.missingAsEmpty(parser.parseExpr(exprTokens)))];
   } else {
     props = parsePairs(tokens, parser, types, line, opts);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-django",
-  "version": "2.9.7",
+  "version": "2.9.9",
   "description": "Django-syntax frontend for the @rhinostone/swig-core template engine. Part of the @rhinostone/swig multi-flavor family.",
   "keywords": [
     "template",
@@ -22,7 +22,7 @@
     "node": ">=12"
   },
   "peerDependencies": {
-    "@rhinostone/swig-core": "2.9.7"
+    "@rhinostone/swig-core": "2.9.9"
   },
   "publishConfig": {
     "access": "public"