Restore comments from 7e89b79

jashkenas · Mar 14, 2021 · 0c20985 · 0c20985
1 parent bf5a0ed
commit 0c20985
Show file tree

Hide file tree

Showing 11 changed files with 305 additions and 215 deletions.
diff --git a/docs/modules/template.html b/docs/modules/template.html
@@ -897,9 +897,7 @@ <h1>template.js</h1>
 
 <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">escapeChar</span>(<span class="hljs-params">match</span>) </span>{
  <span class="hljs-keyword">return</span> <span class="hljs-string">'\\'</span> + escapes[match];
-}
-
-<span class="hljs-keyword">var</span> bareIdentifier = <span class="hljs-regexp">/^\s*(\w|\$)+\s*$/</span>;</pre></div></div>
+}</pre></div></div>
 
  </li>
 
@@ -910,6 +908,25 @@ <h1>template.js</h1>
  <div class="pilwrap ">
  <a class="pilcrow" href="#section-4">&#182;</a>
  </div>
+ <p>In order to prevent third-party code injection through
+<code>_.templateSettings.variable</code>, we test it against the following regular
+expression. It is intentionally a bit more liberal than just matching valid
+identifiers, but still prevents possible loopholes through defaults or
+destructuring assignment.</p>
+
+ </div>
+
+ <div class="content"><div class='highlight'><pre><span class="hljs-keyword">var</span> bareIdentifier = <span class="hljs-regexp">/^\s*(\w|\$)+\s*$/</span>;</pre></div></div>
+
+ </li>
+
+
+ <li id="section-5">
+ <div class="annotation">
+
+ <div class="pilwrap ">
+ <a class="pilcrow" href="#section-5">&#182;</a>
+ </div>
  <p>JavaScript micro-templating, similar to John Resig’s implementation.
 Underscore templating handles arbitrary delimiters, preserves whitespace,
 and correctly escapes quotes within interpolated code.
@@ -924,11 +941,11 @@ <h1>template.js</h1>
  </li>
 
 
- <li id="section-5">
+ <li id="section-6">
  <div class="annotation">
 
  <div class="pilwrap ">
- <a class="pilcrow" href="#section-5">&#182;</a>
+ <a class="pilcrow" href="#section-6">&#182;</a>
  </div>
  <p>Combine delimiters into one regular expression via alternation.</p>
 
@@ -943,11 +960,11 @@ <h1>template.js</h1>
  </li>
 
 
- <li id="section-6">
+ <li id="section-7">
  <div class="annotation">
 
  <div class="pilwrap ">
- <a class="pilcrow" href="#section-6">&#182;</a>
+ <a class="pilcrow" href="#section-7">&#182;</a>
  </div>
  <p>Compile the template source, escaping string literals appropriately.</p>
 
@@ -970,11 +987,11 @@ <h1>template.js</h1>
  </li>
 
 
- <li id="section-7">
+ <li id="section-8">
  <div class="annotation">
 
  <div class="pilwrap ">
- <a class="pilcrow" href="#section-7">&#182;</a>
+ <a class="pilcrow" href="#section-8">&#182;</a>
  </div>
  <p>Adobe VMs need the match returned to produce the correct offset.</p>
 
@@ -985,18 +1002,34 @@ <h1>template.js</h1>
  source += <span class="hljs-string">"';\n"</span>;
 
  <span class="hljs-keyword">var</span> argument = settings.variable;
- <span class="hljs-keyword">if</span> (argument) {
- <span class="hljs-keyword">if</span> (!bareIdentifier.test(argument)) <span class="hljs-keyword">throw</span> <span class="hljs-keyword">new</span> <span class="hljs-built_in">Error</span>(argument);
+ <span class="hljs-keyword">if</span> (argument) {</pre></div></div>
+
+ </li>
+
+
+ <li id="section-9">
+ <div class="annotation">
+
+ <div class="pilwrap ">
+ <a class="pilcrow" href="#section-9">&#182;</a>
+ </div>
+ <p>Insure against third-party code injection.</p>
+
+ </div>
+
+ <div class="content"><div class='highlight'><pre> <span class="hljs-keyword">if</span> (!bareIdentifier.test(argument)) <span class="hljs-keyword">throw</span> <span class="hljs-keyword">new</span> <span class="hljs-built_in">Error</span>(
+ <span class="hljs-string">'variable is not a bare identifier: '</span> + argument
+ );
  } <span class="hljs-keyword">else</span> {</pre></div></div>
 
  </li>
 
 
- <li id="section-8">
+ <li id="section-10">
  <div class="annotation">
 
  <div class="pilwrap ">
- <a class="pilcrow" href="#section-8">&#182;</a>
+ <a class="pilcrow" href="#section-10">&#182;</a>
  </div>
  <p>If a variable is not specified, place data values in local scope.</p>
 
@@ -1025,11 +1058,11 @@ <h1>template.js</h1>
  </li>
 
 
- <li id="section-9">
+ <li id="section-11">
  <div class="annotation">
 
  <div class="pilwrap ">
- <a class="pilcrow" href="#section-9">&#182;</a>
+ <a class="pilcrow" href="#section-11">&#182;</a>
  </div>
  <p>Provide the compiled source as a convenience for precompilation.</p>