@rhinostone/swig-twig 2.8.1 → 2.8.2

package/lib/index.js

@@ -19,6 +19,16 @@ var utils = require('@rhinostone/swig-core/lib/utils'),
 
 exports.name = 'twig';
 
+/**
+ * Package version number as a string. The packages of the family are
+ * released together, so they share one version.
+ * @example
+ * if (twig.version === "2.8.2") { ... }
+ *
+ * @type {String}
+ */
+exports.version = "2.8.2";
+
 /**
  * Expression-level parser — Pratt-style recursive descent that consumes
  * Twig lexer tokens and returns swig-core IRExpr nodes.
@@ -75,7 +85,7 @@ function validateOptions(options) {
     if (!options.hasOwnProperty(key)) {
       return;
     }
-    if (!utils.isArray(options[key]) || options[key].length !== 2) {
+    if (!utils.isArray(options[key]) || options[key].length !== 2 || typeof options[key][0] !== 'string' || typeof options[key][1] !== 'string') {
       throw new Error('Option "' + key + '" must be an array containing 2 different control strings.');
     }
     if (options[key][0] === options[key][1]) {
@@ -83,7 +93,7 @@ function validateOptions(options) {
     }
     utils.each(options[key], function (a, i) {
       if (a.length < 2) {
-        throw new Error('Option "' + key + '" ' + ((i) ? 'open ' : 'close ') + 'control must be at least 2 characters. Saw "' + a + '" instead.');
+        throw new Error('Option "' + key + '" ' + ((i) ? 'close ' : 'open ') + 'control must be at least 2 characters. Saw "' + a + '" instead.');
       }
     });
   });
@@ -151,7 +161,14 @@ exports.Twig = function (opts) {
     filters: _filters,
     validateOptions: validateOptions,
     onCompileError: function (err, options) {
-      utils.throwError(err, null, options.filename);
+      var filename = options && options.filename;
+      // An error with no file name to add, or one whose message already
+      // names the file (a tag's own throwError does), is rethrown
+      // unchanged instead of being wrapped a second time.
+      if (err instanceof Error && (!filename || err.message.indexOf(' in file ' + filename) !== -1)) {
+        throw err;
+      }
+      utils.throwError(err, null, filename);
     }
   });
 

package/lib/parser.js

@@ -85,12 +85,12 @@ exports.parseExpr = function (tokens, filters, _posOut) {
 
   function guardSegment(segment) {
     if (_dangerousProps.indexOf(segment) !== -1) {
-      bail('Unsafe access to "' + segment + '" is not allowed in templates (CVE-2023-25345)');
+      bail('Unsafe access to "' + segment + '" is not allowed in templates (prototype-chain guard)');
     }
   }
   function guardBracketString(value) {
     if (_dangerousProps.indexOf(value) !== -1) {
-      bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (CVE-2023-25345)');
+      bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (prototype-chain guard)');
     }
   }
 

package/lib/tags/apply.js

@@ -109,7 +109,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
 
   function checkName(name) {
     if (_dangerousProps.indexOf(name) !== -1) {
-      utils.throwError('Unsafe filter name "' + name + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe filter name "' + name + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   }
 

package/lib/tags/block.js

@@ -66,7 +66,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
     utils.throwError('Block name "' + nameTok.match + '" must be a bare identifier', line, opts.filename);
   }
   if (_dangerousProps.indexOf(nameTok.match) !== -1) {
-    utils.throwError('Unsafe block name "' + nameTok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+    utils.throwError('Unsafe block name "' + nameTok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
   }
 
   pos += 1;

package/lib/tags/for.js

@@ -76,7 +76,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
       utils.throwError('Loop variable "' + tok.match + '" must be a bare identifier in "for" tag', line, opts.filename);
     }
     if (_dangerousProps.indexOf(tok.match) !== -1) {
-      utils.throwError('Unsafe loop variable "' + tok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe loop variable "' + tok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
     return tok.match;
   }

package/lib/tags/from.js

@@ -88,7 +88,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
       utils.throwError(role + ' "' + name + '" must be a bare identifier in "from" tag', line, opts.filename);
     }
     if (_dangerousProps.indexOf(name) !== -1) {
-      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   }
 

package/lib/tags/import.js

@@ -106,7 +106,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
     utils.throwError('Import alias "' + aliasTok.match + '" must be a bare identifier in "import" tag', line, opts.filename);
   }
   if (_dangerousProps.indexOf(aliasTok.match) !== -1) {
-    utils.throwError('Unsafe import alias "' + aliasTok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+    utils.throwError('Unsafe import alias "' + aliasTok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
   }
 
   if (peek()) {

package/lib/tags/macro.js

@@ -76,7 +76,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
       utils.throwError(role + ' "' + name + '" must be a bare identifier in "macro" tag', line, opts.filename);
     }
     if (_dangerousProps.indexOf(name) !== -1) {
-      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   }
 

package/lib/tags/set.js

@@ -84,17 +84,18 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
   var path = lhsTok.match.split('.');
   utils.each(path, function (segment) {
     if (_dangerousProps.indexOf(segment) !== -1) {
-      utils.throwError('Unsafe assignment to "' + segment + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe assignment to "' + segment + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   });
 
-  // DOTKEY tail — the Twig lexer already folds dotted paths into the
-  // VAR match, but a defensive DOTKEY consumer here keeps this tag
-  // robust if a future lexer tightening splits `foo.bar` into VAR + DOTKEY.
+  // DOTKEY tail — the Twig lexer folds `foo.bar` into one VAR match, but a
+  // dot after whitespace (`foo .bar`) lexes as its own DOTKEY token, so this
+  // loop runs today; it also keeps the tag safe if a future lexer splits
+  // `foo.bar` into VAR + DOTKEY.
   while (peek() && peek().type === types.DOTKEY) {
     var dk = consume();
     if (_dangerousProps.indexOf(dk.match) !== -1) {
-      utils.throwError('Unsafe assignment to "' + dk.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe assignment to "' + dk.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
     path.push(dk.match);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-twig",
-  "version": "2.8.1",
+  "version": "2.8.2",
   "description": "Twig-syntax frontend for the @rhinostone/swig-core template engine. Part of the @rhinostone/swig multi-flavor family.",
   "keywords": [
     "template",
@@ -22,7 +22,7 @@
     "node": ">=12"
   },
   "peerDependencies": {
-    "@rhinostone/swig-core": "2.8.1"
+    "@rhinostone/swig-core": "2.8.2"
   },
   "publishConfig": {
     "access": "public"