@sap/cds-dk 10.1.2 → 10.2.0

package/node_modules/handlebars/lib/handlebars/compiler/code-gen.js

@@ -1,6 +1,61 @@
 /* global define, require */
 import { isArray } from '../utils';
 
+// Matches any character that quotedString may have to escape: quotes,
+// backslashes, control characters, line separators, surrogates and "<". Most
+// strings, e.g. lookup names, contain none of them and can skip the escaping.
+// eslint-disable-next-line no-control-regex
+const NEEDS_ESCAPING = /[\x00-\x1f\\"\u2028\u2029<\ud800-\udfff]/;
+
+// Per HTML "Restrictions for contents of script elements": "<!--", "<script"
+// and "</script" can end or change the parsing of an enclosing <script>
+// element.
+const SCRIPT_DELIMITERS = /<(?=!--|\/?script)/gi;
+
+/**
+ * Escape the "<" of every sequence that could end or change the parsing of
+ * an enclosing <script> element.
+ *
+ * Only pass JavaScript or JSON code in which "<" can only occur inside string
+ * literals, where "\u003C" has the same value.
+ *
+ * @param {string} code the code to escape
+ * @returns {string} the escaped code
+ */
+function escapeScriptDelimiters(code) {
+  return code.replace(SCRIPT_DELIMITERS, '\\u003C');
+}
+
+/**
+ * Escape a UTF-16 surrogate code unit as a "\uXXXX" escape sequence.
+ *
+ * @param {string} surrogate a single surrogate code unit
+ * @returns {string} the escape sequence
+ */
+function escapeSurrogate(surrogate) {
+  return '\\u' + surrogate.charCodeAt(0).toString(16);
+}
+
+/**
+ * Convert a value to a JSON literal that is safe to write into generated
+ * code: valid in ES5, where line and paragraph separators end string literals,
+ * encodable as UTF-8 on every engine, and safe inside an enclosing <script>
+ * element.
+ *
+ * @param {*} value the value to convert
+ * @returns {string} the JavaScript literal
+ */
+export function safeJsonLiteral(value) {
+  return escapeScriptDelimiters(
+    JSON.stringify(value)
+      .replace(/\u2028/g, '\\u2028')
+      .replace(/\u2029/g, '\\u2029')
+      // Engines before ES2019 leave lone surrogates unescaped, and those cannot
+      // be encoded as UTF-8. Escaping paired ones as well keeps the value.
+      .replace(/[\ud800-\udfff]/g, escapeSurrogate)
+  );
+}
+
 let SourceNode;
 
 try {
@@ -116,17 +171,16 @@ CodeGen.prototype = {
   },
 
   quotedString: function(str) {
-    return (
-      '"' +
-      (str + '')
-        .replace(/\\/g, '\\\\')
-        .replace(/"/g, '\\"')
-        .replace(/\n/g, '\\n')
-        .replace(/\r/g, '\\r')
-        .replace(/\u2028/g, '\\u2028') // Per Ecma-262 7.3 + 7.8.4
-        .replace(/\u2029/g, '\\u2029') +
-      '"'
-    );
+    str = str + '';
+    // Fast path: quotedString runs for every lookup name and content string,
+    // and the chain of replacements below is much slower than a single test.
+    if (!NEEDS_ESCAPING.test(str)) {
+      return '"' + str + '"';
+    }
+
+    // JSON.stringify escapes quotes, backslashes and control characters;
+    // safeJsonLiteral adds line separators, surrogates and script delimiters.
+    return safeJsonLiteral(str);
   },
 
   objectLiteral: function(obj) {

package/node_modules/handlebars/lib/handlebars/compiler/compiler.js

@@ -3,6 +3,7 @@
 import Exception from '../exception';
 import { isArray, indexOf, extend } from '../utils';
 import AST from './ast';
+import { NODE_TYPES } from './node-types';
 
 const slice = [].slice;
 
@@ -89,8 +90,8 @@ Compiler.prototype = {
   },
 
   accept: function(node) {
-    /* istanbul ignore next: Sanity code */
-    if (!this[node.type]) {
+    // Dispatching on an unknown type could call an arbitrary Compiler method.
+    if (indexOf(NODE_TYPES, node.type) === -1 || !this[node.type]) {
       throw new Exception('Unknown type: ' + node.type, node);
     }
 
