@rhinostone/swig 2.8.2 → 2.8.4

package/HISTORY.md

@@ -1,3 +1,15 @@
+[2.8.4](https://github.com/gina-io/swig/tree/v2.8.4) / 2026-10-21
+-----------------------------------------------------------------
+
+* **Fixed** A filename option that is not a string, such as a number, compiles again with import, from and extends on the async render path, as it did in 2.8.2, and include, which failed with a number in 2.8.2 as well, now compiles too. 2.8.3 escaped the filename as a string before writing it into the compiled template, so a number failed with value.replace is not a function; the filename is now converted to a string first. All four frontends.
+
+* **Fixed** The autoescape option of @rhinostone/swig now takes the name of an escape strategy, as documented: autoescape set to 'js' gives JavaScript escaping and 'html' HTML escaping. The option was written into the compiled template as code, so these values failed with ReferenceError: js is not defined, and an autoescape option built from untrusted input could run as code in the template. A value already wrapped in quotes keeps working, and a value holding a double quote or a line break is now rejected with an error. The Twig, Jinja2 and Django frontends already passed the option to the escape filter as a string.
+
+[2.8.3](https://github.com/gina-io/swig/tree/v2.8.3) / 2026-10-21
+-----------------------------------------------------------------
+
+* **Security** The template compiler now escapes the including template filename (resolveFrom) before writing it into the compiled function body, so a double quote in a filename option can no longer break out of the generated string literal (GHSA-q89c). Escaping is centralized in the code generator, which also fixes a latent broken-JS bug for backslash paths through import, from and extends.
+
 [2.8.2](https://github.com/gina-io/swig/tree/v2.8.2) / 2026-10-20
 -----------------------------------------------------------------
 

package/README.md

@@ -43,24 +43,12 @@ Features
 * Robust without the bloat — a single runtime dependency ([`@rhinostone/swig-core`](https://www.npmjs.com/package/@rhinostone/swig-core)).
 * Extendable and customizable — register custom filters, tags, and loaders per-instance.
 
