@vituum/vite-plugin-latte 2.0.0-next.4 → 2.0.0

package/vendor/latte/latte/src/Latte/Runtime/FilterInfo.php

@@ -1,34 +1,34 @@
-<?php
+<?php declare(strict_types=1);
 
 /**
  * This file is part of the Latte (https://latte.nette.org)
  * Copyright (c) 2008 David Grudl (https://davidgrudl.com)
  */
 
-declare(strict_types=1);
-
 namespace Latte\Runtime;
 
 use Latte;
+use function in_array, strtoupper;
 
 
 /**
- * Filter runtime info
+ * Content type context for contextual filters.
  */
 class FilterInfo
 {
-	public ?string $contentType = null;
-
-
-	public function __construct(?string $contentType = null)
-	{
-		$this->contentType = $contentType;
+	public function __construct(
+		public ?string $contentType = null,
+	) {
 	}
 
 
+	/**
+	 * Validates content type is allowed for this filter.
+	 * @param  list<string|null>  $contentTypes
+	 */
 	public function validate(array $contentTypes, ?string $name = null): void
 	{
-		if (!in_array($this->contentType, $contentTypes, true)) {
+		if (!in_array($this->contentType, $contentTypes, strict: true)) {
 			$name = $name ? " |$name" : $name;
 			$type = $this->contentType ? ' ' . strtoupper($this->contentType) : '';
 			throw new Latte\RuntimeException("Filter{$name} used with incompatible type{$type}.");

package/vendor/latte/latte/src/Latte/Runtime/FunctionExecutor.php

@@ -1,15 +1,14 @@
-<?php
+<?php declare(strict_types=1);
 
 /**
  * This file is part of the Latte (https://latte.nette.org)
  * Copyright (c) 2008 David Grudl (https://davidgrudl.com)
  */
 
-declare(strict_types=1);
-
 namespace Latte\Runtime;
 
 use Latte\Helpers;
+use function array_keys;
 
 
 /**
@@ -19,10 +18,10 @@ use Latte\Helpers;
 #[\AllowDynamicProperties]
 class FunctionExecutor
 {
-	/** @var callable[] */
+	/** @var array<string, callable> */
 	private array $_list = [];
 
-	/** @var bool[] */
+	/** @var array<string, bool> */
 	private array $_aware = [];
 
 
@@ -39,7 +38,7 @@ class FunctionExecutor
 
 	/**
 	 * Returns all run-time functions.
-	 * @return callable[]
+	 * @return array<string, callable>
 	 */
 	public function getAll(): array
 	{

package/vendor/latte/latte/src/Latte/Runtime/Helpers.php

@@ -0,0 +1,91 @@
+<?php declare(strict_types=1);
+
+/**
+ * This file is part of the Latte (https://latte.nette.org)
+ * Copyright (c) 2008 David Grudl (https://davidgrudl.com)
+ */
+
+namespace Latte\Runtime;
+
+use Latte;
+use Latte\ContentType;
+use Latte\RuntimeException;
+use Nette;
+use function addcslashes, is_string, json_encode, preg_replace, str_replace, strtoupper;
+use const JSON_INVALID_UTF8_SUBSTITUTE, JSON_THROW_ON_ERROR, JSON_UNESCAPED_SLASHES, JSON_UNESCAPED_UNICODE;
+
+
+/**
+ * Template runtime helpers.
+ * @internal
+ */
+class Helpers
+{
+	/**
+	 * Ensures the value is a string or returns null.
+	 * @return ($value is string ? string : null)
+	 */
+	public static function stringOrNull(mixed $value): ?string
+	{
+		return is_string($value) ? $value : null;
+	}
+
+
+	/**
+	 * Escapes string for use inside CSS template.
+	 */
+	public static function escapeCss(mixed $s): string
+	{
+		// http://www.w3.org/TR/2006/WD-CSS21-20060411/syndata.html#q6
+		return addcslashes((string) $s, "\x00..\x1F!\"#$%&'()*+,./:;<=>?@[\\]^`{|}~");
+	}
+
+
+	/**
+	 * Escapes variables for use inside <script>.
+	 */
+	public static function escapeJs(mixed $s): string
+	{
+		if ($s instanceof HtmlStringable || $s instanceof Nette\HtmlStringable) {
+			$s = $s->__toString();
+		}
+
+		$json = json_encode($s, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE | JSON_THROW_ON_ERROR);
+		return str_replace([']]>', '<!', '</'], [']]\u003E', '\u003C!', '<\/'], $json);
+	}
+
+
+	/**
+	 * Escapes string for use inside iCal template.
+	 */
+	public static function escapeICal(mixed $s): string
+	{
+		// https://www.ietf.org/rfc/rfc5545.txt
+		$s = str_replace("\r", '', (string) $s);
+		$s = preg_replace('#[\x00-\x08\x0B-\x1F]#', "\u{FFFD}", (string) $s);
+		return addcslashes($s, "\";\\,:\n");
+	}
+
+
+	/**
+	 * Converts content between content types.
+	 */
+	public static function convertTo(FilterInfo $info, string $dest, string $s): string
+	{
+		$source = $info->contentType ?: ContentType::Text;
+		if ($source === $dest) {
+			return $s;
+		} elseif ($conv = Latte\Compiler\Escaper::getConvertor($source, $dest)) {
+			$info->contentType = $dest;
+			return $conv($s);
+		} else {
+			throw new RuntimeException('Filters: unable to convert content type ' . strtoupper($source) . ' to ' . strtoupper($dest));
+		}
+	}
+
+
+	public static function nop(mixed $s): string
+	{
+		return (string) $s;
+	}
+}

