@rhinostone/swig-jinja2 2.8.1 → 2.8.3

package/README.md

@@ -33,7 +33,7 @@ A near-subset of Python Jinja2 — everything below was cross-checked against Ji
 * **Operators** — `**` power, `//` floor-division, `~` string concat, inline-if (`a if c else b`), Python slicing (`seq[start:stop:step]`), `is <test>` / `is not <test>`, plus `{{- … -}}` / `{%- … -%}` whitespace control.
 * **Built-in `is` tests** — `defined`, `undefined`, `none`, `even`, `odd`, `divisibleby`, `iterable`, `mapping`, `sequence`, `string`, `number`, `boolean`, `callable`, `lower`, `upper`, `sameas`.
 * **Filters** — 39 built-ins (`upper`, `lower`, `capitalize`, `title`, `trim`, `truncate`, `replace`, `striptags`, `format`, `wordcount`, `wordwrap`, `indent`, `center`, `urlencode`, `escape` / `e`, `safe`, `first`, `last`, `join`, `reverse`, `sort`, `length` / `count`, `list`, `unique`, `batch`, `slice`, `dictsort`, `groupby`, `min`, `max`, `sum`, `random`, `abs`, `round`, `int`, `float`, `default` / `d`, `tojson`, `date`). See `lib/filters.js` for the full list.
-* **Async** — `renderFileAsync` / `compileFileAsync` for async loaders.
+* **Async** — `renderFile(path, locals, cb)` against a loader with `async === true`, or `compileFile` with `codegenMode: 'async'`; `renderFileAsync` / `compileFileAsync` still work but are deprecated.
 
 Explicitly unsupported (parse-time throw or absent)
 ---------------------------------------------------

package/lib/filters.js

@@ -177,7 +177,7 @@ exports.count = exports.length;
 
 /**
  * Return the first item of an array, the first character of a string, or
- * the first value of an object.
+ * the first key of a mapping (Jinja2 iterates a mapping's keys).
  *
  * @example
  * {{ ["a", "b", "c"]|first }}
@@ -188,8 +188,7 @@ exports.count = exports.length;
  */
 exports.first = function (input) {
   if (typeof input === 'object' && input !== null && !utils.isArray(input)) {
-    var keys = utils.keys(input);
-    return input[keys[0]];
+    return utils.keys(input)[0];
   }
   if (typeof input === 'string') {
     return input.substr(0, 1);
@@ -202,7 +201,7 @@ exports.first = function (input) {
 
 /**
  * Return the last item of an array, the last character of a string, or
- * the last value of an object.
+ * the last key of a mapping (Jinja2 iterates a mapping's keys).
  *
  * @example
  * {{ ["a", "b", "c"]|last }}
@@ -214,7 +213,7 @@ exports.first = function (input) {
 exports.last = function (input) {
   if (typeof input === 'object' && input !== null && !utils.isArray(input)) {
     var keys = utils.keys(input);
-    return input[keys[keys.length - 1]];
+    return keys[keys.length - 1];
   }
   if (typeof input === 'string') {
     return input.charAt(input.length - 1);
@@ -254,13 +253,13 @@ exports.join = function (input, glue) {
 
 /**
  * Reverse an array or string. Does not sort — items come out in reverse
- * input order.
+ * input order. A mapping gives its keys in reverse order.
  *
  * @example
  * {{ [1, 2, 3]|reverse|join(",") }}
  * // => 3,2,1
  *
- * @param  {array|string} input
+ * @param  {array|string|object} input
  * @return {array|string}
  */
 exports.reverse = function (input) {
@@ -270,14 +269,17 @@ exports.reverse = function (input) {
   if (typeof input === 'string') {
     return input.split('').reverse().join('');
   }
+  if (input && typeof input === 'object') {
+    return utils.keys(input).reverse();
+  }
   return input;
 };
 
 /**
  * Sort an array ascending, returning a copy (does not mutate the input).
  * Numbers sort numerically; everything else compares case-insensitively.
- * A string sorts its characters; an object sorts its keys. Pass a truthy
- * first argument to sort descending.
+ * A string gives its characters as a sorted list, as in Jinja2; a mapping
+ * gives its sorted keys. Pass a truthy first argument to sort descending.
  *
  * @example
  * {{ [3, 1, 2]|sort|join(",") }}
@@ -292,12 +294,11 @@ exports.reverse = function (input) {
  * @return {*}
  */
 exports.sort = function (input, reverse) {
-  var arr, isString = false;
+  var arr;
   if (utils.isArray(input)) {
     arr = utils.extend([], input);
   } else if (typeof input === 'string') {
     arr = input.split('');
-    isString = true;
   } else if (input && typeof input === 'object') {
     arr = utils.keys(input);
   } else {
@@ -309,9 +310,17 @@ exports.sort = function (input, reverse) {
     return sa < sb ? -1 : sa > sb ? 1 : 0;
   });
   if (reverse) { arr.reverse(); }
-  return isString ? arr.join('') : arr;
+  return arr;
 };
 
