quicktype-core 23.2.6 → 23.3.1

package/dist/ConvenienceRenderer.d.ts

@@ -132,6 +132,9 @@ export declare abstract class ConvenienceRenderer extends Renderer {
     protected emitComments(comments: Comment[]): void;
     protected emitCommentLines(lines: Sourcelike[], { lineStart, firstLineStart, lineEnd, beforeComment, afterComment, }?: CommentOptions): void;
     protected emitDescription(description: Sourcelike[] | undefined): void;
+    private commentLineEscapes;
+    protected get commentLinesSpliceOnBackslash(): boolean;
+    private escapeCommentLine;
     protected emitDescriptionBlock(lines: Sourcelike[]): void;
     protected emitPropertyTable(c: ClassType, makePropertyRow: (name: Name, jsonName: string, p: ClassProperty) => Sourcelike[]): void;
     private processGraph;

package/dist/ConvenienceRenderer.js

@@ -32,7 +32,13 @@ const unionMemberNameOrder = 40;
 function splitDescription(descriptions) {
     if (descriptions === undefined)
         return undefined;
-    const description = Array.from(descriptions).join("\n\n").trim();
+    // U+0085, U+2028 and U+2029 count as line terminators in some
+    // target languages (JavaScript, C#), so they must not survive
+    // into single-line comments.
+    const description = Array.from(descriptions)
+        .join("\n\n")
+        .replace(/\r\n?|[\u0085\u2028\u2029]/g, "\n")
+        .trim();
     if (description === "")
         return undefined;
     return wordWrap(description)
@@ -577,6 +583,13 @@ class ConvenienceRenderer extends Renderer_1.Renderer {
         });
     }
     emitCommentLines(lines, { lineStart = this.commentLineStart, firstLineStart = lineStart, lineEnd, beforeComment, afterComment, } = {}) {
+        const replacements = this.commentLineEscapes({
+            lineStart,
+            firstLineStart,
+            lineEnd,
+            beforeComment,
+            afterComment,
+        });
         if (beforeComment !== undefined) {
             this.emitLine(beforeComment);
         }
@@ -584,14 +597,15 @@ class ConvenienceRenderer extends Renderer_1.Renderer {
         for (const line of lines) {
             let start = first ? firstLineStart : lineStart;
             first = false;
-            if (this.sourcelikeToString(line) === "") {
+            const escapedLine = this.escapeCommentLine(line, replacements, lineEnd);
+            if (this.sourcelikeToString(escapedLine) === "") {
                 start = (0, Strings_1.trimEnd)(start);
             }
             if (lineEnd) {
-                this.emitLine(start, line, lineEnd);
+                this.emitLine(start, escapedLine, lineEnd);
             }
             else {
-                this.emitLine(start, line);
+                this.emitLine(start, escapedLine);
             }
         }
         if (afterComment !== undefined) {
@@ -604,6 +618,59 @@ class ConvenienceRenderer extends Renderer_1.Renderer {
         // FIXME: word-wrap
         this.emitDescriptionBlock(description);
     }
+    commentLineEscapes(options) {
+        const delimiters = [
+            options.lineStart,
+            options.firstLineStart,
+            options.lineEnd,
+            options.beforeComment,
+            options.afterComment,
+        ];
+        const containsDelimiter = (delimiter) => delimiters.some((part) => { var _a; return (_a = part === null || part === void 0 ? void 0 : part.includes(delimiter)) !== null && _a !== void 0 ? _a : false; });
+        const replacements = [];
+        if (containsDelimiter("/*") || containsDelimiter("*/")) {
+            // The opener must be escaped, too: some languages (Kotlin,
+            // Scala) nest block comments, so a lone `/*` would reopen a
+            // comment that the closing delimiter can't terminate.
+            replacements.push(["/*", "/ *"], ["*/", "* /"]);
+        }
+        if (containsDelimiter("{-") || containsDelimiter("-}")) {
+            replacements.push(["{-", "{ -"], ["-}", "- }"]);
+        }
+        if (containsDelimiter('"""')) {
+            // Triple-quoted comments (Python docstrings, Elixir
+            // moduledocs) are string literals, so backslashes are escape
+            // characters — in particular a trailing backslash would
+            // swallow the first quote of the closing delimiter.
+            replacements.push(["\\", "\\\\"], ['"""', '\\"\\"\\"']);
+        }
+        return replacements;
+    }
+    // C-family lexers splice a backslash-newline into one line even
+    // inside comments, which would pull the following line of
+    // generated code into an attacker-controlled comment.
+    get commentLinesSpliceOnBackslash() {
+        return false;
+    }
+    escapeCommentLine(line, replacements, lineEnd) {
+        if (replacements.length === 0 && !this.commentLinesSpliceOnBackslash) {
+            return line;
+        }
+        let escaped = replacements.reduce((result, [unsafe, safe]) => result.split(unsafe).join(safe), this.sourcelikeToString(line));
+        // A quote at the end of the line would merge with a closing
+        // `"""` emitted right after it.  The quote needs escaping iff
+        // it's preceded by an even number of backslashes.
+        if (lineEnd !== undefined && lineEnd.startsWith('"')) {
+            const trailing = /(\\*)"$/.exec(escaped);
+            if (trailing !== null && trailing[1].length % 2 === 0) {
+                escaped = `${escaped.slice(0, -1)}\\"`;
+            }
+        }
+        if (this.commentLinesSpliceOnBackslash && escaped.endsWith("\\")) {
+            escaped = `${escaped}.`;
+        }
+        return escaped;
+    }
     emitDescriptionBlock(lines) {
         this.emitCommentLines(lines);
     }