package/vendor/latte/latte/src/Latte/Runtime/Html.php

@@ -1,12 +1,10 @@
-<?php
+<?php declare(strict_types=1);
 
 /**
  * This file is part of the Latte (https://latte.nette.org)
  * Copyright (c) 2008 David Grudl (https://davidgrudl.com)
  */
 
-declare(strict_types=1);
-
 namespace Latte\Runtime;
 
 
@@ -15,10 +13,10 @@ namespace Latte\Runtime;
  */
 class Html implements HtmlStringable
 {
-	private string $value;
+	private readonly string $value;
 
 
-	public function __construct($value)
+	public function __construct(string|\Stringable|null $value)
 	{
 		$this->value = (string) $value;
 	}

package/vendor/latte/latte/src/Latte/Runtime/HtmlHelpers.php

@@ -0,0 +1,374 @@
+<?php declare(strict_types=1);
+
+/**
+ * This file is part of the Latte (https://latte.nette.org)
+ * Copyright (c) 2008 David Grudl (https://davidgrudl.com)
+ */
+
+namespace Latte\Runtime;
+
+use Latte;
+use Latte\ContentType;
+use Nette;
+use function get_debug_type, html_entity_decode, htmlspecialchars, in_array, is_array, is_bool, is_float, is_int, is_string, ord, preg_match, preg_replace, preg_replace_callback, str_replace, strip_tags, strtolower, strtr;
+use const ENT_HTML5, ENT_NOQUOTES, ENT_QUOTES, ENT_SUBSTITUTE, JSON_INVALID_UTF8_SUBSTITUTE, JSON_THROW_ON_ERROR, JSON_UNESCAPED_SLASHES, JSON_UNESCAPED_UNICODE;
+
+
+/**
+ * Runtime utilities for handling HTML.
+ * @internal
+ */
+final class HtmlHelpers
+{
+	private const BooleanAttributes = [
+		'allowfullscreen' => 1, 'async' => 1, 'autofocus' => 1, 'autoplay' => 1, 'checked' => 1, 'controls' => 1,
+		'contenteditable' => 1, 'default' => 1, 'defer' => 1, 'disabled' => 1, 'draggable' => 1, 'formnovalidate' => 1,
+		'hidden' => 1, 'inert' => 1, 'ismap' => 1, 'itemscope' => 1, 'loop' => 1, 'multiple' => 1, 'muted' => 1,
+		'nomodule' => 1, 'novalidate' => 1, 'open' => 1, 'playsinline' => 1, 'readonly' => 1, 'required' => 1,
+		'reversed' => 1, 'selected' => 1, 'spellcheck' => 1,
+	];
+
+	private const SpaceSeparatedAttributes = [
+		'accesskey' => 1, 'class' => 1, 'headers' => 1, 'itemprop' => 1, 'ping' => 1, 'rel' => 1, 'role' => 1, 'sandbox' => 1,
+	];
+
+
+	/**
+	 * Escapes string for use inside HTML text.
+	 */
+	public static function escapeText(mixed $s): string
+	{
+		if ($s instanceof HtmlStringable || $s instanceof Nette\HtmlStringable) {
+			return $s->__toString();
+		}
+
+		$s = htmlspecialchars((string) $s, ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8');
+		$s = strtr($s, ['{{' => '{<!-- -->{', '{' => '&#123;']);
+		return $s;
+	}
+
+
+	/**
+	 * Escapes string for use inside HTML attribute value.
+	 */
+	public static function escapeAttr(mixed $s): string
+	{
+		if ($s instanceof HtmlStringable) {
+			$s = self::convertHtmlToText($s->__toString());
+		}
+		$s = (string) $s;
+		$s = htmlspecialchars($s, ENT_QUOTES | ENT_HTML5 | ENT_SUBSTITUTE, 'UTF-8');
+		$s = str_replace('{', '&#123;', $s);
+		return $s;
+	}
+
+
+	/**
+	 * Escapes string for use inside HTML tag.
+	 */
+	public static function escapeTag(mixed $s): string
+	{
+		$s = (string) $s;
+		$s = htmlspecialchars($s, ENT_QUOTES | ENT_HTML5 | ENT_SUBSTITUTE, 'UTF-8');
+		return preg_replace_callback(
+			'#[=/\s]#',
+			fn($m) => '&#' . ord($m[0]) . ';',