+/*!
+ * Split a string into code points, keeping a surrogate pair together as
+ * Python's `str` iteration does. @private
+ */
+function codePoints(s) {
+  return s.match(/[\uD800-\uDBFF][\uDC00-\uDFFF]|[\s\S]/g) || [];
+}
+
 /*!
  * Resolve a possibly-dotted attribute path against an object. Returns
  * undefined if any segment is missing. @private
@@ -645,7 +654,10 @@ exports.trim = function (input, chars) {
  * Replace occurrences of a literal substring with another. Unlike the
  * native swig `replace` (regex) and the Twig `replace` (mapping), Jinja2's
  * `replace` is a plain left-to-right literal substitution. An optional
- * count limits how many occurrences are replaced.
+ * count limits how many occurrences are replaced. As in Python, an empty
+ * search string inserts the replacement before each character and at the
+ * end, a negative count replaces every occurrence, and a number input is
+ * converted to a string first.
  *
  * @example
  * {{ "Hello World"|replace("Hello", "Goodbye") }}
@@ -662,20 +674,36 @@ exports.trim = function (input, chars) {
  * @return {*}
  */
 exports.replace = function (input, old, neu, count) {
-  var limited, max, out, i, n;
+  var max, out, chars, i, n;
+  if (typeof input === 'number') {
+    input = String(input);
+  }
   if (typeof input !== 'string') {
     return input;
   }
   old = String(old);
   neu = (neu === undefined || neu === null) ? '' : String(neu);
-  if (old === '') {
-    return input;
+  max = (count !== undefined && count !== null) ? Number(count) : Infinity;
+  if (max < 0) {
+    max = Infinity;
   }
-  limited = (count !== undefined && count !== null);
-  max = limited ? Number(count) : Infinity;
   out = '';
-  i = 0;
   n = 0;
+  if (old === '') {
+    chars = codePoints(input);
+    for (i = 0; i < chars.length; i += 1) {
+      if (n < max) {
+        out += neu;
+        n += 1;
+      }
+      out += chars[i];
+    }
+    if (n < max) {
+      out += neu;
+    }
+    return out;
+  }
+  i = 0;
   while (i < input.length) {
     if (n < max && input.substr(i, old.length) === old) {
       out += neu;
@@ -689,6 +717,35 @@ exports.replace = function (input, old, neu, count) {
   return out;
 };
 
+/*!
+ * Pad the exponent of a JavaScript exponential string to at least two
+ * digits, as Python's `%e` prints it (`1e+4` becomes `1e+04`). @private
+ */
+function padExponent(s) {
+  return s.replace(/e([+-])(\d)$/, function (m, sign, digit) {
+    return 'e' + sign + '0' + digit;
+  });
+}
+
+/*!
+ * Python's `%g` for a non-negative number: precision `prec` (0 counts as
+ * 1) significant digits, fixed notation when the decimal exponent X of
+ * the rounded value satisfies -4 <= X < precision and exponential
+ * notation otherwise, then trailing zeros and a bare point removed from
+ * the fractional part. @private
+ */
+function formatGeneral(num, prec) {
+  var p = (prec === 0) ? 1 : prec, digits = Math.min(p - 1, 100), exp, parts;
+  // toExponential and toFixed take at most 100 digits; for most numbers the
+  // digits past those are zeros, which are stripped below anyway.
+  exp = parseInt(num.toExponential(digits).split('e')[1], 10);
+  parts = ((exp >= -4 && exp < p) ? num.toFixed(Math.min(p - 1 - exp, 100)) : num.toExponential(digits)).split('e');
+  if (parts[0].indexOf('.') !== -1) {
+    parts[0] = parts[0].replace(/0+$/, '').replace(/\.$/, '');
+  }
+  return (parts.length > 1) ? padExponent(parts[0] + 'e' + parts[1]) : parts[0];
+}
+
 /*!
  * printf-style format expansion backing the `format` filter. Supports the
  * common conversions (s d i u f F e E g G x X o c %) with optional flags
@@ -738,14 +795,14 @@ function sprintf(fmt, args) {
     case 'E':
       num = parseFloat(arg);
       if (isNaN(num)) { num = 0; }
-      s = withSign(num).toExponential(hasPrec ? prec : 6);
+      s = padExponent(withSign(num).toExponential(hasPrec ? prec : 6));
       if (conv === 'E') { s = s.toUpperCase(); }
       break;
     case 'g':
     case 'G':
       num = parseFloat(arg);
       if (isNaN(num)) { num = 0; }
-      s = String(withSign(num));
+      s = formatGeneral(withSign(num), hasPrec ? prec : 6);
       if (conv === 'G') { s = s.toUpperCase(); }
       break;
     case 'x':
@@ -825,7 +882,9 @@ exports.wordcount = function (input) {
  * Word-wrap a string to a given line width (Jinja2's `wordwrap`). Words are
  * packed greedily; a word longer than the width is split when
  * `breakLongWords` is truthy (the default). Lines are joined with
- * `wrapstring` (default newline).
+ * `wrapstring` (default newline). A width of 0 or less returns the input
+ * unchanged (Jinja2 raises), and a width between 0 and 1 breaks one
+ * character at a time, as Python's textwrap does.
  *
  * @example
  * {{ "the quick brown fox"|wordwrap(10) }}
@@ -843,6 +902,12 @@ exports.wordwrap = function (input, width, breakLongWords, wrapstring) {
     return input;
   }
   if (width === undefined || width === null) { width = 79; }
+  if (width <= 0) {
+    return input;
+  }
+  if (width < 1) {
+    width = 1;
+  }
   if (breakLongWords === undefined) { breakLongWords = true; }
   if (wrapstring === undefined || wrapstring === null) { wrapstring = '\n'; }
   words = input.split(/\s+/);
@@ -854,7 +919,9 @@ exports.wordwrap = function (input, width, breakLongWords, wrapstring) {
     while (breakLongWords && word.length > width) {
       space = (cur === '') ? width : width - cur.length - 1;
       if (space <= 0) {
-        lines.push(cur);
+        // Python's textwrap keeps the separating space when the line is
+        // exactly full.
+        lines.push(space === 0 ? cur + ' ' : cur);
         cur = '';
         space = width;
       }
@@ -974,7 +1041,8 @@ exports.list = function (input) {
 /**
  * Return the unique items of a sequence, preserving first-seen order
  * (Jinja2's `unique`). String comparison is case-insensitive by default;
- * pass a truthy `caseSensitive` to compare exactly.
+ * pass a truthy `caseSensitive` to compare exactly. A mapping gives its
+ * unique keys.
  *
  * @example
  * {{ [1, 2, 2, 3, 1]|unique|join(",") }}
@@ -988,6 +1056,8 @@ exports.unique = function (input, caseSensitive) {
   var seen = [], out = [];
   if (typeof input === 'string') {
     input = input.split('');
+  } else if (input && typeof input === 'object' && !utils.isArray(input)) {
+    input = utils.keys(input);
   } else if (!utils.isArray(input)) {
     return input;
   }
@@ -1002,9 +1072,13 @@ exports.unique = function (input, caseSensitive) {
 };
 
