@rhinostone/swig 2.9.0 → 2.9.1

package/HISTORY.md

@@ -1,3 +1,18 @@
+[2.9.1](https://github.com/gina-io/swig/tree/v2.9.1) / 2026-10-23
+-----------------------------------------------------------------
+
+* **Fixed** The Express example (examples/express) no longer has its catch-all route, which rendered any .html file a URL named as a template, including files outside the views folder. Its pages link only to the explicit routes, which are unchanged. The example is not part of any package; an application built from it should remove or confine that route.
+
+* **Changed** The test suite gains property-based tests, which check each property on many generated inputs: in every flavor the escape filter is idempotent and leaves no raw markup character, `{{ x }}` renders the escaped string, text with no tag renders unchanged apart from line endings, and any template filename reaches the loader unchanged through an include; the membership helper behind the `in` operator matches its definition on lists. They run with the new fast-check dev dependency (MIT, one dependency, pure-rand) under a fixed seed. Development and CI only; the published package is unaffected and its only runtime dependency remains @rhinostone/swig-core.
+
+* **Security** swig striptags no longer takes time quadratic in the length of its input. On text with many < and no > after them it ran for about five seconds per 100 000 characters, so a template that applied it to request data could be made to block the event loop. It now runs in linear time with the same output. The regex dates from the original project, so every earlier release has it.
+
+* **Security** swig-twig striptags and trim no longer take time quadratic in the length of their input. striptags ran for about five seconds per 100 000 characters on text with many < and no > after them, and trim took about as long on a long run of the trimmed characters inside the text, so a template that applied either to request data could be made to block the event loop. Both now run in linear time with the same output. Every swig-twig release since 2.0.0-alpha.3 has them.
+
+* **Security** swig-jinja2 striptags, trim and format no longer take time quadratic in the length of their input. striptags ran for about five seconds per 100 000 characters on text with many < or <!-- and nothing closing them, trim took as long on a long run of the trimmed characters inside the text, and format longer still on a % followed by a long run of zeros. A template that applied one of them to request data could be made to block the event loop. All three now run in linear time with the same output (Jinja2 3.1.6 strips tags and trims these inputs in linear time). Every swig-jinja2 release since 2.5.0 has them.
+
+* **Security** swig-django striptags, truncatewords, pluralize, slugify and floatformat no longer take time quadratic in the length of their input. striptags ran for about five seconds per 100 000 characters on text with many < and no > after them, truncatewords and pluralize took about as long on a long run of whitespace inside the value, slugify on a long run of underscores, and floatformat on an argument with a long run of g or u not at its end. A template that applied one of them to request data could be made to block the event loop. All five now run in linear time with the same output (Django 5.2.18 handles these inputs in linear time). Every swig-django release since 2.7.0 has them, except pluralize, which has had it since 2.8.2.
+
 [2.9.0](https://github.com/gina-io/swig/tree/v2.9.0) / 2026-10-23
 -----------------------------------------------------------------
 

package/README.md

@@ -43,14 +43,17 @@ Features
 * Robust without the bloat — a single runtime dependency ([`@rhinostone/swig-core`](https://www.npmjs.com/package/@rhinostone/swig-core)).
 * Extendable and customizable — register custom filters, tags, and loaders per-instance.
 
-What's new in v2.9.0
+What's new in v2.9.1
 --------------------
 
-> **Behaviour change in `@rhinostone/swig-twig`, `@rhinostone/swig-jinja2` and `@rhinostone/swig-django`.** `x in list` now tests the list's items, not its indices, and `x in "text"` a substring, as Twig, Jinja2 and Django do. In swig-twig, `x in mapping` now tests the mapping's values, as Twig does: write `x in mapping|keys` to test a key. Native `@rhinostone/swig` is unchanged.
+> **Security release: upgrade all five packages to 2.9.1.** `striptags` in every flavor, `trim` in swig-twig and swig-jinja2, swig-jinja2 `format`, and swig-django `truncatewords`, `pluralize`, `slugify` and `floatformat` took time quadratic in the length of their input on some inputs, several seconds for 100 000 characters. A template that applied one of them to request data could be made to block the event loop. They now run in linear time with the same output.
 
-* **Fixed — `in` tests membership in the Twig, Jinja2 and Django frontends.** In swig-jinja2 and swig-django a list holds an equal item, a string a substring and a mapping a key; in swig-twig a list or a mapping holds a value, compared loosely, and a string holds a string or number as a substring. Until now `in` was the JavaScript operator, which tests keys: `3 in [1, 2, 3]` was false, `0 in [5]` true, and `"b" in "abc"` threw. A test the reference engine cannot run (a number or null container, for instance) is false instead of an error. Native `@rhinostone/swig` keeps the JavaScript `in`, which tests an object's keys or an array's indices.
-* **Added — `not in` in the Twig, Jinja2 and Django frontends.** `x not in y` negates `x in y` and binds at the same level. Where Django cannot run the test it is false, as in Django; where Jinja2 raises, swig gives true. Until now `x not in y` failed to parse. Native `@rhinostone/swig` still rejects `not in`.
-* **Added — an OpenSSF Scorecard badge** at the top of the README of each of the five packages. It shows the score that a Scorecard workflow publishes for the repository on every push to develop and every week, and links to the Scorecard report. Documentation only; no runtime or API change.
+* **Security — swig `striptags` runs in linear time.** On text with many `<` and no `>` after them it ran for about five seconds per 100 000 characters. The regex dates from the original project, so every earlier release has it.
+* **Security — swig-twig `striptags` and `trim` run in linear time.** `striptags` was slow on text with many `<` and no `>` after them, and `trim` on a long run of the trimmed characters inside the text. Every swig-twig release since 2.0.0-alpha.3 has them.
+* **Security — swig-jinja2 `striptags`, `trim` and `format` run in linear time.** `striptags` was slow on text with many `<` or `<!--` and nothing closing them, `trim` on a long run of the trimmed characters inside the text, and `format` slower still on a `%` followed by a long run of zeros. Every swig-jinja2 release since 2.5.0 has them.
+* **Security — swig-django `striptags`, `truncatewords`, `pluralize`, `slugify` and `floatformat` run in linear time.** `striptags` was slow on text with many `<` and no `>` after them, `truncatewords` and `pluralize` on a long run of whitespace inside the value, `slugify` on a long run of underscores, and `floatformat` on an argument with a long run of `g` or `u` not at its end. Every swig-django release since 2.7.0 has them, except `pluralize`, which has had it since 2.8.2.
+* **Fixed — the Express example no longer has its catch-all route.** The route rendered any `.html` file a URL named as a template, including files outside the views folder. The example is not part of any package; an application built from it should remove or confine that route.
+* **Changed — property-based tests.** The test suite checks properties on many generated inputs, with the new fast-check dev dependency under a fixed seed. Development and CI only; the only runtime dependency remains `@rhinostone/swig-core`.
 