package/dist/input/io/NodeIO.js

@@ -54,7 +54,7 @@ const is_url_1 = __importDefault(require("is-url"));
 const Messages_1 = require("../../Messages");
 const Support_1 = require("../../support/Support");
 const get_stream_1 = require("./get-stream");
-const _fetch_1 = require("./$fetch");
+const _fetch_ci_1 = require("./$fetch.ci");
 function parseHeaders(httpHeaders) {
     if (!Array.isArray(httpHeaders)) {
         return {};
@@ -76,7 +76,7 @@ function readableFromFileOrURL(fileOrURL, httpHeaders) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
             if ((0, is_url_1.default)(fileOrURL)) {
-                const response = yield (0, _fetch_1.fetch)(fileOrURL, {
+                const response = yield (0, _fetch_ci_1.fetch)(fileOrURL, {
                     headers: parseHeaders(httpHeaders),
                 });
                 return (0, ts_necessities_1.defined)(response.body);

package/dist/language/CJSON/CJSONRenderer.d.ts

@@ -219,6 +219,7 @@ export declare class CJSONRenderer extends ConvenienceRenderer {
      * @pram global: true if global include, false otherwise (default)
      */
     protected emitIncludeLine(name: Sourcelike, global?: boolean): void;
+    protected get commentLinesSpliceOnBackslash(): boolean;
     /**
      * Emit description block
      * @param lines: description block lines

package/dist/language/CJSON/CJSONRenderer.js

@@ -3067,6 +3067,9 @@ class CJSONRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
     emitIncludeLine(name, global = false) {
         this.emitLine("#include ", global ? "<" : '"', name, global ? ">" : '"');
     }
+    get commentLinesSpliceOnBackslash() {
+        return true;
+    }
     /**
      * Emit description block
      * @param lines: description block lines

package/dist/language/CPlusPlus/CPlusPlusRenderer.d.ts

@@ -65,6 +65,7 @@ export declare class CPlusPlusRenderer extends ConvenienceRenderer {
     protected finishFile(): void;
     protected get needsTypeDeclarationBeforeUse(): boolean;
     protected canBeForwardDeclared(t: Type): boolean;
+    protected get commentLinesSpliceOnBackslash(): boolean;
     protected emitDescriptionBlock(lines: Sourcelike[]): void;
     protected emitBlock(line: Sourcelike, withSemicolon: boolean, f: () => void, withIndent?: boolean): void;
     protected emitNamespaces(namespaceNames: Iterable<string>, f: () => void): void;

package/dist/language/CPlusPlus/CPlusPlusRenderer.js

@@ -458,6 +458,9 @@ class CPlusPlusRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
         const kind = t.kind;
         return kind === "class";
     }
+    get commentLinesSpliceOnBackslash() {
+        return true;
+    }
     emitDescriptionBlock(lines) {
         this.emitCommentLines(lines, {
             lineStart: " * ",