 /**
- * Batch items into rows of `size` (Jinja2's `batch`). The last row holds
+ * Batch items into rows of `size` (Jinja2's `batch`). A new row starts
+ * when the current one holds exactly `size` items, so the last row holds
  * the remainder; an optional `fill` pads the last row up to `size`. A
- * mapping batches its values.
+ * string batches its characters and a mapping its keys; any other input
+ * that is not a list gives an empty list. As in Jinja2, a size of 0 gives
+ * an empty first row, and a size that no row length can equal (negative,
+ * fractional or not a number) gives a single row.
  *
  * @example
  * {% for row in [1,2,3,4,5]|batch(2) %}[{{ row|join(",") }}]{% endfor %}
@@ -1016,31 +1090,32 @@ exports.unique = function (input, caseSensitive) {
  * @return {Array}
  */
 exports.batch = function (input, size, fill) {
-  var items, n, out, i, last;
+  var items, out = [], tmp = [], i;
   if (utils.isArray(input)) {
     items = input;
+  } else if (typeof input === 'string') {
+    items = codePoints(input);
   } else if (input && typeof input === 'object') {
-    items = [];
-    utils.each(input, function (v) { items.push(v); });
+    items = utils.keys(input);
   } else {
     return [];
   }
-  n = Number(size);
-  if (!isFinite(n) || n <= 0) {
-    return [];
-  }
-  n = Math.ceil(n);
-  out = [];
-  i = 0;
-  while (i < items.length) {
-    out.push(items.slice(i, i + n));
-    i += n;
-  }
-  if (fill !== undefined && out.length > 0) {
-    last = out[out.length - 1];
-    while (last.length < n) {
-      last.push(fill);
+  for (i = 0; i < items.length; i += 1) {
+    if (tmp.length === size) {
+      out.push(tmp);
+      tmp = [];
     }
+    tmp.push(items[i]);
+  }
+  if (tmp.length) {
+    // Pad only up to a finite numeric size, since a non-finite one would
+    // never end the loop (Jinja2 raises unless the size is an integer).
+    if (fill !== undefined && typeof size === 'number' && isFinite(size)) {
+      while (tmp.length < size) {
+        tmp.push(fill);
+      }
+    }
+    out.push(tmp);
   }
   return out;
 };
@@ -1049,7 +1124,8 @@ exports.batch = function (input, size, fill) {
  * Distribute items across `slices` columns (Jinja2's `slice` filter — the
  * inverse of `batch`, and distinct from the `seq[start:stop:step]`
  * subscript). The first columns receive the extra items when the count
- * does not divide evenly; an optional `fill` pads the shorter columns.
+ * does not divide evenly; an optional `fill` pads the shorter columns. A
+ * string distributes its characters and a mapping its keys.
  *
  * @example
  * {% for col in [1,2,3,4,5,6,7,8,9,10]|slice(3) %}[{{ col|join(",") }}]{% endfor %}
@@ -1067,8 +1143,7 @@ exports.slice = function (input, slices, fill) {
   } else if (typeof input === 'string') {
     seq = input.split('');
   } else if (input && typeof input === 'object') {
-    seq = [];
-    utils.each(input, function (v) { seq.push(v); });
+    seq = utils.keys(input);
   } else {
     return [];
   }
@@ -1186,13 +1261,11 @@ exports.sum = function (input, attribute, start) {
  * numerically. @private
  */
 function minmax(input, caseSensitive, want) {
-  var best, found = false, vals;
+  var best, found = false;
   if (typeof input === 'string') {
     input = input.split('');
   } else if (input && typeof input === 'object' && !utils.isArray(input)) {
-    vals = [];
-    utils.each(input, function (v) { vals.push(v); });
-    input = vals;
+    input = utils.keys(input);
   } else if (!utils.isArray(input)) {
     return input;
   }
@@ -1219,7 +1292,8 @@ function minmax(input, caseSensitive, want) {
 