+			$s,
+		);
+	}
+
+
+	/**
+	 * Escapes string for use inside HTML/XML comments.
+	 */
+	public static function escapeComment(mixed $s): string
+	{
+		$s = (string) $s;
+		if ($s && ($s[0] === '-' || $s[0] === '>' || $s[0] === '!')) {
+			$s = ' ' . $s;
+		}
+
+		$s = str_replace('--', '- - ', $s);
+		if (str_ends_with($s, '-')) {
+			$s .= ' ';
+		}
+
+		return $s;
+	}
+
+
+	/**
+	 * Escapes HTML for usage in <script type=text/html>
+	 */
+	public static function escapeRawHtml(mixed $s): string
+	{
+		if ($s instanceof HtmlStringable || $s instanceof Nette\HtmlStringable) {
+			return self::convertHtmlToRawText($s->__toString());
+		}
+
+		return htmlspecialchars((string) $s, ENT_QUOTES | ENT_HTML5 | ENT_SUBSTITUTE, 'UTF-8');
+	}
+
+
+	/**
+	 * Escapes only quotes.
+	 */
+	public static function escapeQuotes(mixed $s): string
+	{
+		return strtr((string) $s, ['"' => '&quot;', "'" => '&apos;']);
+	}
+
+
+	/**
+	 * Converts JS and CSS for usage in <script> or <style>
+	 */
+	public static function convertJSToRawText(mixed $s): string
+	{
+		return preg_replace('#</(script|style)#i', '<\/$1', (string) $s);
+	}
+
+
+	/**
+	 * Sanitizes <script> in <script type=text/html>
+	 */
+	public static function convertHtmlToRawText(string $s): string
+	{
+		return preg_replace('#(</?)(script)#i', '$1x-$2', $s);
+	}
+
+
+	/**
+	 * Converts HTML text to quoted attribute.
+	 */
+	public static function convertHtmlToAttr(string $s): string
+	{
+		return self::escapeAttr(self::convertHtmlToText($s));
+	}
+
+
+	/**
+	 * Converts HTML attribute to HTML text. The < > chars need to be escaped.
+	 */
+	public static function convertAttrToHtml(string $s): string
+	{
+		return self::escapeAttr(html_entity_decode($s, ENT_QUOTES | ENT_HTML5, 'UTF-8'));
+	}
+
+
+	/**
+	 * Converts HTML to plain text.
+	 */
+	public static function convertHtmlToText(string $s): string
+	{
+		$s = strip_tags($s);
+		return html_entity_decode($s, ENT_QUOTES | ENT_HTML5, 'UTF-8');
+	}
+
+
+	public static function classifyAttributeType(string $name): string
+	{
+		$name = strtolower($name);
+		return match (true) {
+			isset(self::BooleanAttributes[$name]) => 'bool',
+			isset(self::SpaceSeparatedAttributes[$name]) => 'list',
+			str_starts_with($name, 'data-') => 'data',
+			str_starts_with($name, 'aria-') => 'aria',
+			$name === 'style' => 'style',
+			default => '',
+		};
+	}
+
+
+	/**
+	 * Formats common HTML attribute.
+	 */
+	public static function formatAttribute(string $namePart, mixed $value, bool $migrationWarnings = false): string
+	{
+		if ($migrationWarnings) {
+			if ($value === null) {
+				self::triggerMigrationWarning(trim($namePart), $value);
+			} elseif (is_string($value) && str_starts_with($name = ltrim($namePart), 'on')) {
+				self::triggerMigrationWarning($name, 'string value: previously it was JSON-encoded, now it is rendered as a string');
+			}
+		}
+		return match (true) {
+			is_string($value), is_int($value), is_float($value), $value instanceof \Stringable => $namePart . '="' . self::escapeAttr($value) . '"',
+			$value === null => '',
+			default => self::triggerInvalidValue(trim($namePart), $value),
+		};
+	}
+
+
+	/**
+	 * Formats boolean HTML attribute.
+	 */