package/dist/language/CSharp/CSharpRenderer.js

@@ -143,12 +143,18 @@ class CSharpRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
         return [...propertyArray, csType, " ", name, " { get; set; }"];
     }
     emitDescriptionBlock(lines) {
+        // Doc comments are XML, so anything that could be mistaken
+        // for markup must be escaped.
+        const escapedLines = lines.map((line) => this.sourcelikeToString(line)
+            .replace(/&/g, "&")
+            .replace(/</g, "&lt;")
+            .replace(/>/g, "&gt;"));
         const start = "/// <summary>";
         if (this._csOptions.dense) {
-            this.emitLine(start, lines.join("; "), "</summary>");
+            this.emitLine(start, escapedLines.join("; "), "</summary>");
         }
         else {
-            this.emitCommentLines(lines, {
+            this.emitCommentLines(escapedLines, {
                 lineStart: "/// ",
                 beforeComment: start,
                 afterComment: "/// </summary>",

package/dist/language/Objective-C/ObjectiveCRenderer.d.ts

@@ -21,6 +21,7 @@ export declare class ObjectiveCRenderer extends ConvenienceRenderer {
     protected makeUnionMemberNamer(): null;
     protected makeEnumCaseNamer(): Namer;
     protected namedTypeToNameForTopLevel(type: Type): Type | undefined;
+    protected get commentLinesSpliceOnBackslash(): boolean;
     protected emitDescriptionBlock(lines: Sourcelike[]): void;
     protected emitBlock(line: Sourcelike, f: () => void): void;
     protected emitMethod(declaration: Sourcelike, f: () => void): void;

package/dist/language/Objective-C/ObjectiveCRenderer.js

@@ -64,6 +64,9 @@ class ObjectiveCRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
     namedTypeToNameForTopLevel(type) {
         return type;
     }
+    get commentLinesSpliceOnBackslash() {
+        return true;
+    }
     emitDescriptionBlock(lines) {
         this.emitCommentLines(lines, { lineStart: "/// " });
     }

package/dist/language/Php/PhpRenderer.d.ts

@@ -35,6 +35,7 @@ export declare class PhpRenderer extends ConvenienceRenderer {
     protected finishFile(): void;
     protected emitFileHeader(fileName: Sourcelike, _imports: string[]): void;
     emitDescriptionBlock(lines: Sourcelike[]): void;
+    private emitDocBlockDescription;
     emitBlock(line: Sourcelike, f: () => void): void;
     protected phpType(_reference: boolean, t: Type, isOptional?: boolean, prefix?: string, suffix?: string): Sourcelike;
     protected phpDocConvertType(className: Name, t: Type): Sourcelike;