 /**
  * Return the smallest item of a sequence (Jinja2's `min`). String
- * comparison is case-insensitive unless `caseSensitive` is truthy.
+ * comparison is case-insensitive unless `caseSensitive` is truthy. A
+ * mapping compares its keys.
  *
  * @example
  * {{ [3, 1, 2]|min }}
@@ -1235,7 +1309,8 @@ exports.min = function (input, caseSensitive) {
 
 /**
  * Return the largest item of a sequence (Jinja2's `max`). String
- * comparison is case-insensitive unless `caseSensitive` is truthy.
+ * comparison is case-insensitive unless `caseSensitive` is truthy. A
+ * mapping compares its keys.
  *
  * @example
  * {{ [3, 1, 2]|max }}

package/lib/index.js

@@ -19,6 +19,16 @@ var utils = require('@rhinostone/swig-core/lib/utils'),
 
 exports.name = 'jinja2';
 
+/**
+ * Package version number as a string. The packages of the family are
+ * released together, so they share one version.
+ * @example
+ * if (jinja2.version === "2.8.2") { ... }
+ *
+ * @type {String}
+ */
+exports.version = "2.8.3";
+
 /**
  * Expression-level parser — Pratt-style recursive descent that consumes
  * Jinja2 lexer tokens and returns swig-core IRExpr nodes, plus the
@@ -76,7 +86,7 @@ function validateOptions(options) {
     if (!options.hasOwnProperty(key)) {
       return;
     }
-    if (!utils.isArray(options[key]) || options[key].length !== 2) {
+    if (!utils.isArray(options[key]) || options[key].length !== 2 || typeof options[key][0] !== 'string' || typeof options[key][1] !== 'string') {
       throw new Error('Option "' + key + '" must be an array containing 2 different control strings.');
     }
     if (options[key][0] === options[key][1]) {
@@ -84,7 +94,7 @@ function validateOptions(options) {
     }
     utils.each(options[key], function (a, i) {
       if (a.length < 2) {
-        throw new Error('Option "' + key + '" ' + ((i) ? 'open ' : 'close ') + 'control must be at least 2 characters. Saw "' + a + '" instead.');
+        throw new Error('Option "' + key + '" ' + ((i) ? 'close ' : 'open ') + 'control must be at least 2 characters. Saw "' + a + '" instead.');
       }
     });
   });
@@ -152,7 +162,14 @@ exports.Jinja2 = function (opts) {
     filters: _filters,
     validateOptions: validateOptions,
     onCompileError: function (err, options) {
-      utils.throwError(err, null, options.filename);
+      var filename = options && options.filename;
+      // An error with no file name to add, or one whose message already
+      // names the file (a tag's own throwError does), is rethrown
+      // unchanged instead of being wrapped a second time.
+      if (err instanceof Error && (!filename || err.message.indexOf(' in file ' + filename) !== -1)) {
+        throw err;
+      }
+      utils.throwError(err, null, filename);
     }
   });
 

package/lib/parser.js

@@ -34,24 +34,31 @@ var _reserved = ['break', 'case', 'catch', 'continue', 'debugger', 'default', 'd
  * FUNCTION/FUNCTIONEMPTY callee names — same checkpoints as the native
  * frontend.
  *
- * Binding-power table (shared subset; higher binds tighter):
+ * Binding levels, loosest first, following Jinja2's parser (parse_condexpr,
+ * parse_or, parse_and, parse_not, parse_compare ... parse_pow,
+ * parse_unary, parse_postfix, parse_filter_expr):
  *
- *   Level | Tokens                             | Assoc
- *   ------+------------------------------------+------
- *     1   | || / or  (LOGIC)                   | left
- *     2   | && / and (LOGIC)                   | left
- *     3   | == != === !== (COMPARATOR)          | left
- *     4   | < > <= >= in  (COMPARATOR)          | left
- *     6   | + - (OPERATOR)                     | left
- *     8   | * / % (OPERATOR)                   | left
- *   post  | DOTKEY BRACKETOPEN PARENOPEN        | —
- *          | FILTER FILTEREMPTY                 |
- *   pfx   | NOT, unary +/-                     | —
+ *   Level  | Tokens                                   | Assoc
+ *   -------+------------------------------------------+--------
+ *     0    | inline `a if c else b`                   | right
+ *     1    | || / or  (LOGIC)                         | left
+ *     2    | && / and (LOGIC)                         | left
+ *    not   | NOT starting an operand of the levels    | prefix
+ *          | above; its operand runs at level 3       |
+ *     3    | == != === !== (COMPARATOR)               | left
+ *     4    | < > <= >= in  (COMPARATOR)               | left
+ *     6    | + - (OPERATOR)                           | left
+ *     7    | ~ (TILDE)                                | left
+ *     8    | * / % (OPERATOR), // (FLOORDIV)          | left
+ *    pow   | ** (POWER), over unary operands          | left
+ *   filter | FILTER FILTEREMPTY, IS ISNOT tests       | postfix
+ *   unary  | unary + / -                              | prefix
+ *   post   | DOTKEY BRACKETOPEN PARENOPEN             | postfix
  *
- * The Jinja2-only operators (`~` concat, `**` power, `//` floor-division,
- * inline `if`/`else`, `is` / `is not` tests) are added in subsequent
- * commits; their precedence slots into the gaps left here (`~` at 7,
- * `**` above `*`, `//` alongside `*`, inline-if at the loosest level).
+ * So `not a == b` is not (a == b), `1 + 2 is number` tests 2, `-x|abs` is
+ * abs(-x) and `2 ** 3 ** 2` is (2 ** 3) ** 2. A NOT in any other operand
+ * position (`a == not b`) binds its unary operand; Jinja2 rejects that
+ * form.
  *
  * @param  {object[]} tokens     LexerToken[] from swig-jinja2's lexer.
  * @param  {object}   [filters]  Filter catalog for name validation.
@@ -83,12 +90,12 @@ exports.parseExpr = function (tokens, filters, _posOut) {
 