@@ -101,6 +102,7 @@ Compiler.prototype = {
   },
 
   Program: function(program) {
+    validateBlockParams(program);
     this.options.blockParams.unshift(program.blockParams);
 
     let body = program.body,
@@ -219,6 +221,9 @@ Compiler.prototype = {
   },
 
   ContentStatement: function(content) {
+    if (content.value != null && typeof content.value !== 'string') {
+      throw invalidAst(content, 'value must be a string');
+    }
     if (content.value) {
       this.opcode('appendContent', content.value);
     }
@@ -243,7 +248,7 @@ Compiler.prototype = {
       name = path.parts[0],
       isBlock = program != null || inverse != null;
 
-    this.opcode('getContext', path.depth);
+    this.opcode('getContext', validateDepth(path));
 
     this.opcode('pushProgram', program);
     this.opcode('pushProgram', inverse);
@@ -288,41 +293,43 @@ Compiler.prototype = {
   },
 
   PathExpression: function(path) {
-    this.addDepth(path.depth);
-    this.opcode('getContext', path.depth);
+    // Validate AST values at the compiler boundary: javascript-compiler.js
+    // trusts all opcode arguments to be safe.
+    const depth = validateDepth(path);
+    const parts = validateParts(path);
+
+    this.addDepth(depth);
+    this.opcode('getContext', depth);
 
-    let name = path.parts[0],
+    let name = parts[0],
       scoped = AST.helpers.scopedId(path),
-      blockParamId = !path.depth && !scoped && this.blockParamIndex(name);
+      blockParamId = !depth && !scoped && this.blockParamIndex(name);
 
     if (blockParamId) {
-      this.opcode('lookupBlockParam', blockParamId, path.parts);
+      this.opcode('lookupBlockParam', blockParamId, parts);
     } else if (!name) {
       // Context reference, i.e. `{{foo .}}` or `{{foo ..}}`
       this.opcode('pushContext');
     } else if (path.data) {
       this.options.data = true;
-      this.opcode('lookupData', path.depth, path.parts, path.strict);
+      this.opcode('lookupData', depth, parts, path.strict);
     } else {
-      this.opcode(
-        'lookupOnContext',
-        path.parts,
-        path.falsy,
-        path.strict,
-        scoped
-      );
+      this.opcode('lookupOnContext', parts, path.falsy, path.strict, scoped);
     }
   },
 
   StringLiteral: function(string) {
+    validateLiteral(string);
     this.opcode('pushString', string.value);
   },
 
   NumberLiteral: function(number) {
+    validateLiteral(number);
     this.opcode('pushLiteral', number.value);
   },
 
   BooleanLiteral: function(bool) {
+    validateLiteral(bool);
     this.opcode('pushLiteral', bool.value);
   },
 
@@ -337,7 +344,17 @@ Compiler.prototype = {
   Hash: function(hash) {
     let pairs = hash.pairs,
       i = 0,
-      l = pairs.length;
+      l;
+
+    if (!isArray(pairs)) {
+      throw invalidAst(hash, 'pairs must be an array');
+    }
+    l = pairs.length;
+    for (let j = 0; j < l; j++) {
+      if (!pairs[j] || typeof pairs[j].key !== 'string') {
+        throw invalidAst(hash, 'pair keys must be strings');
+      }
+    }
 
     this.opcode('pushHash');
 
@@ -368,6 +385,9 @@ Compiler.prototype = {
   },
 
   classifySexpr: function(sexpr) {
+    // The first part is used as a helper name below, e.g. for known helpers,
+    // before the PathExpression handler gets to validate the parts.
+    validateParts(sexpr.path);
     let isSimple = AST.helpers.simpleId(sexpr.path);
 
     let isBlockParam = isSimple && !!this.blockParamIndex(sexpr.path.parts[0]);
@@ -409,17 +429,26 @@ Compiler.prototype = {
   },
 
   pushParam: function(val) {
+    // Literal params are not visited by their node handlers in stringParams
+    // mode, so their values must be validated here as well.
+    validateLiteral(val);
     let value = val.value != null ? val.value : val.original || '';
+    let depth = validateDepth(val);
 
     if (this.stringParams) {
+      // pushStringParam emits non-string values as raw JavaScript literals.
+      // Literal values are validated above, but `original` is not, so
+      // anything that is not a number or boolean is stringified.
+      if (typeof value !== 'number' && typeof value !== 'boolean') {
+        value = String(value);
+      }
       if (value.replace) {
         value = value.replace(/^(\.?\.\/)*/g, '').replace(/\//g, '.');
       }
-
-      if (val.depth) {
-        this.addDepth(val.depth);
+      if (depth) {
+        this.addDepth(depth);
       }
-      this.opcode('getContext', val.depth || 0);
+      this.opcode('getContext', depth);
       this.opcode('pushStringParam', value, val.type);
 