package/dist/language/Php/PhpRenderer.js

@@ -133,6 +133,17 @@ class PhpRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
             afterComment: " */",
         });
     }
+    emitDocBlockDescription(desc) {
+        if (desc === undefined) {
+            this.emitLine("/**");
+            return;
+        }
+        this.emitCommentLines(desc, {
+            lineStart: " * ",
+            beforeComment: "/**",
+        });
+        this.emitLine(" *");
+    }
     emitBlock(line, f) {
         this.emitLine(line, " {");
         this.indent(f);
@@ -350,11 +361,7 @@ class PhpRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
         });
     }
     emitFromMethod(names, p, className, _name, desc) {
-        this.emitLine("/**");
-        if (desc !== undefined) {
-            this.emitLine(" * ", desc);
-            this.emitLine(" *");
-        }
+        this.emitDocBlockDescription(desc);
         // this.emitLine(" * @param ", this.phpType(false, p.type, false, "", "|null"));
         this.emitLine(" * @param ", this.phpConvertType(className, p.type), " $value");
         this.emitLine(" * @throws Exception");
@@ -373,11 +380,7 @@ class PhpRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
         });
     }
     emitToMethod(names, p, className, name, desc) {
-        this.emitLine("/**");
-        if (desc !== undefined) {
-            this.emitLine(" * ", desc);
-            this.emitLine(" *");
-        }
+        this.emitDocBlockDescription(desc);
         this.emitLine(" * @throws Exception");
         this.emitLine(" * @return ", this.phpConvertType(className, p.type));
         this.emitLine(" */");
@@ -402,11 +405,7 @@ class PhpRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
         });
     }
     emitValidateMethod(names, p, className, name, desc) {
-        this.emitLine("/**");
-        if (desc !== undefined) {
-            this.emitLine(" * ", desc);
-            this.emitLine(" *");
-        }
+        this.emitDocBlockDescription(desc);
         this.emitLine(" * @param ", this.phpType(false, p.type, false, "", "|null"));
         this.emitLine(" * @return bool");
         this.emitLine(" * @throws Exception");
@@ -424,11 +423,7 @@ class PhpRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
     }
     emitGetMethod(names, p, className, name, desc) {
         if (this._options.withGet) {
-            this.emitLine("/**");
-            if (desc !== undefined) {
-                this.emitLine(" * ", desc);
-                this.emitLine(" *");
-            }
+            this.emitDocBlockDescription(desc);
             if (!this._options.fastGet) {
                 this.emitLine(" * @throws Exception");
             }
@@ -458,11 +453,7 @@ class PhpRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
     }
     emitSetMethod(names, p, className, name, desc) {
         if (this._options.withSet) {
-            this.emitLine("/**");
-            if (desc !== undefined) {
-                this.emitLine(" * ", desc);
-                this.emitLine(" *");
-            }
+            this.emitDocBlockDescription(desc);
             this.emitLine(" * @param ", this.phpType(false, p.type, false, "", "|null"));
             this.emitLine(" * @throws Exception");
             this.emitLine(" */");
@@ -481,11 +472,7 @@ class PhpRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
     }
     emitSampleMethod(names, p, className, name, desc, idx) {
         if (this._options.withGet) {
-            this.emitLine("/**");
-            if (desc !== undefined) {
-                this.emitLine(" * ", desc);
-                this.emitLine(" *");
-            }
+            this.emitDocBlockDescription(desc);
             const rendered = this.phpType(false, p.type);
             this.emitLine(" * @return ", rendered);
             this.emitLine(" */");

package/dist/language/Python/PythonRenderer.d.ts

@@ -2,7 +2,7 @@ import { ConvenienceRenderer, type ForbiddenWordsInfo } from "../../ConvenienceR
 import { type Name, type Namer } from "../../Naming";
 import type { RenderContext } from "../../Renderer";
 import type { OptionValues } from "../../RendererOptions";
-import { type Sourcelike } from "../../Source";
+import type { Sourcelike } from "../../Source";
 import type { TargetLanguage } from "../../TargetLanguage";
 import { type ClassProperty, ClassType, EnumType, type Type } from "../../Type";
 import type { pythonOptions } from "./language";

package/dist/language/Python/PythonRenderer.js

@@ -4,7 +4,6 @@ exports.PythonRenderer = void 0;
 const collection_utils_1 = require("collection-utils");
 const ConvenienceRenderer_1 = require("../../ConvenienceRenderer");
 const Naming_1 = require("../../Naming");
-const Source_1 = require("../../Source");
 const Strings_1 = require("../../support/Strings");
 const Support_1 = require("../../support/Support");
 const Transformers_1 = require("../../Transformers");
@@ -45,14 +44,8 @@ class PythonRenderer extends ConvenienceRenderer_1.ConvenienceRenderer {
     }
     emitDescriptionBlock(lines) {
         if (lines.length === 1) {
-            const docstring = (0, Source_1.modifySource)((content) => {
-                if (content.endsWith('"')) {
-                    return content.slice(0, -1) + '\\"';
-                }
-                return content;
-            }, lines[0]);
             this.emitComments([
-                { customLines: [docstring], lineStart: '"""', lineEnd: '"""' },
+                { customLines: lines, lineStart: '"""', lineEnd: '"""' },
             ]);
         }
         else {

package/package.json

@@ -1,11 +1,11 @@
 {
     "name": "quicktype-core",
-    "version": "23.2.6",
+    "version": "23.3.1",
     "description": "The quicktype engine as a library",
     "license": "Apache-2.0",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
-    "repository": "https://github.com/quicktype/quicktype",
+    "repository": "https://github.com/glideapps/quicktype",
     "scripts": {
         "clean": "rm -rf dist node_modules *~",
         "build": "./env.sh && tsc"