   function guardSegment(segment) {
     if (_dangerousProps.indexOf(segment) !== -1) {
-      bail('Unsafe access to "' + segment + '" is not allowed in templates (CVE-2023-25345)');
+      bail('Unsafe access to "' + segment + '" is not allowed in templates (prototype-chain guard)');
     }
   }
   function guardBracketString(value) {
     if (_dangerousProps.indexOf(value) !== -1) {
-      bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (CVE-2023-25345)');
+      bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (prototype-chain guard)');
     }
   }
 
@@ -105,12 +112,6 @@ exports.parseExpr = function (tokens, filters, _posOut) {
       }
       return { op: m, prec: 4 };
     }
-    if (tok.type === _t.IS) {
-      return { op: 'is', prec: 3 };
-    }
-    if (tok.type === _t.ISNOT) {
-      return { op: 'is not', prec: 3 };
-    }
     if (tok.type === _t.OPERATOR) {
       m = tok.match;
       if (m === '+' || m === '-') { return { op: m, prec: 6 }; }
@@ -182,7 +183,7 @@ exports.parseExpr = function (tokens, filters, _posOut) {
   }
 
   function parseTest() {
-    var nameTok = consume();
+    var nameTok = consume(), pk;
     if (!nameTok) { bail('Expected test name after "is" / "is not"'); }
     var testName;
     var testArgs = [];
@@ -191,6 +192,13 @@ exports.parseExpr = function (tokens, filters, _posOut) {
         bail('Dotted names are not valid test names');
       }
       testName = nameTok.match;
+      pk = peek();
+      if (pk && pk.type === _t.PARENOPEN) {
+        consume();
+        testArgs = parseArgList(_t.PARENCLOSE);
+      } else if (pk && isBareTestArgStart(pk)) {
+        testArgs = [parsePostfix(parsePrimary())];
+      }
     } else if (nameTok.type === _t.FUNCTIONEMPTY) {
       testName = nameTok.match;
     } else if (nameTok.type === _t.FUNCTION) {
@@ -206,6 +214,40 @@ exports.parseExpr = function (tokens, filters, _posOut) {
     return { name: testName, args: testArgs };
   }
 
+  // Jinja2's parse_test takes one argument without parentheses when the
+  // next token starts a primary (`x is divisibleby 3`, `x is sameas y`);
+  // the argument is a primary with its subscripts and calls, no filter or
+  // test. `else` ends an inline-if, and `if` is excluded too, so
+  // `x is defined if c else d` keeps parsing as an inline-if (Jinja2
+  // rejects it).
+  function isBareTestArgStart(tok) {
+    if (tok.type === _t.VAR) {
+      return tok.match !== 'if' && tok.match !== 'else';
+    }
+    return tok.type === _t.STRING || tok.type === _t.NUMBER || tok.type === _t.BOOL ||
+      tok.type === _t.FUNCTION || tok.type === _t.FUNCTIONEMPTY ||
+      tok.type === _t.BRACKETOPEN || tok.type === _t.CURLYOPEN;
+  }
+
+  // Lower `<subject> is [not] <test>` to `_ext._test_<name>(subject,
+  // ...args)`; `is not` wraps the call in a unary `!`. `defined` / `none` /
+  // `undefined` on a VarRef subject route through IRVarRefExists instead,
+  // because emitVarRef coerces a missing or null lookup to "" and so loses
+  // the defined/undefined signal those tests depend on. Other subjects
+  // evaluate to a concrete value (no coercion) and use the generic helper
+  // the engine registers.
+  function lowerTest(subject, negated) {
+    var test = parseTest(), testCall;
+    if (test.args.length === 0 && subject.type === 'VarRef' && test.name === 'defined') {
+      testCall = ir.varRefExists(subject.path, subject.loc);
+    } else if (test.args.length === 0 && subject.type === 'VarRef' && (test.name === 'none' || test.name === 'undefined')) {
+      testCall = ir.unaryOp('!', ir.varRefExists(subject.path, subject.loc));
+    } else {
+      testCall = ir.fnCall(ir.varRef(['_ext', '_test_' + test.name]), [subject].concat(test.args));
+    }
+    return negated ? ir.unaryOp('!', testCall) : testCall;
+  }
+
   function expectBracketClose() {
     var close = consume();
     if (!close || close.type !== _t.BRACKETCLOSE) {
@@ -268,7 +310,11 @@ exports.parseExpr = function (tokens, filters, _posOut) {
     ]);
   }
 