       if (val.type === 'SubExpression') {
@@ -430,8 +459,10 @@ Compiler.prototype = {
     } else {
       if (this.trackIds) {
         let blockParamIndex;
-        if (val.parts && !AST.helpers.scopedId(val) && !val.depth) {
-          blockParamIndex = this.blockParamIndex(val.parts[0]);
+        if (val.parts && !AST.helpers.scopedId(val) && !depth) {
+          // The parts are read here before the PathExpression handler,
+          // invoked by accept() below, gets to validate them.
+          blockParamIndex = this.blockParamIndex(validateParts(val)[0]);
         }
         if (blockParamIndex) {
           let blockParamChild = val.parts.slice(1).join('.');
@@ -562,6 +593,116 @@ export function compile(input, options = {}, env) {
   return ret;
 }
 
+/**
+ * Create the exception thrown for an AST node that fails validation.
+ *
+ * @param {Object} node the offending AST node; its `type` is included in the
+ *   message and its `loc`, if present, in the error location
+ * @param {string} message what is wrong with the node
+ * @returns {Exception} the exception to throw
+ */
+function invalidAst(node, message) {
+  return new Exception('Invalid AST: ' + node.type + ' ' + message, node);
+}
+
+/**
+ * Validate the `depth` of a path or param node.
+ *
+ * A missing depth is treated as 0, because ASTs built by hand or by other
+ * tools commonly omit it. Any depth that is present must be a non-negative
+ * integer, since it is written into the generated code.
+ *
+ * @param {Object} node the AST node whose `depth` is validated
+ * @returns {number} the validated depth, or 0 if the node has none
+ * @throws {Exception} if the depth is present but not a non-negative integer
+ */
+function validateDepth(node) {
+  let depth = node.depth;
+  if (depth == null) {
+    return 0;
+  }
+  if (
+    typeof depth !== 'number' ||
+    !isFinite(depth) ||
+    Math.floor(depth) !== depth ||
+    depth < 0
+  ) {
+    throw invalidAst(node, 'depth must be a non-negative integer');
+  }
+  return depth;
+}
+
+/**
+ * Validate the `value` of a StringLiteral, NumberLiteral or BooleanLiteral.
+ *
+ * Literal values are written into the generated code, so they must have
+ * exactly the type their node promises. Nodes of any other type pass through
+ * unchanged.
+ *
+ * Numbers need not be finite: the parser produces Infinity for very long
+ * number literals, and Infinity and NaN are emitted as the read-only globals
+ * of the same name.
+ *
+ * @param {Object} node the AST node to validate
+ * @throws {Exception} if the value does not match the literal type
+ */
+function validateLiteral(node) {
+  let value = node.value;
+  if (node.type === 'StringLiteral' && typeof value !== 'string') {
+    throw invalidAst(node, 'value must be a string');
+  } else if (node.type === 'NumberLiteral' && typeof value !== 'number') {
+    throw invalidAst(node, 'value must be a number');
+  } else if (node.type === 'BooleanLiteral' && typeof value !== 'boolean') {
+    throw invalidAst(node, 'value must be a boolean');
+  }
+}
+
+/**
+ * Validate that a node property is an array containing only strings.
+ *
+ * @param {Object} node the AST node the property belongs to, for the error
+ * @param {*} value the property value to validate
+ * @param {string} name the property name, used in the error message
+ * @returns {string[]} the validated array
+ * @throws {Exception} if the value is not an array or contains non-strings
+ */
+function validateStringArray(node, value, name) {
+  if (!isArray(value)) {
+    throw invalidAst(node, name + ' must be an array');
+  }
+  for (let i = 0; i < value.length; i++) {
+    if (typeof value[i] !== 'string') {
+      throw invalidAst(node, name + ' must only contain strings');
+    }
+  }
+  return value;
+}
+
+/**
+ * Validate the `parts` of a PathExpression node.
+ *
+ * @param {Object} path the PathExpression node
+ * @returns {string[]} the validated parts
+ * @throws {Exception} if `parts` is not an array of strings
+ */
+function validateParts(path) {
+  return validateStringArray(path, path.parts, 'parts');
+}
+
+/**
+ * Validate the optional `blockParams` of a Program node. Its length is
+ * written into the generated code, so it must be an array of strings when
+ * present.
+ *
+ * @param {Object} program the Program node
+ * @throws {Exception} if `blockParams` is present and not an array of strings
+ */
+function validateBlockParams(program) {
+  if (program.blockParams != null) {
+    validateStringArray(program, program.blockParams, 'blockParams');
+  }
+}
+
 function argEquals(a, b) {
   if (a === b) {
     return true;