-What's new in v2.8.2
+What's new in v2.8.4
 --------------------
 
-> **Upgrade if a template takes a `wordwrap` width or a range bound from request data.** swig-jinja2's `wordwrap` hung on a width below 1 and swig-twig's `a..b` on an infinite bound, which plain JSON produces for a number such as `1e999`; each took seconds and more than 2 GB of memory before failing.
-
-> **Error text changed.** The prototype-chain guards' messages end with `(prototype-chain guard)` instead of `(CVE-2023-25345)`; code that matches the old text has to match the new one.
-
-* **Security — swig-jinja2 `wordwrap` no longer hangs on a width below 1.** A width of 0 or less, as a number or as a string such as `"0"`, ran for four to six seconds and took more than 2 GB of memory before a RangeError; it now returns the input unchanged (Jinja2 raises). A width between 0 and 1 now breaks one character at a time, as Python does. Every swig-jinja2 release since 2.5.0 has the hang.
-* **Security — swig-twig ranges no longer hang on an infinite bound.** `a..b` with a bound of Infinity looped until the array overflowed, taking up to about three seconds and more than 2 GB of memory before a RangeError; the range is now empty, as it already was for NaN. Every release since 2.0.0-alpha.5 has the hang.
-* **Fixed — parenthesized sub-expressions keep their grouping, in every flavor.** Since 2.0.0-alpha.2 a group whose operator binds more loosely than the operator outside it was evaluated wrongly (`{{ (1 + 2) * 3 }}` rendered 7, and `{% if (x or y) and z %}` took its branch with x true and z false), as were a comparison grouped inside a comparison and a subscript on a `+` group, and `{{ -(-x) }}` failed to compile. Groups that JavaScript reads the same way, `not (…)`, `-(…)` and a group followed by a filter were not affected.
-* **Fixed — swig-jinja2 expressions follow Jinja2's precedence.** A unary minus applies before the filters and the `**` that follow it (`-2 ** 2` is 4); `**` reads from the left (`2 ** 3 ** 2` is 64); a test binds to the operand next to it (`{{ 1 + 2 is number }}` tests 2, and `not x is defined` negates the test) and takes one argument without parentheses (`x is divisibleby 3`); and `not` sits below the comparisons and arithmetic (`not x == y` is `not (x == y)`).
-* **Fixed — swig-jinja2 tests.** `lower` and `upper` need a cased letter, `odd` follows Python's `n % 2 == 1`, and `number` accepts NaN, as in Jinja2.
-* **Fixed — swig-jinja2 filters follow Jinja2.** `first`, `last`, `reverse`, `unique`, `min`, `max` and `slice` use a mapping's keys; `batch` starts a row at exactly `size` items and batches a string by its characters; `sort` of a string returns its sorted characters; `replace` converts a number first and handles an empty search string and a negative count as Python does; `format` prints `%e` with at least two exponent digits and `%g` as Python does; and `wordwrap` keeps the separating space when a line is exactly full.
-* **Fixed — swig-django filters follow Django.** `join` joins a string's characters and a mapping's keys; `pluralize` reads a boolean, a string and a mapping as Django does; `truncatechars` and `truncatewords` return the empty string for a count of 0 or less and the value unchanged for a count that Python's `int()` rejects.
-* **Fixed — the shared engine, in all four frontends.** An async-mode compile no longer shares its cache entry with a sync compile of the same file (a sync include of such a file rendered `[object Promise]`); an error raised while a template compiles is reported when no options object is passed, instead of a TypeError, and names its file once; and the `varControls`, `tagControls` and `cmtControls` options reject a control that is not a string, with the open and close controls named the right way round.
-* **Fixed — guard messages and version exports.** The prototype-chain guards' messages end with `(prototype-chain guard)`, and `swig-core`, `swig-twig`, `swig-jinja2` and `swig-django` export their `version`, as `swig` always has.
-* **Fixed — documentation.** SECURITY.md names 2.8.x as the supported line; the issue and pull-request templates no longer open with the original project's "no longer maintained" notice; and the README says that `compileFile` needs `codegenMode: 'async'` for an async loader, that its compiled function then returns a promise of `{ output, exports }`, and how to port `not in` to native swig; the swig-jinja2 and swig-django READMEs lead with `renderFile` against an async loader.
-* **Changed — development only.** The `globals` dev dependency moves to 17.x; `make lint` reports the same clean result.
+* **Fixed — a string `autoescape` option names the escape strategy.** In `@rhinostone/swig`, `autoescape: 'js'` now gives JavaScript escaping and `autoescape: 'html'` HTML escaping, as documented. The option was written into the compiled template as code, so these values failed with `ReferenceError: js is not defined`, and an autoescape option built from untrusted input could run as code in the template. A value already wrapped in quotes keeps working, and a value holding a double quote or a line break is now rejected with an error. The Twig, Jinja2 and Django frontends already passed the option to the escape filter as a string.
+
+* **Fixed — a numeric `filename` option compiles again.** A filename that is not a string, such as a number, compiles again with `import`, `from` and `extends` on the async render path, as it did in 2.8.2, and `include`, which failed with a number in 2.8.2 as well, now compiles too. 2.8.3 escaped the filename as a string and failed with `value.replace is not a function`; it is now converted to a string first. All four frontends.
 
 See the full [HISTORY.md](./HISTORY.md) and [ROADMAP.md](./ROADMAP.md).
 

package/ROADMAP.md

@@ -27,6 +27,17 @@ For bug reports and feature requests, file an issue at [gina-io/swig](https://gi
 
 ## Completed
 
+### v2.8.4 (October 2026)
+
+- Fixed the `autoescape` option of `@rhinostone/swig` set to an escape strategy name: `'js'` and `'html'` work as documented. The value was written into the compiled template as code, so these failed with a ReferenceError and an option built from untrusted input could run as code; a value holding a double quote or a line break is now rejected with an error.
+- Fixed a `filename` option that is not a string, such as a number, which 2.8.3 no longer compiled with `import`, `from` and `extends` on the async render path; `include` now compiles with a number too. All four frontends.
+- All five packages released in lockstep at `2.8.4`.
+
+### v2.8.3 (October 2026)
+
+- Security: the template compiler escapes the including template's filename before writing it into the compiled function body, so a double quote in a `filename` option can no longer break out of the generated string literal (GHSA-q89c). Escaping is centralized in the code generator, which also fixes a latent broken-JS bug for backslash paths through `import`, `from` and `extends`.
+- All five packages released in lockstep at `2.8.3`.
+
 ### v2.8.2 (October 2026)
 
 - Fixed two hangs that request data can reach. swig-jinja2's `wordwrap` with a width below 1, as a number or as a string such as `"0"`, ran for four to six seconds and took more than 2 GB of memory before a RangeError; it now returns the input unchanged, and a width between 0 and 1 breaks one character at a time. swig-twig's `a..b` with an infinite bound, which plain JSON produces for a number such as `1e999`, looped until the array overflowed; the range is now empty.

