From 4407285d84c7ddf8bba0fac627a74bc5f0ceaa79 Mon Sep 17 00:00:00 2001
From: mclow <mclow@users.noreply.github.com>
Date: Fri, 16 Apr 2021 19:35:34 +0000
Subject: [PATCH] deploy: 68fa9dccdec75d59ac28d3ff98d70c659e12326d

---
 doc/develop/html/index.html                   |   2 +-
 .../html/numpy/.doctrees/environment.pickle   | Bin 27164 -> 27164 bytes
 doc/develop/html/numpy/_static/underscore.js  |  23 +++++++++++++++---
 doc/develop/html/reference/index.html         |   2 +-
 doc/develop/html/tutorial/index.html          |   2 +-
 5 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/doc/develop/html/index.html b/doc/develop/html/index.html
index be799258..4d33c94b 100644
--- a/doc/develop/html/index.html
+++ b/doc/develop/html/index.html
@@ -126,7 +126,7 @@
   </p>
 </div>
 <table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
-<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:22 GMT</small></p></td>
+<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:23 GMT</small></p></td>
 <td align="right"><div class="copyright-footer"></div></td>
 </tr></table>
 <hr>
diff --git a/doc/develop/html/numpy/.doctrees/environment.pickle b/doc/develop/html/numpy/.doctrees/environment.pickle
index de0444fcae58075251ad2d3fdce597c85d2c7645..31ef42ff731382a417f01ab314a7fc8858c35a34 100644
GIT binary patch
delta 1651
zcmbPpg>lXm#tpU7lg~*TPFAuLQ|jR>DJ{t_%1q4B&&*3nt(eloUzD1bT9lfXoT{Hv
zQdy8XSwTik1xXO9Oc1UwttdY?C9x!N@<M5mdW3PMX{C9|Q+fmu#^t3X78NB{PU&HV
zm@%P;BQYl@J|#c7cuMUQjVwDR1_pP>8*-HgH6*8H8N+#+zE`r$;5;oChb&73Z(?PZ
z37n^0pFbhX7S7dQJT=P*&NG-Llw|?u8M3X-vO@6UuV$Gdcx#Qb%;7wvAlEEw1aFC7
zmJOU|oSs?Q!;_L)keZj0nwOk8*-5s#9^{YODPRxOP64~Tb_&?ZwNt=ut(^jPW9<~M
z<7%gXT~#{;?3~&uV0Y9`0Xv{}3fSh_DPSvWr<C@vm1LIWq$0wrhc6{RxwIrRr&up9
zKP9zzN)PL18#!~v$(;(ylcjW|CU1}rogAv7JlWDjc(S#E-(*$=<;iOl7Ej))syx}>
zL1J>3;_b;3m6a!VDCJHrmRFuEp<FpRRZV&Fy9ndS&z18SO(zE^Dos8cWjuMcO5WsD
zCFRLBs+E%^Rh1{#CumM)R7;usRY`erhgu2P+gYhh3=CkOXVrsPplHkL1+hR;mNgs1
z0!3HWN)QVaQ(4<VEKn?E9R;yKF_d)~!~(@m)<X~r6f;@xK`c<LWc>xPKrxcV&CI|6
z4w@`UW_|{S(jJx)cw*Yzr5?{Xd6$FAWM0iZjCPw(X+C6}{Kz_gvXoBl<Qq0Bn^)^7
zGfuu?Be?m#ZXuX4S>H=>bCbRwgtOjTZu5VG05E5Bf>9RZ<hZE($(AN*lY^sGHXk-o
zW}F-xEjanUuIy$Jvk(XeWWX$QKL`h8fVgD<gp*(-w|SbC598!h#`%-iD40xcwF#a)
z-$Z5dADaz~mYdhw8Z%86OfZ{dVmaC0A$#)g1eMMA9F!R+|4x8dq3;v|;ef2z>g)&M
zfUGcbP2-&05CPWOp(Ht3!9RF%Nu<i=>Hf-$lS?8Y+Ft~OKsX@nc|m><4oLg!-~b2*
z<ie~_AI8b6waq3^2(g$fp)5byIXrlBfWF}54JN{qcZDCD{4_Cd^1Fz($-9zNCeMgG
z#%MbEp?%)uvr%o6UuvjKE|1<Y`J|@cW{VhprpYt>Aja6J%1^!$7d+V}2x5$P{ISXI
zae0&L6KW=_$E!@1PdqkxTUg%Y4mFX<=}Ezpr-iFdzMphE6qJj+8Nq4En-!dkyjj7y
z$eR(Ii@aIDxyYLpoQu3!!MVtr5uA&>8Ns>8n-QFgycxl{$eS_CW-@<@vpC4)*eM!W
zsi4%8!OXyr3O0ALmz^wAmg(e<6bEoxo{$BS>xULh6SC}B85lr3P)eSV<$%I-LgBff
z@Z3;%0vr%iKxukHmJkY01jdtLVqln%B?jYyc@i+*=H%3JMo*9@I>DjS2@af2upc_X
zLDLBinND!Pbb`aB6C5m^;85uV2TCV6Oggh{HY=wKFo8om7E)%#LdvXINSPH2DYIfB
kWmYVt%!-ASS+S5ZD;82_#X`!gSV)-_J0;6za!2MA0A4Kj^#A|>