package/node_modules/handlebars/lib/handlebars/compiler/javascript-compiler.js

@@ -1,7 +1,7 @@
 import { COMPILER_REVISION, REVISION_CHANGES } from '../base';
 import Exception from '../exception';
 import { isArray } from '../utils';
-import CodeGen from './code-gen';
+import CodeGen, { safeJsonLiteral } from './code-gen';
 
 function Literal(value) {
   this.value = value;
@@ -19,7 +19,7 @@ JavaScriptCompiler.prototype = {
     return [
       this.aliasable('container.lookup'),
       '(depths, ',
-      JSON.stringify(name),
+      this.quotedString(name),
       ')'
     ];
   },
@@ -56,7 +56,7 @@ JavaScriptCompiler.prototype = {
   // END PUBLIC API
   internalNameLookup: function(parent, name) {
     this.lookupPropertyFunctionIsUsed = true;
-    return ['lookupProperty(', parent, ',', JSON.stringify(name), ')'];
+    return ['lookupProperty(', parent, ',', this.quotedString(name), ')'];
   },
 
   lookupPropertyFunctionIsUsed: false,
@@ -832,7 +832,7 @@ JavaScriptCompiler.prototype = {
     }
 
     if (indent) {
-      options.indent = JSON.stringify(indent);
+      options.indent = this.quotedString(indent);
     }
     options.helpers = 'helpers';
     options.partials = 'partials';
@@ -894,7 +894,7 @@ JavaScriptCompiler.prototype = {
           '].path[' +
           name[1] +
           ']' +
-          (child ? ' + ' + JSON.stringify('.' + child) : '')
+          (child ? ' + ' + this.quotedString('.' + child) : '')
       );
     } else if (type === 'PathExpression') {
       this.pushString(name);
@@ -1224,7 +1224,7 @@ JavaScriptCompiler.prototype = {
 
   setupHelperArgs: function(helper, paramSize, params, useRegister) {
     let options = this.setupParams(helper, paramSize, params);
-    options.loc = JSON.stringify(this.source.currentLocation);
+    options.loc = locationLiteral(this);
     options = this.objectLiteral(options);
     if (useRegister) {
       this.useRegister('options');
@@ -1276,6 +1276,22 @@ JavaScriptCompiler.isValidJavaScriptVariableName = function(name) {
   );
 };
 
+/**
+ * The compiler's current source location as a JavaScript literal.
+ *
+ * Hand-built ASTs may omit `loc`; emitting the literal `undefined` then
+ * keeps the generated code valid and drops the key from object literals.
+ * The location's `source` is the `srcName` option, so it is escaped like
+ * every other string in the generated code.
+ *
+ * @param {JavaScriptCompiler} compiler the compiler whose location is emitted
+ * @returns {string} a JSON object literal, or the string "undefined"
+ */
+function locationLiteral(compiler) {
+  let loc = compiler.source.currentLocation;
+  return loc ? safeJsonLiteral(loc) : 'undefined';
+}
+
 function strictLookup(requireTerminal, compiler, parts, startPartIndex, type) {
   let stack = compiler.popStack(),
     len = parts.length;
@@ -1295,7 +1311,7 @@ function strictLookup(requireTerminal, compiler, parts, startPartIndex, type) {
       ', ',
       compiler.quotedString(parts[len]),
       ', ',
-      JSON.stringify(compiler.source.currentLocation),
+      locationLiteral(compiler),
       ' )'
     ];
   } else {

package/node_modules/handlebars/lib/handlebars/compiler/node-types.js

@@ -0,0 +1,24 @@
+// AST node types produced by the parser. Visitor#accept and Compiler#accept
+// dispatch on the untrusted `node.type`, so they must never call any other
+// method of the visiting object. The Compiler only accepts these types; a
+// Visitor also accepts types for which a subclass defines its own handler.
+export const NODE_TYPES = [
+  'Program',
+  'BlockStatement',
+  'DecoratorBlock',
+  'PartialStatement',
+  'PartialBlockStatement',
+  'Decorator',
+  'MustacheStatement',
+  'ContentStatement',
+  'CommentStatement',
+  'SubExpression',
+  'PathExpression',
+  'StringLiteral',
+  'NumberLiteral',
+  'BooleanLiteral',
+  'UndefinedLiteral',
+  'NullLiteral',
+  'Hash',
+  'HashPair'
+];

package/node_modules/handlebars/lib/handlebars/compiler/visitor.js

@@ -1,9 +1,34 @@
 import Exception from '../exception';
+import { indexOf } from '../utils';
+import { NODE_TYPES } from './node-types';
 
