@rhinostone/swig-twig 2.8.1 → 2.8.3

package/lib/index.js

@@ -19,6 +19,16 @@ var utils = require('@rhinostone/swig-core/lib/utils'),
 
 exports.name = 'twig';
 
+/**
+ * Package version number as a string. The packages of the family are
+ * released together, so they share one version.
+ * @example
+ * if (twig.version === "2.8.2") { ... }
+ *
+ * @type {String}
+ */
+exports.version = "2.8.3";
+
 /**
  * Expression-level parser — Pratt-style recursive descent that consumes
  * Twig lexer tokens and returns swig-core IRExpr nodes.
@@ -75,7 +85,7 @@ function validateOptions(options) {
     if (!options.hasOwnProperty(key)) {
       return;
     }
-    if (!utils.isArray(options[key]) || options[key].length !== 2) {
+    if (!utils.isArray(options[key]) || options[key].length !== 2 || typeof options[key][0] !== 'string' || typeof options[key][1] !== 'string') {
       throw new Error('Option "' + key + '" must be an array containing 2 different control strings.');
     }
     if (options[key][0] === options[key][1]) {
@@ -83,7 +93,7 @@ function validateOptions(options) {
     }
     utils.each(options[key], function (a, i) {
       if (a.length < 2) {
-        throw new Error('Option "' + key + '" ' + ((i) ? 'open ' : 'close ') + 'control must be at least 2 characters. Saw "' + a + '" instead.');
+        throw new Error('Option "' + key + '" ' + ((i) ? 'close ' : 'open ') + 'control must be at least 2 characters. Saw "' + a + '" instead.');
       }
     });
   });
@@ -151,7 +161,14 @@ exports.Twig = function (opts) {
     filters: _filters,
     validateOptions: validateOptions,
     onCompileError: function (err, options) {
-      utils.throwError(err, null, options.filename);
+      var filename = options && options.filename;
+      // An error with no file name to add, or one whose message already
+      // names the file (a tag's own throwError does), is rethrown
+      // unchanged instead of being wrapped a second time.
+      if (err instanceof Error && (!filename || err.message.indexOf(' in file ' + filename) !== -1)) {
+        throw err;
+      }
+      utils.throwError(err, null, filename);
     }
   });
 

package/lib/parser.js

@@ -85,12 +85,12 @@ exports.parseExpr = function (tokens, filters, _posOut) {
 
   function guardSegment(segment) {
     if (_dangerousProps.indexOf(segment) !== -1) {
-      bail('Unsafe access to "' + segment + '" is not allowed in templates (CVE-2023-25345)');
+      bail('Unsafe access to "' + segment + '" is not allowed in templates (prototype-chain guard)');
     }
   }
   function guardBracketString(value) {
     if (_dangerousProps.indexOf(value) !== -1) {
-      bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (CVE-2023-25345)');
+      bail('Unsafe access to "' + value + '" via bracket notation is not allowed in templates (prototype-chain guard)');
     }
   }
 

package/lib/tags/apply.js

@@ -109,7 +109,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
 
   function checkName(name) {
     if (_dangerousProps.indexOf(name) !== -1) {
-      utils.throwError('Unsafe filter name "' + name + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe filter name "' + name + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   }
 

package/lib/tags/block.js

@@ -66,7 +66,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
     utils.throwError('Block name "' + nameTok.match + '" must be a bare identifier', line, opts.filename);
   }
   if (_dangerousProps.indexOf(nameTok.match) !== -1) {
-    utils.throwError('Unsafe block name "' + nameTok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+    utils.throwError('Unsafe block name "' + nameTok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
   }
 
   pos += 1;

package/lib/tags/for.js

@@ -76,7 +76,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
       utils.throwError('Loop variable "' + tok.match + '" must be a bare identifier in "for" tag', line, opts.filename);
     }
     if (_dangerousProps.indexOf(tok.match) !== -1) {
-      utils.throwError('Unsafe loop variable "' + tok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe loop variable "' + tok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
     return tok.match;
   }