delta 1613
zcmbPpg>lXm#tpU7DuN}YCHX~}i8=adMftfYi6x0sdiaY{(^894^O95bGxJhXD<&Jr
zh)A%4nNxcB;2IzTlWU}n_>pv^lvEZ>c9apB{6bnqSP)@SUP@w7QDWtk$%=O3^%HtH
z5_59mQ}UCGr_@f-$TDSOU~qT5A>y)SgNJ^W1)R5W&zmeuIBzqvW|lF6mz0!c2j^``
z7SFPU^LBjW%rb}bb_qVqvO(~A72L9n5ZtfqS!QtFZl6V2)^Oe)k=a=$2wvsVEGsx~
zuVvk2Q`wGskkf0YfZbd>1?<?`DPULDP60cwb_&>CwNt<js+|IMN$nJ{3u>o;t*)H{
zwzGB$*s|IwU|VXZl=iTdWR~QlB7&%gFC{;@v?Md9ST8R>CAD};59?+dIdjIzUzL<6
zOX)~W-XI@3xl=)TvZaaeWNQV#$;I-@lh-ILX0+QJpeV{XSyEMba)(mx<Wx1~$r8$y
zlT($HC%=m@p8Q-nZ!)Wb^5nBo#*<g8<W1hHsyx|7wQ{n*qVnYW1kK5eYAKT^Dl1R!
zP%8oZH!GEifdTC0ta=a&6h&FRAQmWkvSx!=ps2}O31WewC2Ko~1&WfaqaYS2I<hW<
zSfH55dI(~HVj=52hy{v)tiK=@DD<<qnHd<sVUi`u%+J73+QU);PdJ;q)Z-Z^2S=++
z=GELYSv^K@^DWJbjFY#8nN2dWoGhi2J9%2T%I4KN%8Zkzg$r)JuUiOaOxE{O+}xz^
z2jQ&umfQT_AOOtSoM4p2IQfxv{$xv&w8=MYR5l+rQD&Tc!$xrOeO=kjB4!~F4#<F6
z=6(<k$N+K600<|+NN)2qD<8(mtF`kduTe0W+-eg%IY3`<@&*&($$xA%FdA=OYirEJ
zXgB$x{mscQHB>g=b5LfS{89sAgT7M;gafi+tFs@31G2%$HH~w!dmPwj9ZHgu75sxI
ztH-Nsp6;*AI9WX&qWwic2!sRDo)_c?;efQi4i12DKn~0b^<kX+G%;_ogtGi(=kVak
zyOLBV?+!mYd4`|a<Ov}blix+OO|}VwIC@6pvB{^5^CzE;YMVUYL}hY$^ae(=%^ETC
zOp^r@@+RA;%1^!$7d-iQg34s?_+yhF*h7q{PpFx^%RyzbeB!am4H0>hJJdubrzZtZ
zE{Rl`d@t!vC@AZAGlJ8RH!C>nc(a1DjyEGX>v*$(vyL|_IO}+`g0qe{BRK1LGlH{@
zHzPRfcr${tjyGeL)nxt@XK|3pu~Rg%Qb8#vgPDOL6>RQgFFRSLEVIcSDGuOtJRu7t
z*AFd#CS=*MGBAL6pj12|%K?Swgu-({;klvk1UMk3fYS4XEFl!02#hDg#K15iOAN*Z
z^CV!r&B>|djGiD*bb>>t6C605U_W$%gQgQ4GM(Un=>&&MCpcI-!J*O#4wO!Cm~>`Y
zZB|YfU;>ABETo`{g%nh=kb)`}Qc%T03aVI0K@|%rsA3@nRV<{SiiH$Zv5<l)c1o7j
I<c`cK0Qnc^?*IS*

