mirror of
https://github.com/boostorg/python.git
synced 2026-01-23 05:42:30 +00:00
deploy: 68fa9dccde
This commit is contained in:
@@ -126,7 +126,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
|
||||
<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:22 GMT</small></p></td>
|
||||
<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:23 GMT</small></p></td>
|
||||
<td align="right"><div class="copyright-footer"></div></td>
|
||||
</tr></table>
|
||||
<hr>
|
||||
|
||||
Binary file not shown.
@@ -1550,6 +1550,13 @@
|
||||
return '\\' + escapes[match];
|
||||
};
|
||||
|
||||
// In order to prevent third-party code injection through
|
||||
// `_.templateSettings.variable`, we test it against the following regular
|
||||
// expression. It is intentionally a bit more liberal than just matching valid
|
||||
// identifiers, but still prevents possible loopholes through defaults or
|
||||
// destructuring assignment.
|
||||
var bareIdentifier = /^\s*(\w|\$)+\s*$/;
|
||||
|
||||
// JavaScript micro-templating, similar to John Resig's implementation.
|
||||
// Underscore templating handles arbitrary delimiters, preserves whitespace,
|
||||
// and correctly escapes quotes within interpolated code.
|
||||
@@ -1585,8 +1592,17 @@
|
||||
});
|
||||
source += "';\n";
|
||||
|
||||
// If a variable is not specified, place data values in local scope.
|
||||
if (!settings.variable) source = 'with(obj||{}){\n' + source + '}\n';
|
||||
var argument = settings.variable;
|
||||
if (argument) {
|
||||
// Insure against third-party code injection.
|
||||
if (!bareIdentifier.test(argument)) throw new Error(
|
||||
'variable is not a bare identifier: ' + argument
|
||||
);
|
||||
} else {
|
||||
// If a variable is not specified, place data values in local scope.
|
||||
source = 'with(obj||{}){\n' + source + '}\n';
|
||||
argument = 'obj';
|
||||
}
|
||||
|
||||
source = "var __t,__p='',__j=Array.prototype.join," +
|
||||
"print=function(){__p+=__j.call(arguments,'');};\n" +
|
||||
@@ -1594,7 +1610,7 @@
|
||||
|
||||
var render;
|
||||
try {
|
||||
render = new Function(settings.variable || 'obj', '_', source);
|
||||
render = new Function(argument, '_', source);
|
||||
} catch (e) {
|
||||
e.source = source;
|
||||
throw e;
|
||||
@@ -1605,7 +1621,6 @@
|
||||
};
|
||||
|
||||
// Provide the compiled source as a convenience for precompilation.
|
||||
var argument = settings.variable || 'obj';
|
||||
template.source = 'function(' + argument + '){\n' + source + '}';
|
||||
|
||||
return template;
|
||||
|
||||
@@ -127,7 +127,7 @@
|
||||
</div>
|
||||
</div>
|
||||
<table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
|
||||
<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:21 GMT</small></p></td>
|
||||
<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:26 GMT</small></p></td>
|
||||
<td align="right"><div class="copyright-footer"></div></td>
|
||||
</tr></table>
|
||||
<hr>
|
||||
|
||||
@@ -140,7 +140,7 @@
|
||||
</div>
|
||||
</div>
|
||||
<table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
|
||||
<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:31 GMT</small></p></td>
|
||||
<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:23 GMT</small></p></td>
|
||||
<td align="right"><div class="copyright-footer"></div></td>
|
||||
</tr></table>
|
||||
<hr>
|
||||
|
||||
Reference in New Issue
Block a user