python-liquid 2.3.0__tar.gz → 2.3.1__tar.gz

{python_liquid-2.3.0 → python_liquid-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-liquid
-Version: 2.3.0
+Version: 2.3.1
 Summary: A Python engine for the Liquid template language.
 Project-URL: Change Log, https://github.com/jg-rp/liquid/blob/main/CHANGES.md
 Project-URL: Documentation, https://jg-rp.github.io/liquid/
@@ -24,6 +24,7 @@ Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Requires-Python: >=3.9
 Requires-Dist: babel>=2
+Requires-Dist: importlib-resources>=5.12
 Requires-Dist: markupsafe>=3
 Requires-Dist: python-dateutil>=2.8.1
 Requires-Dist: pytz

{python_liquid-2.3.0 → python_liquid-2.3.1}/liquid/__init__.py

@@ -56,7 +56,7 @@ from .tag import Tag
 
 from . import future
 
-__version__ = "2.3.0"
+__version__ = "2.3.1"
 
 __all__ = (
     "AwareBoundTemplate",

{python_liquid-2.3.0 → python_liquid-2.3.1}/liquid/builtin/filters/array.py

@@ -59,13 +59,17 @@ def join(
     return separator.join(_str_if_not(item) for item in left)
 
 
+@with_environment
 @liquid_filter
-def first(left: Any) -> object:
+def first(left: Any, *, environment: Environment) -> object:
     """Return the first item in collection _left_.
 
     If _left_ is not a collection or it is empty, `None` is returned.
     """
     if isinstance(left, str):
+        # Honor the opt-in Ruby-compat flag, matching the `.first` property path.
+        if environment.string_first_and_last:
+            return left[0] if left else None
         return None
 
     if isinstance(left, dict):
@@ -77,13 +81,17 @@ def first(left: Any) -> object:
         return None
 
 
+@with_environment
 @liquid_filter
-def last(obj: Sequence[Any]) -> object:
+def last(obj: Sequence[Any], *, environment: Environment) -> object:
     """Return the last item in collection _left_.
 
     If _left_ is not a collection or it is empty, `None` is returned.
     """
     if isinstance(obj, str):
+        # Honor the opt-in Ruby-compat flag, matching the `.last` property path.
+        if environment.string_first_and_last:
+            return obj[-1] if obj else None
         return None
 
     try:

{python_liquid-2.3.0 → python_liquid-2.3.1}/liquid/builtin/loaders/package_loader.py

@@ -4,19 +4,19 @@ from __future__ import annotations
 
 import asyncio
 import os
-from importlib.resources import files
 from pathlib import Path
 from typing import TYPE_CHECKING
 from typing import Iterable
 from typing import Optional
 from typing import Union
 
+import importlib_resources
+
 from liquid.exceptions import TemplateNotFoundError
 from liquid.loader import BaseLoader
 from liquid.loader import TemplateSource
 
 if TYPE_CHECKING:
-    from importlib.abc import Traversable
     from types import ModuleType
 
     from liquid import Environment
@@ -44,31 +44,45 @@ class PackageLoader(BaseLoader):
         ext: str = ".liquid",
     ) -> None:
         if isinstance(package_path, str):
-            self.paths = [files(package).joinpath(package_path)]
+            self.paths = [importlib_resources.files(package).joinpath(package_path)]
         else:
-            _package = files(package)
+            _package = importlib_resources.files(package)
             self.paths = [_package.joinpath(path) for path in package_path]
 
         self.encoding = encoding
         self.ext = ext
 
-    def _resolve_path(self, template_name: str) -> Traversable:
+    def _resolve_path(self, template_name: str) -> Path:
         template_path = Path(template_name)
 
-        # Don't build a path that escapes package/package_path.
-        # Does ".." appear in template_name?
-        if os.path.pardir in template_path.parts:
+        if not template_path.name:
             raise TemplateNotFoundError(template_name)
 
         # Add suffix self.ext if template name does not have a suffix.
         if not template_path.suffix:
             template_path = template_path.with_suffix(self.ext)
 
+        if os.path.pardir in template_path.parts or template_path.is_absolute():
+            raise TemplateNotFoundError(template_name)
+
         for path in self.paths:
-            source_path = path.joinpath(str(template_path))
-            if source_path.is_file():
-                # MyPy seems to think source_path has `Any` type :(
-                return source_path  # type: ignore
+            with importlib_resources.as_file(path) as base:
+                source_path: Path = base.joinpath(template_path)
+
+                try:
+                    if not source_path.exists() or not source_path.is_file():
+                        continue
+                except OSError:
+                    # "File name too long", for example
+                    continue
+
+                resolved = source_path.resolve(strict=False)
+                base_resolved = base.resolve(strict=False)
+
+                if not resolved.is_relative_to(base_resolved):
+                    continue
+
+                return source_path
 
         raise TemplateNotFoundError(template_name)
 

{python_liquid-2.3.0 → python_liquid-2.3.1}/pyproject.toml

@@ -18,7 +18,14 @@ classifiers = [
   "Programming Language :: Python :: 3.13",
   "Programming Language :: Python :: 3.14",
 ]
-dependencies = ["MarkupSafe>=3", "python-dateutil>=2.8.1", "Babel>=2", "pytz"]
+dependencies = [
+  "MarkupSafe>=3",
+  "python-dateutil>=2.8.1",
+  "Babel>=2",
+  "pytz",
+  "importlib-resources>=5.12",
+]
+
 description = "A Python engine for the Liquid template language."
 dynamic = ["version"]
 license = "MIT"
@@ -217,6 +224,7 @@ ignore = [
   "S704",
   "TC006",
   "PLW1641",
+  "PLR0917",
 ]
 
 fixable = ["I", "SIM", "D202"]