@rhinostone/swig 2.8.3 → 2.8.4

package/HISTORY.md

@@ -1,3 +1,10 @@
+[2.8.4](https://github.com/gina-io/swig/tree/v2.8.4) / 2026-10-21
+-----------------------------------------------------------------
+
+* **Fixed** A filename option that is not a string, such as a number, compiles again with import, from and extends on the async render path, as it did in 2.8.2, and include, which failed with a number in 2.8.2 as well, now compiles too. 2.8.3 escaped the filename as a string before writing it into the compiled template, so a number failed with value.replace is not a function; the filename is now converted to a string first. All four frontends.
+
+* **Fixed** The autoescape option of @rhinostone/swig now takes the name of an escape strategy, as documented: autoescape set to 'js' gives JavaScript escaping and 'html' HTML escaping. The option was written into the compiled template as code, so these values failed with ReferenceError: js is not defined, and an autoescape option built from untrusted input could run as code in the template. A value already wrapped in quotes keeps working, and a value holding a double quote or a line break is now rejected with an error. The Twig, Jinja2 and Django frontends already passed the option to the escape filter as a string.
+
 [2.8.3](https://github.com/gina-io/swig/tree/v2.8.3) / 2026-10-21
 -----------------------------------------------------------------
 

package/README.md

@@ -43,12 +43,12 @@ Features
 * Robust without the bloat — a single runtime dependency ([`@rhinostone/swig-core`](https://www.npmjs.com/package/@rhinostone/swig-core)).
 * Extendable and customizable — register custom filters, tags, and loaders per-instance.
 
-What's new in v2.8.3
+What's new in v2.8.4
 --------------------
 
-> **Security.** If your application passes untrusted data as the `filename` option to `render`, `compile`, `precompile`, `renderFile` or `compileFile` (or a flavor equivalent), upgrade to `2.8.3`.
+* **Fixed — a string `autoescape` option names the escape strategy.** In `@rhinostone/swig`, `autoescape: 'js'` now gives JavaScript escaping and `autoescape: 'html'` HTML escaping, as documented. The option was written into the compiled template as code, so these values failed with `ReferenceError: js is not defined`, and an autoescape option built from untrusted input could run as code in the template. A value already wrapped in quotes keeps working, and a value holding a double quote or a line break is now rejected with an error. The Twig, Jinja2 and Django frontends already passed the option to the escape filter as a string.
 
-* **Security — the compiled template escapes the including filename (GHSA-q89c).** The code generator now escapes a template's filename (`resolveFrom`) before writing it into the compiled function body, so a double quote in a `filename` option can no longer break out of the generated string literal. The escape is centralized in the generator, which also fixes a latent broken-JS bug for backslash paths through `import`, `from` and `extends`.
+* **Fixed — a numeric `filename` option compiles again.** A filename that is not a string, such as a number, compiles again with `import`, `from` and `extends` on the async render path, as it did in 2.8.2, and `include`, which failed with a number in 2.8.2 as well, now compiles too. 2.8.3 escaped the filename as a string and failed with `value.replace is not a function`; it is now converted to a string first. All four frontends.
 
 See the full [HISTORY.md](./HISTORY.md) and [ROADMAP.md](./ROADMAP.md).
 

package/ROADMAP.md

@@ -27,6 +27,12 @@ For bug reports and feature requests, file an issue at [gina-io/swig](https://gi
 
 ## Completed
 
+### v2.8.4 (October 2026)
+
+- Fixed the `autoescape` option of `@rhinostone/swig` set to an escape strategy name: `'js'` and `'html'` work as documented. The value was written into the compiled template as code, so these failed with a ReferenceError and an option built from untrusted input could run as code; a value holding a double quote or a line break is now rejected with an error.
+- Fixed a `filename` option that is not a string, such as a number, which 2.8.3 no longer compiled with `import`, `from` and `extends` on the async render path; `include` now compiles with a number too. All four frontends.
+- All five packages released in lockstep at `2.8.4`.
+
 ### v2.8.3 (October 2026)
 
