2
0
mirror of https://github.com/boostorg/python.git synced 2026-01-23 05:42:30 +00:00
This commit is contained in:
mclow
2021-04-16 19:35:34 +00:00
parent 29244def82
commit 4407285d84
5 changed files with 22 additions and 7 deletions

View File

@@ -126,7 +126,7 @@
</p>
</div>
<table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:22 GMT</small></p></td>
<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:23 GMT</small></p></td>
<td align="right"><div class="copyright-footer"></div></td>
</tr></table>
<hr>

View File

@@ -1550,6 +1550,13 @@
return '\\' + escapes[match];
};
// In order to prevent third-party code injection through
// `_.templateSettings.variable`, we test it against the following regular
// expression. It is intentionally a bit more liberal than just matching valid
// identifiers, but still prevents possible loopholes through defaults or
// destructuring assignment.
var bareIdentifier = /^\s*(\w|\$)+\s*$/;
// JavaScript micro-templating, similar to John Resig's implementation.
// Underscore templating handles arbitrary delimiters, preserves whitespace,
// and correctly escapes quotes within interpolated code.
@@ -1585,8 +1592,17 @@
});
source += "';\n";
// If a variable is not specified, place data values in local scope.
if (!settings.variable) source = 'with(obj||{}){\n' + source + '}\n';
var argument = settings.variable;
if (argument) {
// Insure against third-party code injection.
if (!bareIdentifier.test(argument)) throw new Error(
'variable is not a bare identifier: ' + argument
);
} else {
// If a variable is not specified, place data values in local scope.
source = 'with(obj||{}){\n' + source + '}\n';
argument = 'obj';
}
source = "var __t,__p='',__j=Array.prototype.join," +
"print=function(){__p+=__j.call(arguments,'');};\n" +
@@ -1594,7 +1610,7 @@
var render;
try {
render = new Function(settings.variable || 'obj', '_', source);
render = new Function(argument, '_', source);
} catch (e) {
e.source = source;
throw e;
@@ -1605,7 +1621,6 @@
};
// Provide the compiled source as a convenience for precompilation.
var argument = settings.variable || 'obj';
template.source = 'function(' + argument + '){\n' + source + '}';
return template;

View File

@@ -127,7 +127,7 @@
</div>
</div>
<table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:21 GMT</small></p></td>
<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:26 GMT</small></p></td>
<td align="right"><div class="copyright-footer"></div></td>
</tr></table>
<hr>

View File

@@ -140,7 +140,7 @@
</div>
</div>
<table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:31 GMT</small></p></td>
<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:23 GMT</small></p></td>
<td align="right"><div class="copyright-footer"></div></td>
</tr></table>
<hr>