mirror of
https://github.com/S2-/minifyfromhtml.git
synced 2025-08-03 04:10:04 +02:00
update node modules
This commit is contained in:
29
node_modules/lodash/template.js
generated
vendored
29
node_modules/lodash/template.js
generated
vendored
@@ -10,11 +10,26 @@ var assignInWith = require('./assignInWith'),
|
||||
templateSettings = require('./templateSettings'),
|
||||
toString = require('./toString');
|
||||
|
||||
/** Error message constants. */
|
||||
var INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`';
|
||||
|
||||
/** Used to match empty string literals in compiled template source. */
|
||||
var reEmptyStringLeading = /\b__p \+= '';/g,
|
||||
reEmptyStringMiddle = /\b(__p \+=) '' \+/g,
|
||||
reEmptyStringTrailing = /(__e\(.*?\)|\b__t\)) \+\n'';/g;
|
||||
|
||||
/**
|
||||
* Used to validate the `validate` option in `_.template` variable.
|
||||
*
|
||||
* Forbids characters which could potentially change the meaning of the function argument definition:
|
||||
* - "()," (modification of function parameters)
|
||||
* - "=" (default value)
|
||||
* - "[]{}" (destructuring of function parameters)
|
||||
* - "/" (beginning of a comment)
|
||||
* - whitespace
|
||||
*/
|
||||
var reForbiddenIdentifierChars = /[()=,{}\[\]\/\s]/;
|
||||
|
||||
/**
|
||||
* Used to match
|
||||
* [ES template delimiters](http://ecma-international.org/ecma-262/7.0/#sec-template-literal-lexical-components).
|
||||
@@ -169,11 +184,11 @@ function template(string, options, guard) {
|
||||
|
||||
// Use a sourceURL for easier debugging.
|
||||
// The sourceURL gets injected into the source that's eval-ed, so be careful
|
||||
// with lookup (in case of e.g. prototype pollution), and strip newlines if any.
|
||||
// A newline wouldn't be a valid sourceURL anyway, and it'd enable code injection.
|
||||
// to normalize all kinds of whitespace, so e.g. newlines (and unicode versions of it) can't sneak in
|
||||
// and escape the comment, thus injecting code that gets evaled.
|
||||
var sourceURL = hasOwnProperty.call(options, 'sourceURL')
|
||||
? ('//# sourceURL=' +
|
||||
(options.sourceURL + '').replace(/[\r\n]/g, ' ') +
|
||||
(options.sourceURL + '').replace(/\s/g, ' ') +
|
||||
'\n')
|
||||
: '';
|
||||
|
||||
@@ -206,12 +221,16 @@ function template(string, options, guard) {
|
||||
|
||||
// If `variable` is not specified wrap a with-statement around the generated
|
||||
// code to add the data object to the top of the scope chain.
|
||||
// Like with sourceURL, we take care to not check the option's prototype,
|
||||
// as this configuration is a code injection vector.
|
||||
var variable = hasOwnProperty.call(options, 'variable') && options.variable;
|
||||
if (!variable) {
|
||||
source = 'with (obj) {\n' + source + '\n}\n';
|
||||
}
|
||||
// Throw an error if a forbidden character was found in `variable`, to prevent
|
||||
// potential command injection attacks.
|
||||
else if (reForbiddenIdentifierChars.test(variable)) {
|
||||
throw new Error(INVALID_TEMPL_VAR_ERROR_TEXT);
|
||||
}
|
||||
|
||||
// Cleanup code by stripping empty strings.
|
||||
source = (isEvaluating ? source.replace(reEmptyStringLeading, '') : source)
|
||||
.replace(reEmptyStringMiddle, '$1')
|
||||
|
Reference in New Issue
Block a user