From 0b214f23b6496094142b73cf30b858eff202923e Mon Sep 17 00:00:00 2001
From: stefanseefeld <stefanseefeld@users.noreply.github.com>
Date: Wed, 7 Jul 2021 12:06:27 +0000
Subject: [PATCH] deploy: 8dd151177374dbf0aa5cb86bd350cf1ad13e2160

---
 doc/html/index.html                         |   2 +-
 doc/html/numpy/.doctrees/environment.pickle | Bin 27164 -> 27164 bytes
 doc/html/numpy/_static/underscore.js        |  23 ++++++++++++++++----
 doc/html/reference/index.html               |   2 +-
 doc/html/tutorial/index.html                |   2 +-
 5 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/doc/html/index.html b/doc/html/index.html
index fdf869e8..f66c5aeb 100644
--- a/doc/html/index.html
+++ b/doc/html/index.html
@@ -126,7 +126,7 @@
   </p>
 </div>
 <table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
-<td align="left"><p><small>Last revised: March 04, 2021 at 17:00:22 GMT</small></p></td>
+<td align="left"><p><small>Last revised: July 07, 2021 at 12:06:19 GMT</small></p></td>
 <td align="right"><div class="copyright-footer"></div></td>
 </tr></table>
 <hr>
diff --git a/doc/html/numpy/.doctrees/environment.pickle b/doc/html/numpy/.doctrees/environment.pickle
index a9cdd85b2cc3e7aba97a28a4b418ad8e53b4714f..71130901172aa9272223bb039983cabf8c0712a8 100644
GIT binary patch
delta 1671
zcmbPpg>lXm#tpU7la=hmCcl*C7E39qEJ&Tw!&g#Tl3$dWn4@2sR+^VQd8xD>BkN>E
z88wN_yp+_6DLwpf1;v@U1v#lxCf7)-)Wal;Qqxk4QuC5i^`Yhoz?J8vBo-AVR!*7F
z!;zSi6Q7cwTs)<Aibj?>69a?0;|<F+eFwRTS=Ml#qvX{rTLkY_Y?dXQ=VY9eWrX0p
zsaMUifOFmSo@JTAdG0LRvWyYD)RkGL2;LUgEE@#xi(8f*oaa$JEz1hQJA5X~1kUsH
zURc`0lagAHnwOHAmz<e8*;%%#9^{eQDPSMeP60c;b_&?dwNt>3t(^jPWbG8N>uRTf
zomD#p?4H^wV29LB0lT1f3fSt}DPTKmr<C@vm1LIWq#^>Whc6{RxwIrRr&up9KP9zz
zN)PL18#!}EM(fD|ib|8EbfhM4kPn@_RaJSirHSxlYXv_>OR&rug~gML<&`J<J4j6K
zQVgCfsj56lDRr{HqVnbrB~Hf4sY=R|-$fWtey*H1nN>k~^4Tck$*WcJCWophPqtC5
zoZP9PJh?tWb26h^%H)a4%9A_PO28h^N@ZeT0Q)_w9>fC0TvjiL1&Xz-*&r4u#<Es|
zSfI$t+74oYA}Z@Bhy{wItji!4D1x#cf>@x)$$AfBfg&dBFNg(-lq_y$1_p58WJxmf
zGcc6)u#~{l)8;Pqc*e=Ql2j)1YVKh)-+W5*A>-saxBSUcI=PeOyaXq2FcIFoT1T02
zvYeOD<_Ee3AcoQACVfA~$@9GRH~%*X05L=+`-e(zt~2ssoGh4NHpyiE<lhM@n-7~P
zGfw`UAUOHHuIy$Jvk(YJ-%D}xEOS2yXT7)FW^u~^2q(cvZu2xNA4W#Y$q()GCa+O2
zncQj<Jo%-D%H%&b8z!IB6x_VmR+(w?YVG{V{tnrb1N0&8yXT<HI5|LHXz~MHna%o6
zAs~*?=B>_tjFT@I=x;W1^<kXs9%nYm#B!37=wv4M;K}OoDw`|al^G|i$3t9q$|D5K
z*{tuC4`HnL&I2<hgIwj~>%%ztfqnku4kgLS3jV>9cR8qRp6;*AIC+-?#DEt8ArKD8
zdwD^A5Dv(DuY&_19FRd-p<>LFXZV>-o)BU&`CUZYWSbzcA12R;JU021asK49QEijw
zo2X1KkKVv&vsoiXo@sJi6hyg=s{G_Dalw;=qg5t*#~+*g$QmMEpHMUThK<T(`NU(B
z8zS;1cc_U>PEQJ+ToS1=`CihUP*7g;W(21<Z&q+#^JWF-HE%|6Uh`%F=QVFua9;Cf
z1?M$yMsQy9W(4OoZ$@xl^JWC+HE+f&lga!k&f*}GW2b0jrGipe1~UUgD%jk~UUsrf
zSvHe9QXIhPeL@yUt{+-{O~|riWncjDK&gE~mIDgU35Dl^!gE9632;D60j2v1Swbj0
z5g1Q~iGg84mKcl+=1IVKo0C(^89hOs=mdvOCpd6A!G7oj2Tdn9WIDkC(+LijPH?bv
zf<vVf94MXOFzL)P*{qx{zyuEMSV+kh3n|%RAthTZq-2YQlx(q(k}Vcevc*D5wpd8X
U77HoaVj(44?365%$sL(f01o8!%K!iX