 - Security: the template compiler escapes the including template's filename before writing it into the compiled function body, so a double quote in a `filename` option can no longer break out of the generated string literal (GHSA-q89c). Escaping is centralized in the code generator, which also fixes a latent broken-JS bug for backslash paths through `import`, `from` and `extends`.

package/dist/swig.js

@@ -1,4 +1,4 @@
-/*! Swig v2.8.3 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
+/*! Swig v2.8.4 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
 /*! DateZ (c) 2011 Tomo Universalis | @license https://github.com/tn0ms/DateZ/blob/master/LISENCE */
 (() => {
   var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -1618,7 +1618,7 @@
             } else {
               incSelector = "_utils.extend({}, _ctx, " + incCtxJS + ")";
             }
-            out += (node.ignoreMissing ? "  try {\n" : "") + "_output += _swig.compileFile(" + incPathJS + ', {resolveFrom: "' + escapeTextValue(node.resolveFrom || "") + '"})(' + incSelector + ");\n" + (node.ignoreMissing ? "} catch (e) {}\n" : "");
+            out += (node.ignoreMissing ? "  try {\n" : "") + "_output += _swig.compileFile(" + incPathJS + ', {resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"})(' + incSelector + ");\n" + (node.ignoreMissing ? "} catch (e) {}\n" : "");
             return;
           }
           if (node.type === "IncludeDeferred") {
@@ -1643,7 +1643,7 @@
             } else {
               incdSelector = "_utils.extend({}, _ctx, " + incdCtxJS + ")";
             }
-            var incdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || "") + '"}';
+            var incdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             out += (node.ignoreMissing ? "  try {\n" : "") + "_output += (await (await _swig.getTemplate(" + incdPathJS + ", " + incdOpts + "))(" + incdSelector + ")).output;\n" + (node.ignoreMissing ? "} catch (e) {}\n" : "");
             return;
           }
@@ -1657,7 +1657,7 @@
             } else {
               impdPathJS = node.path;
             }
-            var impdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || "") + '"}';
+            var impdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             out += "_ctx." + node.alias + " = (await (await _swig.getTemplate(" + impdPathJS + ", " + impdOpts + "))(_ctx)).exports;\n";
             return;
           }
@@ -1678,7 +1678,7 @@
             } else {
               fromdPathJS = node.path;
             }
-            var fromdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || "") + '"}';
+            var fromdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             var fromdBindings = "";
             utils.each(fromdImports, function(entry) {
               var bindName = entry.alias || entry.name;
@@ -1715,7 +1715,7 @@
             } else {
               extPathJS = node.path;
             }
-            var extOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || "") + '"}';
+            var extOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             out += "var _parentTpl = await _swig.getTemplate(" + extPathJS + ", " + extOpts + ");\n";
             out += "var _parentResult = await _parentTpl(_ctx, _mergedBlocks);\n";
             out += "_output = _parentResult.output;\n";
@@ -3058,9 +3058,23 @@
       function escapeRegExp(str) {
         return str.replace(/[\-\/\\\^$*+?.()|\[\]{}]/g, "\\$&");
       }
+      function quoteEscapeOption(value) {
+        var quote;
+        if (typeof value !== "string" || value === "") {
+          return value;
+        }
+        quote = value.charAt(0);
+        if (value.length > 1 && (quote === '"' || quote === "'") && value.charAt(value.length - 1) === quote) {
+          value = value.slice(1, -1);
+        }
+        if (/["\n\r\u2028\u2029]/.test(value)) {