diff --git a/doc/develop/html/numpy/_static/underscore.js b/doc/develop/html/numpy/_static/underscore.js
index 8219dc50..709ae8e3 100644
--- a/doc/develop/html/numpy/_static/underscore.js
+++ b/doc/develop/html/numpy/_static/underscore.js
@@ -1550,6 +1550,13 @@
     return '\\' + escapes[match];
   };
 
+  // In order to prevent third-party code injection through
+  // `_.templateSettings.variable`, we test it against the following regular
+  // expression. It is intentionally a bit more liberal than just matching valid
+  // identifiers, but still prevents possible loopholes through defaults or
+  // destructuring assignment.
+  var bareIdentifier = /^\s*(\w|\$)+\s*$/;
+
   // JavaScript micro-templating, similar to John Resig's implementation.
   // Underscore templating handles arbitrary delimiters, preserves whitespace,
   // and correctly escapes quotes within interpolated code.
@@ -1585,8 +1592,17 @@
     });
     source += "';\n";
 
-    // If a variable is not specified, place data values in local scope.
-    if (!settings.variable) source = 'with(obj||{}){\n' + source + '}\n';
+    var argument = settings.variable;
+    if (argument) {
+      // Insure against third-party code injection.
+      if (!bareIdentifier.test(argument)) throw new Error(
+        'variable is not a bare identifier: ' + argument
+      );
+    } else {
+      // If a variable is not specified, place data values in local scope.
+      source = 'with(obj||{}){\n' + source + '}\n';
+      argument = 'obj';
+    }
 
     source = "var __t,__p='',__j=Array.prototype.join," +
       "print=function(){__p+=__j.call(arguments,'');};\n" +
@@ -1594,7 +1610,7 @@
 
     var render;
     try {
-      render = new Function(settings.variable || 'obj', '_', source);
+      render = new Function(argument, '_', source);
     } catch (e) {
       e.source = source;
       throw e;
@@ -1605,7 +1621,6 @@
     };
 
     // Provide the compiled source as a convenience for precompilation.
-    var argument = settings.variable || 'obj';
     template.source = 'function(' + argument + '){\n' + source + '}';
 
     return template;
diff --git a/doc/develop/html/reference/index.html b/doc/develop/html/reference/index.html
index ad370f06..6cfde3c2 100644
--- a/doc/develop/html/reference/index.html
+++ b/doc/develop/html/reference/index.html
@@ -127,7 +127,7 @@
 </div>
 </div>
 <table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
-<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:21 GMT</small></p></td>
+<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:26 GMT</small></p></td>
 <td align="right"><div class="copyright-footer"></div></td>
 </tr></table>
 <hr>
diff --git a/doc/develop/html/tutorial/index.html b/doc/develop/html/tutorial/index.html
index 8586fa7a..8d2d2c27 100644
--- a/doc/develop/html/tutorial/index.html
+++ b/doc/develop/html/tutorial/index.html
@@ -140,7 +140,7 @@
 </div>
 </div>
 <table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
-<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:31 GMT</small></p></td>
+<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:23 GMT</small></p></td>
 <td align="right"><div class="copyright-footer"></div></td>
 </tr></table>
 <hr>