@rhinostone/swig 2.8.4 → 2.9.1

package/HISTORY.md

@@ -1,3 +1,27 @@
+[2.9.1](https://github.com/gina-io/swig/tree/v2.9.1) / 2026-10-23
+-----------------------------------------------------------------
+
+* **Fixed** The Express example (examples/express) no longer has its catch-all route, which rendered any .html file a URL named as a template, including files outside the views folder. Its pages link only to the explicit routes, which are unchanged. The example is not part of any package; an application built from it should remove or confine that route.
+
+* **Changed** The test suite gains property-based tests, which check each property on many generated inputs: in every flavor the escape filter is idempotent and leaves no raw markup character, `{{ x }}` renders the escaped string, text with no tag renders unchanged apart from line endings, and any template filename reaches the loader unchanged through an include; the membership helper behind the `in` operator matches its definition on lists. They run with the new fast-check dev dependency (MIT, one dependency, pure-rand) under a fixed seed. Development and CI only; the published package is unaffected and its only runtime dependency remains @rhinostone/swig-core.
+
+* **Security** swig striptags no longer takes time quadratic in the length of its input. On text with many < and no > after them it ran for about five seconds per 100 000 characters, so a template that applied it to request data could be made to block the event loop. It now runs in linear time with the same output. The regex dates from the original project, so every earlier release has it.
+
+* **Security** swig-twig striptags and trim no longer take time quadratic in the length of their input. striptags ran for about five seconds per 100 000 characters on text with many < and no > after them, and trim took about as long on a long run of the trimmed characters inside the text, so a template that applied either to request data could be made to block the event loop. Both now run in linear time with the same output. Every swig-twig release since 2.0.0-alpha.3 has them.
+
+* **Security** swig-jinja2 striptags, trim and format no longer take time quadratic in the length of their input. striptags ran for about five seconds per 100 000 characters on text with many < or <!-- and nothing closing them, trim took as long on a long run of the trimmed characters inside the text, and format longer still on a % followed by a long run of zeros. A template that applied one of them to request data could be made to block the event loop. All three now run in linear time with the same output (Jinja2 3.1.6 strips tags and trims these inputs in linear time). Every swig-jinja2 release since 2.5.0 has them.
+
+* **Security** swig-django striptags, truncatewords, pluralize, slugify and floatformat no longer take time quadratic in the length of their input. striptags ran for about five seconds per 100 000 characters on text with many < and no > after them, truncatewords and pluralize took about as long on a long run of whitespace inside the value, slugify on a long run of underscores, and floatformat on an argument with a long run of g or u not at its end. A template that applied one of them to request data could be made to block the event loop. All five now run in linear time with the same output (Django 5.2.18 handles these inputs in linear time). Every swig-django release since 2.7.0 has them, except pluralize, which has had it since 2.8.2.
+
+[2.9.0](https://github.com/gina-io/swig/tree/v2.9.0) / 2026-10-23
+-----------------------------------------------------------------
+
+* **Added** An OpenSSF Scorecard badge at the top of the README of each of the five packages. It shows the score that a Scorecard workflow publishes for the repository on every push to develop and every week, and links to the Scorecard report. Documentation only; no runtime or API change.
+
+* **Added** swig-twig, swig-jinja2 and swig-django: the `not in` operator, as Twig, Jinja2 and Django have it. `x not in y` negates `x in y` and binds at the same level; where Django cannot run the test it is false, as Django gives it, and where Jinja2 raises swig gives true. Until now `x not in y` failed to parse. Native swig still rejects `not in`.
+
+* **Fixed** swig-twig, swig-jinja2 and swig-django: the `in` operator tests membership as Twig, Jinja2 and Django do. In Jinja2 and Django a list holds an equal item, a string a substring and a mapping a key; in Twig a list or a mapping holds a value, compared loosely, and a string holds a string or number as a substring. Until now `in` was the JavaScript operator, which tests keys: `3 in [1, 2, 3]` was false, `0 in [5]` true, and `"b" in "abc"` threw. A test the reference engine cannot run (a number or null container, for instance) is false instead of an error. Native swig keeps the JavaScript `in`.
+
 [2.8.4](https://github.com/gina-io/swig/tree/v2.8.4) / 2026-10-21
 -----------------------------------------------------------------
 