package/dist/swig.js

@@ -1,4 +1,4 @@
-/*! Swig v2.8.2 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
+/*! Swig v2.8.4 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
 /*! DateZ (c) 2011 Tomo Universalis | @license https://github.com/tn0ms/DateZ/blob/master/LISENCE */
 (() => {
   var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -1618,7 +1618,7 @@
             } else {
               incSelector = "_utils.extend({}, _ctx, " + incCtxJS + ")";
             }
-            out += (node.ignoreMissing ? "  try {\n" : "") + "_output += _swig.compileFile(" + incPathJS + ', {resolveFrom: "' + node.resolveFrom + '"})(' + incSelector + ");\n" + (node.ignoreMissing ? "} catch (e) {}\n" : "");
+            out += (node.ignoreMissing ? "  try {\n" : "") + "_output += _swig.compileFile(" + incPathJS + ', {resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"})(' + incSelector + ");\n" + (node.ignoreMissing ? "} catch (e) {}\n" : "");
             return;
           }
           if (node.type === "IncludeDeferred") {
@@ -1643,7 +1643,7 @@
             } else {
               incdSelector = "_utils.extend({}, _ctx, " + incdCtxJS + ")";
             }
-            var incdOpts = '{resolveFrom: "' + (node.resolveFrom || "") + '"}';
+            var incdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             out += (node.ignoreMissing ? "  try {\n" : "") + "_output += (await (await _swig.getTemplate(" + incdPathJS + ", " + incdOpts + "))(" + incdSelector + ")).output;\n" + (node.ignoreMissing ? "} catch (e) {}\n" : "");
             return;
           }
@@ -1657,7 +1657,7 @@
             } else {
               impdPathJS = node.path;
             }
-            var impdOpts = '{resolveFrom: "' + (node.resolveFrom || "") + '"}';
+            var impdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             out += "_ctx." + node.alias + " = (await (await _swig.getTemplate(" + impdPathJS + ", " + impdOpts + "))(_ctx)).exports;\n";
             return;
           }
@@ -1678,7 +1678,7 @@
             } else {
               fromdPathJS = node.path;
             }
-            var fromdOpts = '{resolveFrom: "' + (node.resolveFrom || "") + '"}';
+            var fromdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             var fromdBindings = "";
             utils.each(fromdImports, function(entry) {
               var bindName = entry.alias || entry.name;
@@ -1715,7 +1715,7 @@
             } else {
               extPathJS = node.path;
             }
-            var extOpts = '{resolveFrom: "' + (node.resolveFrom || "") + '"}';
+            var extOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             out += "var _parentTpl = await _swig.getTemplate(" + extPathJS + ", " + extOpts + ");\n";
             out += "var _parentResult = await _parentTpl(_ctx, _mergedBlocks);\n";
             out += "_output = _parentResult.output;\n";
@@ -3058,9 +3058,23 @@
       function escapeRegExp(str) {
         return str.replace(/[\-\/\\\^$*+?.()|\[\]{}]/g, "\\$&");
       }
+      function quoteEscapeOption(value) {
+        var quote;
+        if (typeof value !== "string" || value === "") {
+          return value;
+        }
+        quote = value.charAt(0);
+        if (value.length > 1 && (quote === '"' || quote === "'") && value.charAt(value.length - 1) === quote) {
+          value = value.slice(1, -1);
+        }
+        if (/["\n\r\u2028\u2029]/.test(value)) {
+          throw new Error('Option "autoescape" must be true, false or an escape strategy name without double quotes or line breaks.');
+        }
+        return '"' + value + '"';
+      }
       exports.parse = function(swig2, source, opts, tags, filters) {
         source = source.replace(/\r\n/g, "\n");
