docx-templates - npm Package Compare versions

Comparing version 4.11.2 to 4.11.3

CHANGELOG.md

@@ -0,14 +1,20 @@
+## 4.11.3 (2023-08-08)
+-  ([PR #321](https://github.com/guigrpa/docx-templates/pull/321)) Fix `InvalidCommandError` referring to `'Unexpected END-IF outside of IF statement context:'` when the problem was actually an unexpected `END-FOR`. Thanks @davidjb
+- Issue [#322](https://github.com/guigrpa/docx-templates/issues/322): Fix silent failure caused by unterminated for-loop in template, leading to a (partially) empty report. Throw new `UnterminatedForLoopError` when `FOR` loop is not properly terminated with an `END-FOR`.
+- Remove unnecessary runtime dependency (`timm`).
+- Upgrade `jszip` dependency to latest version.
+
 ## 4.11.2 (2023-07-14)
-- Issue [#296](https://github.com/guigrpa/docx-templates/issues/296): Fix bug caused by Shapes having the same ID they are generated from a FOR loop. ([MR #315](https://github.com/guigrpa/docx-templates/pull/315)) Thanks @SuchiraD!
+- Issue [#296](https://github.com/guigrpa/docx-templates/issues/296): Fix bug caused by Shapes having the same ID they are generated from a FOR loop. ([PR #315](https://github.com/guigrpa/docx-templates/pull/315)) Thanks @SuchiraD!
 - Issue [#314](https://github.com/guigrpa/docx-templates/issues/314): Ensure all custom error types are exported.
 
 ## 4.11.1 (2023-04-04)
--  ([MR #305](https://github.com/guigrpa/docx-templates/pull/305)) the `IncompleteConditionalStatementError` is now thrown when an 'IF' statement lacks a corresponding 'END-IF' command. Thanks @RoXuS !
+-  ([PR #305](https://github.com/guigrpa/docx-templates/pull/305)) the `IncompleteConditionalStatementError` is now thrown when an 'IF' statement lacks a corresponding 'END-IF' command. Thanks @RoXuS !
 
 ## 4.11.0 (2023-03-02)
-- [Issue #143](https://github.com/guigrpa/docx-templates/issues/143): Add optional `processLineBreaksAsNewText` toggle which provides an alternative way of inserting line breaks from commands into the docx XML. This should improve rendering of newlines in a few docx readers, like LibreOffice. ([MR #182](https://github.com/guigrpa/docx-templates/pull/182)). Thanks @khaled-iva-docs !
+- [Issue #143](https://github.com/guigrpa/docx-templates/issues/143): Add optional `processLineBreaksAsNewText` toggle which provides an alternative way of inserting line breaks from commands into the docx XML. This should improve rendering of newlines in a few docx readers, like LibreOffice. ([PR #182](https://github.com/guigrpa/docx-templates/pull/182)). Thanks @khaled-iva-docs !
 - Updated dependencies.
 
 ## 4.10.0 (2023-02-03)
-- [Issue #194](https://github.com/guigrpa/docx-templates/issues/194): add ability to provide captions for images ([MR #286](https://github.com/guigrpa/docx-templates/pull/286)).
+- [Issue #194](https://github.com/guigrpa/docx-templates/issues/194): add ability to provide captions for images ([PR #286](https://github.com/guigrpa/docx-templates/pull/286)).
 - Ensure XMLs are processed in a deterministic order (mainly relevant for `listCommands()`), see commit 8b2ba5526df78da675eaf59f88cb76035ffac5bd.
@@ -15,0 +21,0 @@ - Various minor code quality and typing improvements.

lib/bundled.d.ts

@@ -117,2 +117,11 @@ type Buffer = ArrayBufferLike;
 };
+type VarValue = unknown;
+type LoopStatus = {
+    refNode: Node;
+    refNodeLevel: number;
+    varName: string;
+    loopOver: Array<VarValue>;
+    idx: number;
+    isIf?: boolean;
+};
 type CommandSummary = {
@@ -238,3 +247,6 @@ raw: string;
 }
+declare class UnterminatedForLoopError extends Error {
+    constructor(loop: LoopStatus);
+}
 
-export { CommandExecutionError, CommandSyntaxError, ImageError, IncompleteConditionalStatementError, InternalError, InvalidCommandError, NullishCommandResultError, ObjectCommandResultError, QueryResolver, TemplateParseError, createReport, createReport as default, getMetadata, listCommands };
+export { CommandExecutionError, CommandSyntaxError, ImageError, IncompleteConditionalStatementError, InternalError, InvalidCommandError, NullishCommandResultError, ObjectCommandResultError, QueryResolver, TemplateParseError, UnterminatedForLoopError, createReport, createReport as default, getMetadata, listCommands };

lib/errors.d.ts

@@ -0,1 +1,2 @@
+import { LoopStatus } from './types';
 /**
@@ -38,1 +39,4 @@ * Thrown when `rejectNullish` is set to `true` and a command returns `null` or `undefined`.
 }
+export declare class UnterminatedForLoopError extends Error {
+    constructor(loop: LoopStatus);
+}