package/README.md

@@ -1,7 +1,7 @@
 Swig
 ====
 
-[![CI](https://github.com/gina-io/swig/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/gina-io/swig/actions/workflows/ci.yml) [![NPM version](https://img.shields.io/npm/v/@rhinostone/swig.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig) [![NPM Downloads](https://img.shields.io/npm/dm/@rhinostone/swig.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig) [![Socket Badge](https://socket.dev/api/badge/npm/package/@rhinostone/swig)](https://socket.dev/npm/package/@rhinostone/swig)
+[![CI](https://github.com/gina-io/swig/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/gina-io/swig/actions/workflows/ci.yml) [![NPM version](https://img.shields.io/npm/v/@rhinostone/swig.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig) [![NPM Downloads](https://img.shields.io/npm/dm/@rhinostone/swig.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig) [![Socket Badge](https://socket.dev/api/badge/npm/package/@rhinostone/swig)](https://socket.dev/npm/package/@rhinostone/swig) [![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/gina-io/swig?label=openssf%20scorecard&style=flat)](https://scorecard.dev/viewer/?uri=github.com/gina-io/swig)
 
 > **Multi-flavor template engine** for Node.js and browsers — native Swig syntax (Jinja2/Django-inspired), Twig syntax, Python Jinja2 syntax, and Django Template Language syntax via dedicated frontends sharing one IR backend. [gina-io/swig](https://github.com/gina-io/swig) started as a maintained continuation of the abandoned `paularmstrong/swig` (last released 2014) and is now a standalone project. Security and bug fixes ship here.
 
@@ -32,7 +32,7 @@ Features
 --------
 
 * Available for node.js **and** major web browsers.
-* **Strict-CSP browser runtime** — AOT-compile templates ahead of time (`swig compile --recursive --register`) and render them with the runtime-only bundle (`dist/swig.runtime.min.js`, ~22 KB) — no parser, no `new Function`, no `unsafe-eval` required.
+* **Strict-CSP browser runtime** — AOT-compile templates ahead of time (`swig compile --recursive --register`) and render them with the runtime-only bundle (`dist/swig.runtime.min.js`, ~24 KB) — no parser, no `new Function`, no `unsafe-eval` required.
 * [Express](https://expressjs.com/) compatible.
 * **Async template loading** — back the loader with S3 / Redis / HTTP / any callback API: set `loader.async = true` and pass a callback to `renderFile`, or to `compileFile` with `codegenMode: 'async'` in its options, whose compiled function returns a promise of `{ output, exports }`; `extends` / `include` / `import` resolve at render time, dynamic `{% extends %}` paths included.
 * Object-Oriented template inheritance.
@@ -43,12 +43,17 @@ Features
 * Robust without the bloat — a single runtime dependency ([`@rhinostone/swig-core`](https://www.npmjs.com/package/@rhinostone/swig-core)).
 * Extendable and customizable — register custom filters, tags, and loaders per-instance.
 
-What's new in v2.8.4
+What's new in v2.9.1
 --------------------
 
-* **Fixed — a string `autoescape` option names the escape strategy.** In `@rhinostone/swig`, `autoescape: 'js'` now gives JavaScript escaping and `autoescape: 'html'` HTML escaping, as documented. The option was written into the compiled template as code, so these values failed with `ReferenceError: js is not defined`, and an autoescape option built from untrusted input could run as code in the template. A value already wrapped in quotes keeps working, and a value holding a double quote or a line break is now rejected with an error. The Twig, Jinja2 and Django frontends already passed the option to the escape filter as a string.
+> **Security release: upgrade all five packages to 2.9.1.** `striptags` in every flavor, `trim` in swig-twig and swig-jinja2, swig-jinja2 `format`, and swig-django `truncatewords`, `pluralize`, `slugify` and `floatformat` took time quadratic in the length of their input on some inputs, several seconds for 100 000 characters. A template that applied one of them to request data could be made to block the event loop. They now run in linear time with the same output.
 