 function Visitor() {
   this.parents = [];
 }
 
+/**
+ * Whether a visitor may dispatch on a node type.
+ *
+ * A type is dispatchable if the parser produces it, or if the visitor
+ * (typically a subclass) defines a handler for it that is not a method of
+ * Visitor itself. `in` is used for the latter so that accept, acceptKey and
+ * everything inherited from Object.prototype (constructor, __proto__, ...)
+ * can never be reached through a crafted `type`.
+ *
+ * Subclasses that visit untrusted ASTs, such as WhitespaceControl, must
+ * therefore define nothing but node handlers as function properties.
+ *
+ * @param {Visitor} visitor the visitor that would handle the node
+ * @param {*} type the untrusted `type` of the node
+ * @returns {boolean} true if the visitor may call its `type` method
+ */
+function isDispatchable(visitor, type) {
+  return (
+    indexOf(NODE_TYPES, type) !== -1 ||
+    (!(type in Visitor.prototype) && typeof visitor[type] === 'function')
+  );
+}
+
 Visitor.prototype = {
   constructor: Visitor,
   mutating: false,
@@ -12,9 +37,7 @@ Visitor.prototype = {
   acceptKey: function(node, name) {
     let value = this.accept(node[name]);
     if (this.mutating) {
-      // Hacky sanity check: This may have a few false positives for type for the helper
-      // methods but will generally do the right thing without a lot of overhead.
-      if (value && !Visitor.prototype[value.type]) {
+      if (value && !isDispatchable(this, value.type)) {
         throw new Exception(
           'Unexpected node type "' +
             value.type +
@@ -57,8 +80,9 @@ Visitor.prototype = {
       return;
     }
 
-    /* istanbul ignore next: Sanity code */
-    if (!this[object.type]) {
+    // Dispatching on an unknown type could call an arbitrary method of the
+    // visitor (e.g. `accept` itself) with an untrusted AST node.
+    if (!isDispatchable(this, object.type) || !this[object.type]) {
       throw new Exception('Unknown type: ' + object.type, object);
     }
 

package/node_modules/handlebars/lib/handlebars/compiler/whitespace-control.js

@@ -41,7 +41,9 @@ WhitespaceControl.prototype.Program = function(program) {
         // If we are on a standalone node, save the indent info for partials
         if (current.type === 'PartialStatement') {
           // Pull out the whitespace from the final line
-          current.indent = /([ \t]+$)/.exec(body[i - 1].original)[1];
+          current.indent = /(?:^|[^ \t])([ \t]+)$/.exec(
+            body[i - 1].original
+          )[1];
         }
       }
     }
@@ -159,9 +161,12 @@ function isPrevWhitespace(body, i, isRoot) {
   }
 
   if (prev.type === 'ContentStatement') {
-    return (sibling || !isRoot ? /\r?\n\s*?$/ : /(^|\r?\n)\s*?$/).test(
-      prev.original
-    );
+    // Matches when the trailing whitespace contains a newline (or, for the
+    // root's first node, is the whole string). See omitLeft for the anchoring.
+    return (sibling || !isRoot
+      ? /(?:^|\S)[^\S\n]*\n\s*$/
+      : /^\s*$|(?:^|\S)[^\S\n]*\n\s*$/
+    ).test(prev.original);
   }
 }
 function isNextWhitespace(body, i, isRoot) {
@@ -226,7 +231,13 @@ function omitLeft(body, i, multiple) {
 
   // We omit the last node if it's whitespace only and not preceded by a non-content node.
   let original = current.value;
-  current.value = current.value.replace(multiple ? /\s+$/ : /[ \t]+$/, '');
+  // The match must start after a non-whitespace character (or at the start):
+  // a plain /\s+$/ is retried at every position of a whitespace run, which
+  // takes quadratic time on long runs.
+  current.value = current.value.replace(
+    multiple ? /(^|\S)\s+$/ : /(^|[^ \t])[ \t]+$/,
+    '$1'
+  );
   current.leftStripped = current.value !== original;
   return current.leftStripped;
 }

package/node_modules/handlebars/lib/handlebars/exception.js

@@ -16,11 +16,15 @@ function Exception(message, node) {
     column,
     endColumn;
 
-  if (loc) {
+  // Hand-built ASTs may carry a partial loc; never let the location
+  // bookkeeping mask the actual error message.
+  if (loc && loc.start) {
     line = loc.start.line;
-    endLineNumber = loc.end.line;
     column = loc.start.column;
-    endColumn = loc.end.column;
+    if (loc.end) {
+      endLineNumber = loc.end.line;
+      endColumn = loc.end.column;
+    }
 
     message += ' - ' + line + ':' + column;
   }