-  function parsePostfix(expr) {
+  // Subscripts and calls, then (when `withFilter`) filters and tests, as in
+  // Jinja2's parse_postfix and parse_filter_expr. A unary minus/plus
+  // operand is read without them (Jinja2's parse_unary(False)); they then
+  // apply to the negated value.
+  function parsePostfix(expr, withFilter) {
     while (true) {
       var tok = peek();
       if (!tok) { break; }
@@ -286,7 +332,10 @@ exports.parseExpr = function (tokens, filters, _posOut) {
       } else if (tok.type === _t.PARENOPEN) {
         consume();
         expr = ir.fnCall(expr, parseArgList(_t.PARENCLOSE));
-      } else if (tok.type === _t.FILTER || tok.type === _t.FILTEREMPTY) {
+      } else if (withFilter && (tok.type === _t.IS || tok.type === _t.ISNOT)) {
+        consume();
+        expr = lowerTest(expr, tok.type === _t.ISNOT);
+      } else if (withFilter && (tok.type === _t.FILTER || tok.type === _t.FILTEREMPTY)) {
         consume();
         var fname = tok.match;
         if (filters.hasOwnProperty(fname) && typeof filters[fname] !== 'function') {
@@ -317,22 +366,22 @@ exports.parseExpr = function (tokens, filters, _posOut) {
     var m;
     switch (tok.type) {
     case _t.STRING:
-      return parsePostfix(ir.literal('string', unquoteString(tok.match)));
+      return ir.literal('string', unquoteString(tok.match));
     case _t.NUMBER:
-      return parsePostfix(ir.literal('number', parseFloat(tok.match)));
+      return ir.literal('number', parseFloat(tok.match));
     case _t.BOOL:
-      return parsePostfix(ir.literal('bool', tok.match === 'true'));
+      return ir.literal('bool', tok.match === 'true');
     case _t.PARENOPEN:
       var grouped = parseExpression(0);
       var close = consume();
       if (!close || close.type !== _t.PARENCLOSE) {
         bail('Mismatched nesting state');
       }
-      return parsePostfix(grouped);
+      return grouped;
     case _t.BRACKETOPEN:
-      return parsePostfix(ir.arrayLiteral(parseArgList(_t.BRACKETCLOSE)));
+      return ir.arrayLiteral(parseArgList(_t.BRACKETCLOSE));
     case _t.CURLYOPEN:
-      return parsePostfix(parseObjectLiteral());
+      return parseObjectLiteral();
     case _t.VAR:
       var path = tok.match.split('.');
       if (_reserved.indexOf(path[0]) !== -1) {
@@ -341,7 +390,7 @@ exports.parseExpr = function (tokens, filters, _posOut) {
       utils.each(path, function (segment) {
         guardSegment(segment);
       });
-      return parsePostfix(ir.varRef(path));
+      return ir.varRef(path);
     case _t.FUNCTION:
     case _t.FUNCTIONEMPTY:
       m = tok.match;
@@ -350,75 +399,69 @@ exports.parseExpr = function (tokens, filters, _posOut) {
       }
       guardSegment(m);
       if (tok.type === _t.FUNCTIONEMPTY) {
-        return parsePostfix(ir.fnCall(ir.varRef([m]), []));
+        return ir.fnCall(ir.varRef([m]), []);
       }
-      return parsePostfix(ir.fnCall(ir.varRef([m]), parseArgList(_t.PARENCLOSE)));
+      return ir.fnCall(ir.varRef([m]), parseArgList(_t.PARENCLOSE));
     }
     bail('Unexpected token "' + tok.match + '"');
     return null;
   }
 
-  function parseUnary() {
-    var tok = peek();
+  // Jinja2 parse_unary: a unary minus/plus takes its operand without the
+  // filters that follow, which then apply to the negated value (`-x|abs`
+  // is abs(-x)). A `not` reached here sits where Jinja2 has no not-level
+  // (`a == not b`, `-not x`, `2 ** not x`); it binds its unary operand.
+  function parseUnary(withFilter) {
+    var tok = peek(), node;
     if (tok && tok.type === _t.NOT) {
       consume();
-      return ir.unaryOp('!', parseUnary());
+      return ir.unaryOp('!', parseUnary(withFilter));
     }
     if (tok && tok.type === _t.OPERATOR && (tok.match === '+' || tok.match === '-')) {
       consume();
-      return ir.unaryOp(tok.match, parseUnary());
+      node = ir.unaryOp(tok.match, parseUnary(false));
+    } else {
+      node = parsePrimary();
     }
-    return parsePower();
+    return parsePostfix(node, withFilter);
   }
 
   function parsePower() {
-    var left = parsePrimary();
+    var left = parseUnary(true);
     var next = peek();
-    if (next && next.type === _t.POWER) {
+    while (next && next.type === _t.POWER) {
       consume();
-      // Right-associative (2 ** 3 ** 2 === 2 ** (3 ** 2)); the exponent is a
-      // full unary so `2 ** -3` parses. Lowered to Math.pow because the emit
-      // is parenthesis-safe — a bare `a ** b` emission would mis-group when an
-      // operand is itself a binary op and would SyntaxError when the base is a
-      // unary (`-2 ** 3`). The base is a parsePrimary (not parseUnary), so a
-      // leading minus stays with the caller: `-2 ** 2` groups as `-(2 ** 2)`,
-      // matching Jinja2/Python.
-      var right = parseUnary();
-      return ir.fnCall(ir.varRef(['Math', 'pow']), [left, right]);
+      // Left-associative, as Jinja2's parse_pow reads its unary operands in
+      // a loop: `2 ** 3 ** 2` is (2 ** 3) ** 2 = 64 (Python gives 512). The
+      // base is a unary operand, so a leading minus belongs to it: `-2 ** 2`
+      // is (-2) ** 2 = 4, as Jinja2 renders (Python gives -4). Lowered to
+      // Math.pow because the emit is parenthesis-safe — a bare `a ** b`
+      // emission would mis-group when an operand is itself a binary op and
+      // would SyntaxError when the base is a unary (`-2 ** 3`).
+      left = ir.fnCall(ir.varRef(['Math', 'pow']), [left, parseUnary(true)]);
+      next = peek();
     }
     return left;
   }
 