-* **Fixed — a numeric `filename` option compiles again.** A filename that is not a string, such as a number, compiles again with `import`, `from` and `extends` on the async render path, as it did in 2.8.2, and `include`, which failed with a number in 2.8.2 as well, now compiles too. 2.8.3 escaped the filename as a string and failed with `value.replace is not a function`; it is now converted to a string first. All four frontends.
+* **Security — swig `striptags` runs in linear time.** On text with many `<` and no `>` after them it ran for about five seconds per 100 000 characters. The regex dates from the original project, so every earlier release has it.
+* **Security — swig-twig `striptags` and `trim` run in linear time.** `striptags` was slow on text with many `<` and no `>` after them, and `trim` on a long run of the trimmed characters inside the text. Every swig-twig release since 2.0.0-alpha.3 has them.
+* **Security — swig-jinja2 `striptags`, `trim` and `format` run in linear time.** `striptags` was slow on text with many `<` or `<!--` and nothing closing them, `trim` on a long run of the trimmed characters inside the text, and `format` slower still on a `%` followed by a long run of zeros. Every swig-jinja2 release since 2.5.0 has them.
+* **Security — swig-django `striptags`, `truncatewords`, `pluralize`, `slugify` and `floatformat` run in linear time.** `striptags` was slow on text with many `<` and no `>` after them, `truncatewords` and `pluralize` on a long run of whitespace inside the value, `slugify` on a long run of underscores, and `floatformat` on an argument with a long run of `g` or `u` not at its end. Every swig-django release since 2.7.0 has them, except `pluralize`, which has had it since 2.8.2.
+* **Fixed — the Express example no longer has its catch-all route.** The route rendered any `.html` file a URL named as a template, including files outside the views folder. The example is not part of any package; an application built from it should remove or confine that route.
+* **Changed — property-based tests.** The test suite checks properties on many generated inputs, with the new fast-check dev dependency under a fixed seed. Development and CI only; the only runtime dependency remains `@rhinostone/swig-core`.
 
 See the full [HISTORY.md](./HISTORY.md) and [ROADMAP.md](./ROADMAP.md).
 

package/ROADMAP.md

@@ -10,10 +10,11 @@ For bug reports and feature requests, file an issue at [gina-io/swig](https://gi
 
 | Status | Item |
 | --- | --- |
-| Planned | `in` tests membership in all four flavors: `x in list` tests the elements and `x in "text"` the substring. Today `in` tests an object's keys or an array's indices, so `3 in [1, 2, 3]` is false. |
 | Planned | swig-jinja2 parity: loop filters (`{% for x in xs if cond %}`), `not(x)` written without a space, the `none` / `True` / `False` constants, for-loops over a mapping and over a list of pairs as Jinja2 iterates them, and the builtin filters `attr`, `filesizeformat`, `forceescape`, `items`, `string` and `urlize`. |
 | Planned | swig-django: two-variable for-loops over a list of pairs unpack each pair, as Django does. |
 | Planned | Unknown filter and test names rejected when a Twig, Jinja2 or Django template compiles; today the error comes only at render, or never when the branch does not run. Native swig already rejects an unknown filter. |
+| Planned | swig-django: `not` binds below the comparisons and `in`, as in Django; today `not x == y` reads as `(not x) == y`. |
+| Planned | swig-jinja2 and swig-django: `==` and `!=` compare as Python does; today they are JavaScript's loose operators, so `1 == "1"` is true and `[1] == [1]` false. |
 
 ## Future (post-2.0)
 
@@ -27,6 +28,19 @@ For bug reports and feature requests, file an issue at [gina-io/swig](https://gi
 