+	public static function formatBoolAttribute(string $namePart, mixed $value): string
+	{
+		return $value ? $namePart : '';
+	}
+
+
+	/**
+	 * Formats space separated HTML attribute.
+	 */
+	public static function formatListAttribute(string $namePart, mixed $value): string
+	{
+		return match (true) {
+			is_array($value) => self::formatArrayAttribute($namePart, $value, fn($v, $k) => $v === true ? $k : $v, ' '),
+			default => self::formatAttribute($namePart, $value),
+		};
+	}
+
+
+	/**
+	 * Formats HTML attribute 'style'.
+	 */
+	public static function formatStyleAttribute(string $namePart, mixed $value): string
+	{
+		return match (true) {
+			is_array($value) => self::formatArrayAttribute($namePart, $value, fn($v, $k) => is_string($k) ? $k . ': ' . $v : $v, '; '),
+			default => self::formatAttribute($namePart, $value),
+		};
+	}
+
+
+	/**
+	 * Formats data-* HTML attribute.
+	 */
+	public static function formatDataAttribute(string $namePart, mixed $value, bool $migrationWarnings = false): string
+	{
+		if ($migrationWarnings && (is_bool($value) || $value === null)) {
+			self::triggerMigrationWarning(trim($namePart), $value);
+		}
+		$escape = fn($value) => str_contains($value, '"')
+			? "'" . str_replace(['&', "'"], ['&amp;', '&apos;'], $value) . "'"
+			: '"' . str_replace(['&', '"'], ['&amp;', '&quot;'], $value) . '"';
+		return match (true) {
+			is_bool($value) => $namePart . '="' . ($value ? 'true' : 'false') . '"',
+			is_array($value) || $value instanceof \stdClass => $namePart . '=' . $escape(json_encode($value, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE | JSON_THROW_ON_ERROR)),
+			default => self::formatAttribute($namePart, $value),
+		};
+	}
+
+
+	/**
+	 * Formats aria-* HTML attribute.
+	 */
+	public static function formatAriaAttribute(string $namePart, mixed $value, bool $migrationWarnings = false): string
+	{
+		if ($migrationWarnings && is_bool($value)) {
+			self::triggerMigrationWarning(trim($namePart), $value);
+		}
+		return match (true) {
+			is_bool($value) => $namePart . '="' . ($value ? 'true' : 'false') . '"',
+			is_array($value) => self::formatArrayAttribute($namePart, $value, fn($v, $k) => $v === true ? $k : $v, ' '),
+			default => self::formatAttribute($namePart, $value),
+		};
+	}
+
+
+	/** @param  array<mixed>  $items */
+	private static function formatArrayAttribute(string $namePart, array $items, \Closure $cb, string $separator): string
+	{
+		$res = [];
+		foreach ($items as $k => $v) {
+			if ($v != null) { // intentionally ==, skip nulls & empty string
+				$res[] = $cb($v, $k);
+			}
+		}
+		return $res ? $namePart . '="' . self::escapeAttr(implode($separator, $res)) . '"' : '';
+	}
+
+
+	public static function triggerInvalidValue(string $name, mixed $value): string
+	{
+		$source = Latte\Helpers::guessTemplatePosition();
+		$type = get_debug_type($value);
+		trigger_error("Invalid value for attribute '$name': $type is not allowed" . ($source ? " ($source)" : '.'), E_USER_WARNING);
+		return '';
+	}
+
+
+	public static function triggerMigrationWarning(string $name, mixed $value): void
+	{
+		$source = Latte\Helpers::guessTemplatePosition();
+		$message = match ($value) {