+  // Jinja2's parse_not: a `not` that starts an operand of `and`, `or` or
+  // the whole expression (minPrec up to the comparison level) negates a
+  // level-3 expression, so `not a == b` is not (a == b) and `not x + y` is
+  // not (x + y).
   function parseExpression(minPrec) {
-    var left = parseUnary();
+    var left, ntok = peek();
+    if (ntok && ntok.type === _t.NOT && minPrec <= 3) {
+      consume();
+      left = ir.unaryOp('!', parseExpression(3));
+    } else {
+      left = parsePower();
+    }
     while (true) {
       var tok = peek();
       if (!tok) { break; }
       var info = getBinaryOpInfo(tok);
       if (!info || info.prec < minPrec) { break; }
       consume();
-      // `is` / `is not` — the RHS is a constrained test name + optional arg
-      // list, not a full expression. Lower to `_ext._test_<name>(subject,
-      // ...args)`; `is not` wraps the call in a unary `!`. `defined` /
-      // `none` / `undefined` on a VarRef subject route through
-      // IRVarRefExists instead, because emitVarRef coerces a missing or
-      // null lookup to "" and so loses the defined/undefined signal those
-      // tests depend on. Non-VarRef subjects evaluate to a concrete value
-      // (no coercion) and fall through to the generic `_ext._test_<name>`
-      // helper registered by the engine.
-      if (info.op === 'is' || info.op === 'is not') {
-        var test = parseTest();
-        var testCall;
-        if (test.args.length === 0 && left.type === 'VarRef' && test.name === 'defined') {
-          testCall = ir.varRefExists(left.path, left.loc);
-        } else if (test.args.length === 0 && left.type === 'VarRef' && (test.name === 'none' || test.name === 'undefined')) {
-          testCall = ir.unaryOp('!', ir.varRefExists(left.path, left.loc));
-        } else {
-          testCall = ir.fnCall(ir.varRef(['_ext', '_test_' + test.name]), [left].concat(test.args));
-        }
-        left = info.op === 'is not' ? ir.unaryOp('!', testCall) : testCall;
-        continue;
-      }
       var right = parseExpression(info.prec + 1);
       if (info.op === '//') {
         // Floor division — JS `a // b` is a line comment, so lower to

package/lib/tags/block.js

@@ -56,7 +56,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
     utils.throwError('Block name "' + nameTok.match + '" must be a bare identifier', line, opts.filename);
   }
   if (_dangerousProps.indexOf(nameTok.match) !== -1) {
-    utils.throwError('Unsafe block name "' + nameTok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+    utils.throwError('Unsafe block name "' + nameTok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
   }
 
   pos += 1;

package/lib/tags/filter.js

@@ -108,7 +108,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
 
   function checkName(name) {
     if (_dangerousProps.indexOf(name) !== -1) {
-      utils.throwError('Unsafe filter name "' + name + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe filter name "' + name + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   }
 

package/lib/tags/for.js

@@ -74,7 +74,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
       utils.throwError('Loop variable "' + tok.match + '" must be a bare identifier in "for" tag', line, opts.filename);
     }
     if (_dangerousProps.indexOf(tok.match) !== -1) {
-      utils.throwError('Unsafe loop variable "' + tok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe loop variable "' + tok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
     return tok.match;
   }

package/lib/tags/from.js

@@ -91,7 +91,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
       utils.throwError(role + ' "' + name + '" must be a bare identifier in "from" tag', line, opts.filename);
     }
     if (_dangerousProps.indexOf(name) !== -1) {
-      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   }
 

package/lib/tags/import.js

@@ -106,7 +106,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
     utils.throwError('Import alias "' + aliasTok.match + '" must be a bare identifier in "import" tag', line, opts.filename);
   }
   if (_dangerousProps.indexOf(aliasTok.match) !== -1) {
-    utils.throwError('Unsafe import alias "' + aliasTok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+    utils.throwError('Unsafe import alias "' + aliasTok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
   }
 
   if (peek()) {

package/lib/tags/include.js

@@ -122,7 +122,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
   }
   var pathExpr = parser.parseExpr(pathTokens);
 
-  var resolveFrom = (opts.filename || '').replace(/\\/g, '\\\\');
+  var resolveFrom = (opts.filename || '');
 
   // `without context` -> empty-object context + isolated, so the backend's
   // Include selector emits `{}` rather than `_ctx`. `with context` (and the

package/lib/tags/macro.js

@@ -80,7 +80,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
       utils.throwError(role + ' "' + name + '" must be a bare identifier in "macro" tag', line, opts.filename);
     }
     if (_dangerousProps.indexOf(name) !== -1) {
-      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   }
 

package/lib/tags/set.js

@@ -81,17 +81,18 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
   var path = lhsTok.match.split('.');
   utils.each(path, function (segment) {
     if (_dangerousProps.indexOf(segment) !== -1) {
-      utils.throwError('Unsafe assignment to "' + segment + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe assignment to "' + segment + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   });
 