+          throw new Error('Option "autoescape" must be true, false or an escape strategy name without double quotes or line breaks.');
+        }
+        return '"' + value + '"';
+      }
       exports.parse = function(swig2, source, opts, tags, filters) {
         source = source.replace(/\r\n/g, "\n");
-        var escape = opts.autoescape, tagOpen = opts.tagControls[0], tagClose = opts.tagControls[1], varOpen = opts.varControls[0], varClose = opts.varControls[1], escapedTagOpen = escapeRegExp(tagOpen), escapedTagClose = escapeRegExp(tagClose), escapedVarOpen = escapeRegExp(varOpen), escapedVarClose = escapeRegExp(varClose), tagStrip = new RegExp("^" + escapedTagOpen + "-?\\s*|\\s*-?" + escapedTagClose + "$", "g"), tagStripBefore = new RegExp("^" + escapedTagOpen + "-"), tagStripAfter = new RegExp("-" + escapedTagClose + "$"), varStrip = new RegExp("^" + escapedVarOpen + "-?\\s*|\\s*-?" + escapedVarClose + "$", "g"), varStripBefore = new RegExp("^" + escapedVarOpen + "-"), varStripAfter = new RegExp("-" + escapedVarClose + "$"), cmtOpen = opts.cmtControls[0], cmtClose = opts.cmtControls[1], anyChar = "[\\s\\S]*?", splitter = new RegExp(
+        var escape = quoteEscapeOption(opts.autoescape), tagOpen = opts.tagControls[0], tagClose = opts.tagControls[1], varOpen = opts.varControls[0], varClose = opts.varControls[1], escapedTagOpen = escapeRegExp(tagOpen), escapedTagClose = escapeRegExp(tagClose), escapedVarOpen = escapeRegExp(varOpen), escapedVarClose = escapeRegExp(varClose), tagStrip = new RegExp("^" + escapedTagOpen + "-?\\s*|\\s*-?" + escapedTagClose + "$", "g"), tagStripBefore = new RegExp("^" + escapedTagOpen + "-"), tagStripAfter = new RegExp("-" + escapedTagClose + "$"), varStrip = new RegExp("^" + escapedVarOpen + "-?\\s*|\\s*-?" + escapedVarClose + "$", "g"), varStripBefore = new RegExp("^" + escapedVarOpen + "-"), varStripAfter = new RegExp("-" + escapedVarClose + "$"), cmtOpen = opts.cmtControls[0], cmtClose = opts.cmtControls[1], anyChar = "[\\s\\S]*?", splitter = new RegExp(
           "(" + escapedTagOpen + anyChar + escapedTagClose + "|" + escapedVarOpen + anyChar + escapedVarClose + "|" + escapeRegExp(cmtOpen) + anyChar + escapeRegExp(cmtClose) + ")"
         ), line = 1, stack = [], parent = null, parentExpr = null, tokens = [], blocks = {}, inRaw = false, stripNext;
         function parseVariable(str, line2) {
@@ -3080,7 +3094,7 @@
             if (last && last.name === str.split(/\s+/)[0].replace(/^end/, "") && last.ends) {
               switch (last.name) {
                 case "autoescape":
-                  escape = opts.autoescape;
+                  escape = quoteEscapeOption(opts.autoescape);
                   break;
                 case "raw":
                   inRaw = false;
@@ -4822,7 +4836,7 @@
       var loaders = require_loaders2();
       var preWalker = require_pre_walker();
       var engine = require_engine();
-      exports.version = "2.8.3";
+      exports.version = "2.8.4";
       var defaultOptions = {
         autoescape: true,
         varControls: ["{{", "}}"],
@@ -5185,6 +5199,19 @@
  * @return {string}
  * @private
  */
+/*!
+ * Turn a string autoescape option into the string literal that the
+ * autoescape tail writes into the compiled template as the e filter's
+ * strategy argument; the bare option used to be written there as code.
+ * The tail doubles every backslash, so the value is wrapped in double
+ * quotes without escaping it, and a value holding a double quote or a line
+ * break is rejected. One pair of matching outer quotes is removed first,
+ * so a value that was already quoted keeps working. A value that is not a
+ * non-empty string is returned unchanged.
+ * @param  {*} value The autoescape option.
+ * @return {*}
+ * @private
+ */
 /*!
  * Loop over the source, split via the tag/var/comment regular expression splitter.
  * Send each chunk to the appropriate parser.