delta 1685
zcmbPpg>lXm#tpU7la*wYSyM_X3sNU<k=C26WG80P!&g#Tl3$dWn4@2sR+^VQrAGiR
zke8BJRFqgbrH3^$FD12NN)LZgYFcVhYF=`x{^ZBfYV}~Fru6W`brfgj7UZN(K{6Dg
zb3zYCVopwcN`7+jl-em8S(Z!;4DOCM1YEjrmzri7!FhM~|ID(1^X{Gs%d&#=?n%GQ
zGK2H(b2DevTf@1JMK))d!g){FxwDKBy!^~869n(<^ej6#@2S|5EDHp0`{68GIPV#k
zWtKUDcc8JfhbJYqAT=)~H7_|cwRp;8SJ{eskXLG_fc;QA1?>3RDPULEP60c&c1jk=
znYB~E?yH>wc3ABcu#0M^fSpo11?+~}DPYTMr+{s(ol@GvR+3qglZptk9=??P<kFJN
zoMOGa{FKz<DLt&4ZRE@uC;KZZPnOb=n!G_ibaJSQ@?=XB;mOttev`MVDo<Xcuy}H+
zlJaDK2Z_mDiouhM<&`HXrB0rxth~8HiIZ`1s+#iTcM-;upDX80mQ+=qd^XB>@@kd5
z$#)f%C)=o2PG(h5o?M@xIhj!{h0%O+fTGgm4z&`nx3f~27#P4l&#DKpKrxrq3u1v{
zEo(N21&Xn(l^_-<6tcF1SfGf?ItpTeA}Q-Khy{wEtcM^LC~~sigIJ)5$@&Xofg&Y~
zo0)+D95h*y%=`=tr9CVq@bt8~OFf=(@(ml6$-J6-Ca<v-+<Z&(BID!-_W6^gbaE%}
za!}d4T1T02@-7F#&G&T+!HmiJUW%KW^!*^5_1<!u{~H8=IhzxVvKS}FMdeSnG)bEr
z9IdkXu!%C`<ltz*$@g_-H;b5sKsX=+W|{jzI3NSWEdwB&1S7f4)2w_LCkrN+O){~Z
zyhg!fa;r`7<lhM@lmFOkV6@u2*4CJ5@(jQH$^H)6lWl?oCvPwj-h9tNnQ^jBkkI4@
zx-y&fokBnyqs?2L{TL_j3D)0i<m$sXd9`-_Bqh<wOzy#x1N0%<D&3VCCkN<5w4L$@
z0db5r2YC50PQGBEzxk|p0Ei(n**{czvyZP2<K%`2u&X+hBquBQ2Tv}ERM|Y;Uzu@o
zNhHLFF9Jd!9FPz5g8U#HkPlx62S7L=A7+J$F;9M)m^b-dMBC(DNh*_PL>`;$9tSr2
zY*gE1^>~%Z<<T1$?KW$~$TLl@b2FPfA;e;`jjH_QD{;Y-<-EYopX?ofZ1O2%h+KU_
z&E)weDwE|Ck1?80Zj8vC+@U5iIXx+O@=Fbs$@h}(gn}}hHzPRNd9#8uoHr{t!+A4;
zGn_XIIKz3ff-{^qD>%b>GlDamHzPR1c{74DoHrvl!+A4inNQ|VaTW)e96LoLD;1Q`
zGME_{Qo-g<_Og>@%Cei>k>UVO_7k!|a{bU^Y(kbDD+2?F2TJr4vK&x&PAEJV6rLLj
zPk;kr3Mlzc$Pz-~iNJU=ObiSYvczCqFi!%;+nk(Q&gcp9L?<|OI>CX{3HC!LIA}V-
zA=3#Cm`-rGbb^DW6C5g?;6UjFhe>Ca`DW#G0VZ&0$3lv?SV-{}3n|`WA;nuPq<D*k
h6mPMR;w=_Zyv0I_w^&H=77HofVy9%8PwvQ^0s!_f0+|2+

