angular-expressions - npm Package Versions

1.5.0

Add support for "nullish coalescing operator".

Usable like this : user.name ?? "John".

1.4.3

Disallow access to prototype chain (CVE-2024-54152) when using compile with locals (two arguments in the called function) :

compile("__proto__")({}, {});

=> This now returns undefined, previously it would give you the __proto__ instance which would allow Remote Code Execution.

Thanks to @JorianWoltjer who found the vulnerability and reported it.

1.4.2

Make handleThis the default if you use the Lexer and Parser directly, and you don't use .compile.

This is a way less common use case but it makes sense to have handleThis be the same default for both cases.

(This also makes the library behave in the same way between 1.3.0 and 1.4.1 when using Parser or Lexer). There was a backwards incompatible change brought by 1.4.0 for users of Parser.

1.4.1

Don't use this version, it is missing a commit for the 1.4.2 fix

1.4.0

Add support for handleThis: false to disable handling of this.

(By default handleThis is true).

This way, if you write : {this | filter}, the this will be used as a key from the scope, eg scope["this"].

1.3.0

Add support for template literals.

It is now possible to write :

compile("`Hello ${user}`")({ user: "John" });
// Returns "Hello John"

1.2.1

Bugfix compile(tag, { csp: true }) should now work correctly.

1.2.0

Add four options to the second arg of the compile method :

• compile(tag, {filters: { upper: (input) => input.toUpperCase()}}) which adds filters to a specific instance (those filters are not shared between instances).

• compile(tag, {cache: {}}) to set a "non global" cache.

• compile(tag, { csp: true }) to use the interpreter (avoid use of "new Function()" which is for example not allowed in Vercel).

• compile(tag, {literals: { true: true, false: false, null: null, undefined: undefined } }) which allows to customize literals (such as null, true, false, undefined)

1.1.10

Update typescript typings for "Parser"

1.1.9

Update typescript typings (add .assign method)