-        var escape = opts.autoescape, tagOpen = opts.tagControls[0], tagClose = opts.tagControls[1], varOpen = opts.varControls[0], varClose = opts.varControls[1], escapedTagOpen = escapeRegExp(tagOpen), escapedTagClose = escapeRegExp(tagClose), escapedVarOpen = escapeRegExp(varOpen), escapedVarClose = escapeRegExp(varClose), tagStrip = new RegExp("^" + escapedTagOpen + "-?\\s*|\\s*-?" + escapedTagClose + "$", "g"), tagStripBefore = new RegExp("^" + escapedTagOpen + "-"), tagStripAfter = new RegExp("-" + escapedTagClose + "$"), varStrip = new RegExp("^" + escapedVarOpen + "-?\\s*|\\s*-?" + escapedVarClose + "$", "g"), varStripBefore = new RegExp("^" + escapedVarOpen + "-"), varStripAfter = new RegExp("-" + escapedVarClose + "$"), cmtOpen = opts.cmtControls[0], cmtClose = opts.cmtControls[1], anyChar = "[\\s\\S]*?", splitter = new RegExp(
+        var escape = quoteEscapeOption(opts.autoescape), tagOpen = opts.tagControls[0], tagClose = opts.tagControls[1], varOpen = opts.varControls[0], varClose = opts.varControls[1], escapedTagOpen = escapeRegExp(tagOpen), escapedTagClose = escapeRegExp(tagClose), escapedVarOpen = escapeRegExp(varOpen), escapedVarClose = escapeRegExp(varClose), tagStrip = new RegExp("^" + escapedTagOpen + "-?\\s*|\\s*-?" + escapedTagClose + "$", "g"), tagStripBefore = new RegExp("^" + escapedTagOpen + "-"), tagStripAfter = new RegExp("-" + escapedTagClose + "$"), varStrip = new RegExp("^" + escapedVarOpen + "-?\\s*|\\s*-?" + escapedVarClose + "$", "g"), varStripBefore = new RegExp("^" + escapedVarOpen + "-"), varStripAfter = new RegExp("-" + escapedVarClose + "$"), cmtOpen = opts.cmtControls[0], cmtClose = opts.cmtControls[1], anyChar = "[\\s\\S]*?", splitter = new RegExp(
           "(" + escapedTagOpen + anyChar + escapedTagClose + "|" + escapedVarOpen + anyChar + escapedVarClose + "|" + escapeRegExp(cmtOpen) + anyChar + escapeRegExp(cmtClose) + ")"
         ), line = 1, stack = [], parent = null, parentExpr = null, tokens = [], blocks = {}, inRaw = false, stripNext;
         function parseVariable(str, line2) {
@@ -3080,7 +3094,7 @@
             if (last && last.name === str.split(/\s+/)[0].replace(/^end/, "") && last.ends) {
               switch (last.name) {
                 case "autoescape":
-                  escape = opts.autoescape;
+                  escape = quoteEscapeOption(opts.autoescape);
                   break;
                 case "raw":
                   inRaw = false;
@@ -3327,7 +3341,7 @@
       var missing = "missing";
       var only = "only";
       exports.compile = function(compiler, args, content, parents, options, blockName, token) {
-        var file = args.shift(), onlyIdx = args.indexOf(only), onlyCtx = onlyIdx !== -1 ? args.splice(onlyIdx, 1) : false, parentFile = (args.pop() || "").replace(/\\/g, "\\\\"), ignoreMissing = args[args.length - 1] === missing ? args.pop() : false, w = args.join("");
+        var file = args.shift(), onlyIdx = args.indexOf(only), onlyCtx = onlyIdx !== -1 ? args.splice(onlyIdx, 1) : false, parentFile = args.pop() || "", ignoreMissing = args[args.length - 1] === missing ? args.pop() : false, w = args.join("");
         if (token && token.irExpr) {
           file = token.irExpr.file;
           if (token.irExpr.context !== void 0) {
@@ -4822,7 +4836,7 @@
       var loaders = require_loaders2();
       var preWalker = require_pre_walker();
       var engine = require_engine();
-      exports.version = "2.8.2";
+      exports.version = "2.8.4";
       var defaultOptions = {
         autoescape: true,
         varControls: ["{{", "}}"],
@@ -5185,6 +5199,19 @@
  * @return {string}
  * @private
  */
+/*!
+ * Turn a string autoescape option into the string literal that the
+ * autoescape tail writes into the compiled template as the e filter's
+ * strategy argument; the bare option used to be written there as code.
+ * The tail doubles every backslash, so the value is wrapped in double
+ * quotes without escaping it, and a value holding a double quote or a line
+ * break is rejected. One pair of matching outer quotes is removed first,
+ * so a value that was already quoted keeps working. A value that is not a
+ * non-empty string is returned unchanged.
+ * @param  {*} value The autoescape option.
+ * @return {*}
+ * @private
+ */
 /*!
  * Loop over the source, split via the tag/var/comment regular expression splitter.
  * Send each chunk to the appropriate parser.