diff --git a/doc/html/numpy/_static/underscore.js b/doc/html/numpy/_static/underscore.js
index 8219dc50..709ae8e3 100644
--- a/doc/html/numpy/_static/underscore.js
+++ b/doc/html/numpy/_static/underscore.js
@@ -1550,6 +1550,13 @@
     return '\\' + escapes[match];
   };
 
+  // In order to prevent third-party code injection through
+  // `_.templateSettings.variable`, we test it against the following regular
+  // expression. It is intentionally a bit more liberal than just matching valid
+  // identifiers, but still prevents possible loopholes through defaults or
+  // destructuring assignment.
+  var bareIdentifier = /^\s*(\w|\$)+\s*$/;
+
   // JavaScript micro-templating, similar to John Resig's implementation.
   // Underscore templating handles arbitrary delimiters, preserves whitespace,
   // and correctly escapes quotes within interpolated code.
@@ -1585,8 +1592,17 @@
     });
     source += "';\n";
 
-    // If a variable is not specified, place data values in local scope.
-    if (!settings.variable) source = 'with(obj||{}){\n' + source + '}\n';
+    var argument = settings.variable;
+    if (argument) {
+      // Insure against third-party code injection.
+      if (!bareIdentifier.test(argument)) throw new Error(
+        'variable is not a bare identifier: ' + argument
+      );
+    } else {
+      // If a variable is not specified, place data values in local scope.
+      source = 'with(obj||{}){\n' + source + '}\n';
+      argument = 'obj';
+    }
 
     source = "var __t,__p='',__j=Array.prototype.join," +
       "print=function(){__p+=__j.call(arguments,'');};\n" +
@@ -1594,7 +1610,7 @@
 
     var render;
     try {
-      render = new Function(settings.variable || 'obj', '_', source);
+      render = new Function(argument, '_', source);
     } catch (e) {
       e.source = source;
       throw e;
@@ -1605,7 +1621,6 @@
     };
 
     // Provide the compiled source as a convenience for precompilation.
-    var argument = settings.variable || 'obj';
     template.source = 'function(' + argument + '){\n' + source + '}';
 
     return template;
diff --git a/doc/html/reference/index.html b/doc/html/reference/index.html
index 6e92bba2..a8b908d7 100644
--- a/doc/html/reference/index.html
+++ b/doc/html/reference/index.html
@@ -127,7 +127,7 @@
 </div>
 </div>
 <table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
-<td align="left"><p><small>Last revised: March 04, 2021 at 17:00:24 GMT</small></p></td>
+<td align="left"><p><small>Last revised: July 07, 2021 at 12:06:22 GMT</small></p></td>
 <td align="right"><div class="copyright-footer"></div></td>
 </tr></table>
 <hr>
diff --git a/doc/html/tutorial/index.html b/doc/html/tutorial/index.html
index ee06daee..f0220b2b 100644
--- a/doc/html/tutorial/index.html
+++ b/doc/html/tutorial/index.html
@@ -140,7 +140,7 @@
 </div>
 </div>
 <table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
-<td align="left"><p><small>Last revised: March 04, 2021 at 17:00:24 GMT</small></p></td>
+<td align="left"><p><small>Last revised: July 07, 2021 at 12:06:21 GMT</small></p></td>
 <td align="right"><div class="copyright-footer"></div></td>
 </tr></table>
 <hr>