shelving 1.267.5 → 1.267.6

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "shelving",
-	"version": "1.267.5",
+	"version": "1.267.6",
 	"author": "Dave Houlbrooke <dave@shax.com>",
 	"repository": {
 		"type": "git",

package/util/template.js

@@ -217,14 +217,14 @@ export function renderTemplate(template, values, caller = renderTemplate) {
     let output = template;
     if (isFunction(values)) {
         for (const { name, placeholder } of chunks)
-            output = output.replace(placeholder, values(name));
+            output = output.replace(placeholder, _escapeReplacement(values(name)));
     }
     else if (isData(values)) {
         for (const { name, placeholder } of chunks) {
             const v = getString(getDataProp(values, name));
             if (v === undefined)
                 throw new RequiredError(`Template placeholder "${name}" not found in object`, { received: values, name, caller });
-            output = output.replace(placeholder, v);
+            output = output.replace(placeholder, _escapeReplacement(v));
         }
     }
     else if (isArray(values)) {
@@ -232,7 +232,7 @@ export function renderTemplate(template, values, caller = renderTemplate) {
             const v = getString(values[Number(name)]);
             if (v === undefined)
                 throw new RequiredError(`Template placeholder "${name}" not found in array`, { received: values, name, caller });
-            output = output.replace(placeholder, v);
+            output = output.replace(placeholder, _escapeReplacement(v));
         }
     }
     else {
@@ -240,10 +240,19 @@ export function renderTemplate(template, values, caller = renderTemplate) {
         if (v === undefined)
             throw new RequiredError(`Template value must be string`, { received: values, caller });
         for (const { placeholder } of chunks)
-            output = output.replace(placeholder, v);
+            output = output.replace(placeholder, _escapeReplacement(v));
     }
     return output;
 }
+/**
+ * Escape `$` in a `String.prototype.replace()` replacement value so it's inserted literally.
+ * - Without this, `$&`, `$'`, `` $` ``, `$1`, `$$` in a (often user-supplied) value are interpreted as replacement
+ *   patterns and pull surrounding template text into the value's slot.
+ * - Cheap: only rewrites when a `$` is actually present, so the common case is a single scan with no allocation.
+ */
+function _escapeReplacement(value) {
+    return value.includes("$") ? value.replaceAll("$", "$$$$") : value;
+}
 /**
  * Render a path-shaped template, percent-encoding each substituted value so it stays within its path segment.
  *