-  // DOTKEY tail — the Jinja2 lexer already folds dotted paths into the VAR
-  // match, but a defensive DOTKEY consumer here keeps this tag robust if a
-  // future lexer tightening splits `foo.bar` into VAR + DOTKEY.
+  // DOTKEY tail — the Jinja2 lexer folds `foo.bar` into one VAR match, but a
+  // dot after whitespace (`foo .bar`) lexes as its own DOTKEY token, so this
+  // loop runs today; it also keeps the tag safe if a future lexer splits
+  // `foo.bar` into VAR + DOTKEY.
   while (peek() && peek().type === types.DOTKEY) {
     var dk = consume();
     if (_dangerousProps.indexOf(dk.match) !== -1) {
-      utils.throwError('Unsafe assignment to "' + dk.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe assignment to "' + dk.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
     path.push(dk.match);
   }

package/lib/tags/with.js

@@ -77,7 +77,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
         utils.throwError('"with" assignment target "' + nameTok.match + '" must be a bare identifier', line, opts.filename);
       }
       if (_dangerousProps.indexOf(nameTok.match) !== -1) {
-        utils.throwError('Unsafe "with" assignment to "' + nameTok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+        utils.throwError('Unsafe "with" assignment to "' + nameTok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
       }
 
       var eqTok = consume();

package/lib/tests/index.js

@@ -33,7 +33,9 @@ function isArr(v) {
 }
 
 /*!
- * Finite-number guard shared by the numeric tests. @private
+ * Number guard shared by `even`, `odd` and `divisibleby`: any number but
+ * NaN. An infinity passes and then fails each test's remainder check.
+ * @private
  */
 function isNumber(v) {
   return typeof v === 'number' && !isNaN(v);
@@ -83,13 +85,14 @@ exports['boolean'] = function (v) {
 };
 
 /**
- * `foo is number` — true for a finite number.
+ * `foo is number` — true for any JavaScript number, NaN and the
+ * infinities included, as Python's `numbers.Number` test.
  *
  * @param  {*} v
  * @return {boolean}
  */
 exports['number'] = function (v) {
-  return isNumber(v);
+  return typeof v === 'number';
 };
 
 /**
@@ -158,26 +161,53 @@ exports['sameas'] = function (v, other) {
   return v === other;
 };
 
-/**
- * `foo is lower` — true when the subject is a string equal to its own
- * lowercase form.
+/*!
+ * Unicode case properties for `lower` / `upper`, as Python's
+ * `str.islower` / `str.isupper` read them: a string needs at least one
+ * cased letter, and none of the other case (a titlecase letter counts
+ * against both). Built in a try/catch because an engine without Unicode
+ * property escapes (ES2018) throws on them; it keeps the case-mapping
+ * fallback below. @private
+ */
+var caseProps = (function () {
+  try {
+    return {
+      lower: new RegExp('\\p{Lowercase}', 'u'),
+      upper: new RegExp('\\p{Uppercase}', 'u'),
+      notLower: new RegExp('[\\p{Uppercase}\\p{Lt}]', 'u'),
+      notUpper: new RegExp('[\\p{Lowercase}\\p{Lt}]', 'u')
+    };
+  } catch (e) {
+    return null;
+  }
+}());
+
+/**
+ * `foo is lower` — true when the subject is a string with at least one
+ * cased letter and no uppercase or titlecase letter, as Python's
+ * `str.islower`: `''`, `'123'` and `'-'` are neither lower nor upper.
  *
  * @param  {*} v
  * @return {boolean}
  */
 exports['lower'] = function (v) {
-  return typeof v === 'string' && v === v.toLowerCase();
+  if (typeof v !== 'string') { return false; }
+  if (caseProps) { return !caseProps.notLower.test(v) && caseProps.lower.test(v); }
+  return v === v.toLowerCase() && v !== v.toUpperCase();
 };
 
 /**
- * `foo is upper` — true when the subject is a string equal to its own
- * uppercase form.
+ * `foo is upper` — true when the subject is a string with at least one
+ * cased letter and no lowercase or titlecase letter, as Python's
+ * `str.isupper`.
  *
  * @param  {*} v
  * @return {boolean}
  */
 exports['upper'] = function (v) {
-  return typeof v === 'string' && v === v.toUpperCase();
+  if (typeof v !== 'string') { return false; }
+  if (caseProps) { return !caseProps.notUpper.test(v) && caseProps.upper.test(v); }
+  return v === v.toUpperCase() && v !== v.toLowerCase();
 };
 
 /**
@@ -191,13 +221,14 @@ exports['even'] = function (v) {
 };
 
 /**
- * `n is odd` — true for numbers whose remainder mod 2 is non-zero.
+ * `n is odd` — true for an odd integer, as Python's `n % 2 == 1`: a
+ * negative odd integer is odd; a non-integer or an infinity is not.
  *
  * @param  {number} v
  * @return {boolean}
  */
 exports['odd'] = function (v) {
-  return isNumber(v) && v % 2 !== 0;
+  return isNumber(v) && ((v % 2) + 2) % 2 === 1;
 };
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-jinja2",
-  "version": "2.8.1",
+  "version": "2.8.3",
   "description": "Jinja2-syntax frontend for the @rhinostone/swig-core template engine. Part of the @rhinostone/swig multi-flavor family.",
   "keywords": [
     "template",
@@ -23,7 +23,7 @@
     "node": ">=12"
   },
   "peerDependencies": {
-    "@rhinostone/swig-core": "2.8.1"
+    "@rhinostone/swig-core": "2.8.3"
   },
   "publishConfig": {
     "access": "public"