package/lib/tags/from.js

@@ -88,7 +88,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
       utils.throwError(role + ' "' + name + '" must be a bare identifier in "from" tag', line, opts.filename);
     }
     if (_dangerousProps.indexOf(name) !== -1) {
-      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   }
 

package/lib/tags/import.js

@@ -106,7 +106,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
     utils.throwError('Import alias "' + aliasTok.match + '" must be a bare identifier in "import" tag', line, opts.filename);
   }
   if (_dangerousProps.indexOf(aliasTok.match) !== -1) {
-    utils.throwError('Unsafe import alias "' + aliasTok.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+    utils.throwError('Unsafe import alias "' + aliasTok.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
   }
 
   if (peek()) {

package/lib/tags/include.js

@@ -28,8 +28,8 @@
  * `try { ... } catch {}` wrapper that collapses missing-file errors to
  * the empty string when `ignoreMissing` is set.
  *
- * `resolveFrom` is the template's own filename (backslash-escaped so
- * Windows paths round-trip through the JSON-literal emit). The native
+ * `resolveFrom` is the template's own filename; the backend escapes it at emit time
+ * (GHSA-q89c), so Windows paths and quotes round-trip through the literal. The native
  * parser's splitter passes it in as a trailing arg; Twig's
  * tag-dispatch shape carries it via `opts.filename`.
  */
@@ -125,7 +125,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
     ctxExpr = parser.parseExpr(ctxTokens);
   }
 
-  var resolveFrom = (opts.filename || '').replace(/\\/g, '\\\\');
+  var resolveFrom = (opts.filename || '');
 
   token.irExpr = ir.include(
     pathExpr,

package/lib/tags/macro.js

@@ -76,7 +76,7 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
       utils.throwError(role + ' "' + name + '" must be a bare identifier in "macro" tag', line, opts.filename);
     }
     if (_dangerousProps.indexOf(name) !== -1) {
-      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe ' + role.toLowerCase() + ' "' + name + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   }
 

package/lib/tags/set.js

@@ -84,17 +84,18 @@ exports.parse = function (str, line, parser, types, stack, opts, swig, token) {
   var path = lhsTok.match.split('.');
   utils.each(path, function (segment) {
     if (_dangerousProps.indexOf(segment) !== -1) {
-      utils.throwError('Unsafe assignment to "' + segment + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe assignment to "' + segment + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
   });
 
-  // DOTKEY tail — the Twig lexer already folds dotted paths into the
-  // VAR match, but a defensive DOTKEY consumer here keeps this tag
-  // robust if a future lexer tightening splits `foo.bar` into VAR + DOTKEY.
+  // DOTKEY tail — the Twig lexer folds `foo.bar` into one VAR match, but a
+  // dot after whitespace (`foo .bar`) lexes as its own DOTKEY token, so this
+  // loop runs today; it also keeps the tag safe if a future lexer splits
+  // `foo.bar` into VAR + DOTKEY.
   while (peek() && peek().type === types.DOTKEY) {
     var dk = consume();
     if (_dangerousProps.indexOf(dk.match) !== -1) {
-      utils.throwError('Unsafe assignment to "' + dk.match + '" is not allowed (CVE-2023-25345)', line, opts.filename);
+      utils.throwError('Unsafe assignment to "' + dk.match + '" is not allowed (prototype-chain guard)', line, opts.filename);
     }
     path.push(dk.match);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig-twig",
-  "version": "2.8.1",
+  "version": "2.8.3",
   "description": "Twig-syntax frontend for the @rhinostone/swig-core template engine. Part of the @rhinostone/swig multi-flavor family.",
   "keywords": [
     "template",
@@ -22,7 +22,7 @@
     "node": ">=12"
   },
   "peerDependencies": {
-    "@rhinostone/swig-core": "2.8.1"
+    "@rhinostone/swig-core": "2.8.3"
   },
   "publishConfig": {
     "access": "public"