 See the full [HISTORY.md](./HISTORY.md) and [ROADMAP.md](./ROADMAP.md).
 

package/ROADMAP.md

@@ -28,6 +28,12 @@ For bug reports and feature requests, file an issue at [gina-io/swig](https://gi
 
 ## Completed
 
+### v2.9.1 (October 2026)
+
+- Security: `striptags` in every flavor, `trim` in swig-twig and swig-jinja2, swig-jinja2 `format`, and swig-django `truncatewords`, `pluralize`, `slugify` and `floatformat` run in linear time with the same output. Their regexes took time quadratic in the input length on some inputs, so a template that applied one of them to request data could be made to block the event loop.
+- The Express example no longer has its catch-all route, which rendered any `.html` file a URL named as a template.
+- All five packages released in lockstep at `2.9.1`.
+
 ### v2.9.0 (October 2026)
 
 - `in` tests membership in swig-twig, swig-jinja2 and swig-django, as Twig, Jinja2 and Django do: a list holds an item, a string a substring, and a mapping a key (Jinja2, Django) or a value (Twig). Native swig keeps the JavaScript `in`, which tests an object's keys or an array's indices.

package/dist/swig.js

@@ -1,4 +1,4 @@
-/*! Swig v2.9.0 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
+/*! Swig v2.9.1 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
 /*! DateZ (c) 2011 Tomo Universalis | @license https://github.com/tn0ms/DateZ/blob/master/LISENCE */
 (() => {
   var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -22,8 +22,52 @@
     "packages/swig-core/lib/utils.js"(exports) {
       var security = require_security();
       var isArray;
+      var whitespace = /\s/;
       exports.strip = function(input) {
-        return input.replace(/^\s+|\s+$/g, "");
+        return exports.trimEnd(input.replace(/^\s+/, ""));
+      };
+      exports.trimEnd = function(input, chars) {
+        var end = input.length;
+        if (chars === void 0) {
+          while (end > 0 && whitespace.test(input.charAt(end - 1))) {
+            end -= 1;
+          }
+        } else {
+          while (end > 0 && chars.indexOf(input.charAt(end - 1)) !== -1) {
+            end -= 1;
+          }
+        }
+        return input.slice(0, end);
+      };
+      exports.stripTags = function(input, allowEmpty) {
+        var out = "", from = 0, lt = input.indexOf("<"), gt;
+        while (lt !== -1) {
+          gt = input.indexOf(">", lt + 1);
+          if (gt === -1) {
+            break;
+          }
+          if (gt === lt + 1 && !allowEmpty) {
+            lt = input.indexOf("<", lt + 1);
+            continue;
+          }
+          out += input.slice(from, lt);
+          from = gt + 1;
+          lt = input.indexOf("<", from);
+        }
+        return out + input.slice(from);
+      };
+      exports.stripComments = function(input) {
+        var out = "", from = 0, open = input.indexOf("<!--"), close;
+        while (open !== -1) {
+          close = input.indexOf("-->", open + 4);
+          if (close === -1) {
+            break;
+          }
+          out += input.slice(from, open);
+          from = close + 3;
+          open = input.indexOf("<!--", from);
+        }
+        return out + input.slice(from);
       };
       exports.startsWith = function(str, prefix) {
         return str.indexOf(prefix) === 0;
@@ -1183,7 +1227,7 @@
         if (out !== void 0) {
           return out;
         }
-        return input.toString().replace(/(<([^>]+)>)/ig, "");
+        return utils.stripTags(input.toString());
       };
       exports.title = function(input) {
         var out = iterateFilter.apply(exports.title, arguments);
@@ -4894,7 +4938,7 @@
       var loaders = require_loaders2();
       var preWalker = require_pre_walker();
       var engine = require_engine();
-      exports.version = "2.9.0";
+      exports.version = "2.9.1";
       var defaultOptions = {
         autoescape: true,
         varControls: ["{{", "}}"],
@@ -5120,6 +5164,10 @@
     window.swig = swig;
   }
 })();
+/*!
+ * What a \s regex atom matches, tested one code unit at a time.
+ * @private
+ */
 /*!
  * Resolve a single path segment against a value, Django-style. A plain
  * property access (`obj[seg]`) covers dictionary, attribute, and array /