 ## Completed
 
+### v2.9.1 (October 2026)
+
+- Security: `striptags` in every flavor, `trim` in swig-twig and swig-jinja2, swig-jinja2 `format`, and swig-django `truncatewords`, `pluralize`, `slugify` and `floatformat` run in linear time with the same output. Their regexes took time quadratic in the input length on some inputs, so a template that applied one of them to request data could be made to block the event loop.
+- The Express example no longer has its catch-all route, which rendered any `.html` file a URL named as a template.
+- All five packages released in lockstep at `2.9.1`.
+
+### v2.9.0 (October 2026)
+
+- `in` tests membership in swig-twig, swig-jinja2 and swig-django, as Twig, Jinja2 and Django do: a list holds an item, a string a substring, and a mapping a key (Jinja2, Django) or a value (Twig). Native swig keeps the JavaScript `in`, which tests an object's keys or an array's indices.
+- `not in` in swig-twig, swig-jinja2 and swig-django.
+- An OpenSSF Scorecard badge on the README of each package.
+- All five packages released in lockstep at `2.9.0`.
+
 ### v2.8.4 (October 2026)
 
 - Fixed the `autoescape` option of `@rhinostone/swig` set to an escape strategy name: `'js'` and `'html'` work as documented. The value was written into the compiled template as code, so these failed with a ReferenceError and an option built from untrusted input could run as code; a value holding a double quote or a line break is now rejected with an error.

package/dist/swig.js

@@ -1,4 +1,4 @@
-/*! Swig v2.8.4 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
+/*! Swig v2.9.1 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
 /*! DateZ (c) 2011 Tomo Universalis | @license https://github.com/tn0ms/DateZ/blob/master/LISENCE */
 (() => {
   var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -22,8 +22,52 @@
     "packages/swig-core/lib/utils.js"(exports) {
       var security = require_security();
       var isArray;
+      var whitespace = /\s/;
       exports.strip = function(input) {
-        return input.replace(/^\s+|\s+$/g, "");
+        return exports.trimEnd(input.replace(/^\s+/, ""));
+      };
+      exports.trimEnd = function(input, chars) {
+        var end = input.length;
+        if (chars === void 0) {
+          while (end > 0 && whitespace.test(input.charAt(end - 1))) {
+            end -= 1;
+          }
+        } else {
+          while (end > 0 && chars.indexOf(input.charAt(end - 1)) !== -1) {
+            end -= 1;
+          }
+        }
+        return input.slice(0, end);
+      };
+      exports.stripTags = function(input, allowEmpty) {
+        var out = "", from = 0, lt = input.indexOf("<"), gt;
+        while (lt !== -1) {
+          gt = input.indexOf(">", lt + 1);
+          if (gt === -1) {
+            break;
+          }
+          if (gt === lt + 1 && !allowEmpty) {
+            lt = input.indexOf("<", lt + 1);
+            continue;
+          }
+          out += input.slice(from, lt);
+          from = gt + 1;
+          lt = input.indexOf("<", from);
+        }
+        return out + input.slice(from);
+      };
+      exports.stripComments = function(input) {
+        var out = "", from = 0, open = input.indexOf("<!--"), close;
+        while (open !== -1) {
+          close = input.indexOf("-->", open + 4);
+          if (close === -1) {
+            break;
+          }
+          out += input.slice(from, open);
+          from = close + 3;
+          open = input.indexOf("<!--", from);
+        }
+        return out + input.slice(from);
       };
       exports.startsWith = function(str, prefix) {
         return str.indexOf(prefix) === 0;
@@ -250,6 +294,58 @@
         }
         return cur;
       };
+      function sameItem(a, b, twig) {
+        if (a === b) {
+          return true;
+        }
+        if (!twig) {
+          return (a === null || a === void 0) && (b === null || b === void 0);
+        }
+        if (a !== null && typeof a === "object" || b !== null && typeof b === "object" || typeof a === "function" || typeof b === "function") {
+          return false;
+        }
+        return a == b;
+      }
+      function membership(needle, haystack, twig) {
+        var keys, i;
+        if (typeof haystack === "string") {
+          if (typeof needle === "string" || twig && typeof needle === "number") {
+            return haystack.indexOf(String(needle)) !== -1;
+          }
+          return twig ? false : null;
+        }
+        if (haystack === null || typeof haystack !== "object") {
+          return twig ? false : null;
+        }
+        if (exports.isArray(haystack)) {
+          for (i = 0; i < haystack.length; i += 1) {
+            if (sameItem(needle, haystack[i], twig)) {
+              return true;
+            }
+          }
+          return false;
+        }
+        if (twig) {
+          keys = Object.keys(haystack);
+          for (i = 0; i < keys.length; i += 1) {
+            if (sameItem(needle, haystack[keys[i]], true)) {
+              return true;
+            }
+          }
+          return false;
+        }
+        if (typeof needle === "string" || typeof needle === "number") {
+          return Object.prototype.hasOwnProperty.call(haystack, String(needle));
+        }
+        return needle !== null && typeof needle === "object" ? null : false;
+      }
+      exports.isIn = function(needle, haystack, mode, negate) {
+        var found = membership(needle, haystack, mode === "twig");
+        if (found === null) {
+          return negate === true && mode !== "django";
+        }
+        return negate === true ? !found : found;
+      };
     }
   });
 