+			null => "value null: previously it rendered as $name=\"\", now the attribute is omitted",
+			true => "value true: previously it rendered as $name=\"1\", now it renders as $name=\"true\"",
+			false => "value false: previously it rendered as $name=\"\", now it renders as $name=\"false\"",
+			default => $value,
+		};
+		trigger_error("Behavior change for attribute '$name' with $message" . ($source ? " ($source)" : '.'), E_USER_WARNING);
+	}
+
+
+	/**
+	 * Checks if the given tag name represents a void (empty) HTML element.
+	 */
+	public static function isVoidElement(string $name): bool
+	{
+		static $names = [
+			'img' => 1, 'hr' => 1, 'br' => 1, 'input' => 1, 'meta' => 1, 'area' => 1, 'embed' => 1, 'keygen' => 1, 'source' => 1, 'base' => 1,
+			'col' => 1, 'link' => 1, 'param' => 1, 'basefont' => 1, 'frame' => 1, 'isindex' => 1, 'wbr' => 1, 'command' => 1, 'track' => 1,
+		];
+		return isset($names[strtolower($name)]);
+	}
+
+
+	/**
+	 * Determines if the given HTML attribute is a URL attribute that requires special handling.
+	 */
+	public static function isUrlAttribute(string $tag, string $attr): bool
+	{
+		$attr = strtolower($attr);
+		return in_array($attr, ['href', 'src', 'action', 'formaction'], strict: true)
+			|| ($attr === 'data' && strtolower($tag) === 'object');
+	}
+
+
+	/**
+	 * Classifies script content type based on the MIME type.
+	 */
+	public static function classifyScriptType(string $type): string
+	{
+		if (preg_match('#((application|text)/(((x-)?java|ecma|j|live)script|json)|application/.+\+json|text/plain|module|importmap|)$#Ai', $type)) {
+			return ContentType::JavaScript;
+
+		} elseif (preg_match('#text/((x-)?template|html)$#Ai', $type)) {
+			return ContentType::Html;
+		}
+
+		return ContentType::Text;
+	}
+
+
+	/**
+	 * Checks that the HTML tag name can be changed.
+	 */
+	public static function validateTagChange(mixed $name, ?string $origName = null): string
+	{
+		$name ??= $origName;
+		if (!is_string($name)) {
+			throw new Latte\RuntimeException('Tag name must be string, ' . get_debug_type($name) . ' given');
+
+		} elseif (!preg_match('~' . Latte\Compiler\TemplateLexer::ReTagName . '$~DAu', $name)) {
+			throw new Latte\RuntimeException("Invalid tag name '$name'");
+
+		} elseif (self::isVoidElement($name) !== self::isVoidElement($origName ?? 'div') // non-void is default
+			|| in_array(strtolower($name), ['style', 'script'], strict: true)) {
+			throw new Latte\RuntimeException("Forbidden: Cannot change element to <$name>");
+		}
+		return $name;
+	}
+
+
+	public static function validateAttributeName(mixed $name): void
+	{
+		if (!is_string($name)) {
+			throw new Latte\RuntimeException('Attribute name must be string, ' . get_debug_type($name) . ' given');
+
+		} elseif (!preg_match('~' . Latte\Compiler\TemplateLexer::ReAttrName . '+$~DAu', $name)) {
+			throw new Latte\RuntimeException("Invalid attribute name '$name'");
+		}
+	}
+}

package/vendor/latte/latte/src/Latte/Runtime/HtmlStringable.php

@@ -1,12 +1,10 @@
-<?php
+<?php declare(strict_types=1);
 
 /**
  * This file is part of the Latte (https://latte.nette.org)
  * Copyright (c) 2008 David Grudl (https://davidgrudl.com)
  */
 
-declare(strict_types=1);
-
 namespace Latte\Runtime;