@@ -1131,7 +1227,7 @@
         if (out !== void 0) {
           return out;
         }
-        return input.toString().replace(/(<([^>]+)>)/ig, "");
+        return utils.stripTags(input.toString());
       };
       exports.title = function(input) {
         var out = iterateFilter.apply(exports.title, arguments);
@@ -1923,12 +2019,18 @@
         }
         return js;
       }
+      function membershipMode(flag) {
+        return flag === "twig" || flag === "django" ? flag : "jinja2";
+      }
       function emitBinaryOp(node, d) {
         var left = groupOperand(node.left, emitExpr(node.left, d)), right = groupOperand(node.right, emitExpr(node.right, d));
         if (isArithmeticOp(node.op)) {
           return left + " " + node.op + " " + right;
         }
         if (node.op === "in") {
+          if (node.membership) {
+            return "_utils.isIn(" + left + ", " + right + ', "' + membershipMode(node.membership) + '"' + (node.negate ? ", true" : "") + ")";
+          }
           return left + " in " + right;
         }
         if (node.op === "~") {
@@ -4836,7 +4938,7 @@
       var loaders = require_loaders2();
       var preWalker = require_pre_walker();
       var engine = require_engine();
-      exports.version = "2.8.4";
+      exports.version = "2.9.1";
       var defaultOptions = {
         autoescape: true,
         varControls: ["{{", "}}"],
@@ -5062,6 +5164,10 @@
     window.swig = swig;
   }
 })();
+/*!
+ * What a \s regex atom matches, tested one code unit at a time.
+ * @private
+ */
 /*!
  * Resolve a single path segment against a value, Django-style. A plain
  * property access (`obj[seg]`) covers dictionary, attribute, and array /
@@ -5076,6 +5182,19 @@
  * `_dangerousProps` segments are rejected at runtime as defense-in-depth.
  * @private
  */
+/*!
+ * Item equality for `isIn`. Jinja2 and Django compare with `===` and treat
+ * null and a missing value as equal (Django reads both as None). Twig
+ * compares two scalars with `==`, as swig-twig's `==` does, and anything
+ * else by identity. @private
+ */
+/*!
+ * The membership test of `isIn`: true or false, or null when Jinja2 and
+ * Django cannot run it, where Python raises a TypeError: a container that is
+ * not a list, a string or a mapping, a needle that is not a string tested
+ * against a string, or a list or an object tested against a mapping's keys.
+ * Twig runs every test. @private
+ */
 /*!
  * Attach `loc` to the node if provided, skipping the assignment otherwise
  * so consumers can tell "no source location available" from
@@ -5177,6 +5296,10 @@
  * wraps a unary operand, for the positions where its prefix would bind
  * differently (`-(-x)`, `(-x)[0]`). @private
  */
+/*!
+ * The flavor name `emitBinaryOp` writes into an `_utils.isIn` call: one of
+ * the three names `isIn` knows, never the flag's own text. @private
+ */
 /*!
  * Emit a function / method invocation. Three callee shapes:
  *   1. Single-segment VarRef (`foo(...)`) — FUNCTION-token pattern with