lib/errors.js

@@ -18,3 +18,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IncompleteConditionalStatementError = exports.TemplateParseError = exports.InternalError = exports.ImageError = exports.CommandExecutionError = exports.InvalidCommandError = exports.CommandSyntaxError = exports.ObjectCommandResultError = exports.NullishCommandResultError = void 0;
+exports.UnterminatedForLoopError = exports.IncompleteConditionalStatementError = exports.TemplateParseError = exports.InternalError = exports.ImageError = exports.CommandExecutionError = exports.InvalidCommandError = exports.CommandSyntaxError = exports.ObjectCommandResultError = exports.NullishCommandResultError = void 0;
 /**
@@ -114,1 +114,9 @@ * Thrown when `rejectNullish` is set to `true` and a command returns `null` or `undefined`.
 exports.IncompleteConditionalStatementError = IncompleteConditionalStatementError;
+var UnterminatedForLoopError = /** @class */ (function (_super) {
+    __extends(UnterminatedForLoopError, _super);
+    function UnterminatedForLoopError(loop) {
+        return _super.call(this, "Unterminated FOR-loop ('FOR ".concat(loop.varName, "'). Make sure each FOR loop has a corresponding END-FOR command.")) || this;
+    }
+    return UnterminatedForLoopError;
+}(Error));
+exports.UnterminatedForLoopError = UnterminatedForLoopError;

lib/jsSandbox.js

 "use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
@@ -44,3 +55,2 @@ function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
 var vm_1 = __importDefault(require("vm"));
-var timm_1 = require("timm");
 var reportUtils_1 = require("./reportUtils");
@@ -60,6 +70,3 @@ var errors_1 = require("./errors");
                 case 0:
-                    sandbox = (0, timm_1.merge)(ctx.jsSandbox || {}, {
-                        __code__: code,
-                        __result__: undefined,
-                    }, data, ctx.options.additionalJsContext);
+                    sandbox = __assign(__assign(__assign(__assign({}, (ctx.jsSandbox || {})), { __code__: code, __result__: undefined }), data), ctx.options.additionalJsContext);
                     curLoop = (0, reportUtils_1.getCurLoop)(ctx);
@@ -119,4 +126,4 @@ if (curLoop)
                 case 15:
-                    // Save the sandbox for later use
-                    ctx.jsSandbox = (0, timm_1.omit)(context, ['__code__', '__result__']);
+                    // Save the sandbox for later use, omitting the __code__ and __result__ properties.
+                    ctx.jsSandbox = __assign(__assign({}, context), { __code__: undefined, __result__: undefined });
                     debug_1.logger.debug('Command returned: ', result);
@@ -123,0 +130,0 @@ return [2 /*return*/, result];

lib/processTemplate.js

@@ -187,8 +187,7 @@ "use strict";
 function walkTemplate(data, template, ctx, processor) {
-    var _a;
     return __awaiter(this, void 0, void 0, function () {
-        var out, nodeIn, nodeOut, move, deltaJump, errors, curLoop, nextSibling, parent_3, tag, fRemoveNode, buffers, nodeOutParent, imgNode, captionNodes, parent_4, linkNode, parent_5, htmlNode, parent_6, tag, newNode, newNodeTag, parent_7, result;
-        var _b;
-        return __generator(this, function (_c) {
-            switch (_c.label) {
+        var out, nodeIn, nodeOut, move, deltaJump, errors, curLoop, nextSibling, parent_3, tag, fRemoveNode, buffers, nodeOutParent, imgNode, captionNodes, parent_4, linkNode, parent_5, htmlNode, parent_6, tag, newNode, newNodeTag, parent_7, result, err, innermost_loop, err;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
@@ -200,3 +199,3 @@ out = (0, reportUtils_1.cloneNodeWithoutChildren)(template);
                     errors = [];
-                    _c.label = 1;
+                    _b.label = 1;
                 case 1:
@@ -296,3 +295,3 @@ if (!true) return [3 /*break*/, 5];
                                 if (captionNodes) {
-                                    (_b = parent_4._children).push.apply(_b, captionNodes);
+                                    (_a = parent_4._children).push.apply(_a, captionNodes);
                                 }
@@ -387,3 +386,3 @@ // Prevent containing paragraph or table row from being removed
                 case 2:
-                    result = _c.sent();
+                    result = _b.sent();
                     if (typeof result === 'string') {
@@ -398,7 +397,7 @@ // TODO: improve typesafety of conversion Node to TextNode.
                     }
-                    _c.label = 3;
+                    _b.label = 3;
                 case 3:
                     // Execute the move in the output tree
                     nodeOut = newNode;
-                    _c.label = 4;
+                    _b.label = 4;
                 case 4:
@@ -418,9 +417,20 @@ // JUMP to the target level of the tree.
                     if (ctx.gCntIf !== ctx.gCntEndIf) {
-                        if ((_a = ctx.options) === null || _a === void 0 ? void 0 : _a.failFast) {
-                            throw new errors_1.IncompleteConditionalStatementError();
+                        err = new errors_1.IncompleteConditionalStatementError();
+                        if (ctx.options.failFast) {
+                            throw err;
                         }
                         else {
-                            errors.push(new errors_1.IncompleteConditionalStatementError());
+                            errors.push(err);
                         }
                     }
+                    if (ctx.loops.filter(function (l) { return !l.isIf; }).length > 0) {
+                        innermost_loop = ctx.loops[ctx.loops.length - 1];
+                        err = new errors_1.UnterminatedForLoopError(innermost_loop);
+                        if (ctx.options.failFast) {
+                            throw err;
+                        }
+                        else {
+                            errors.push(err);
+                        }
+                    }
                     if (errors.length > 0)
@@ -758,6 +768,6 @@ return [2 /*return*/, {
 var processEndForIf = function (node, ctx, cmd, cmdName, cmdRest) {
+    var isIf = cmdName === 'END-IF';
     var curLoop = (0, reportUtils_1.getCurLoop)(ctx);
     if (!curLoop)
-        throw new errors_1.InvalidCommandError('Unexpected END-IF outside of IF statement context', cmd);
-    var isIf = cmdName === 'END-IF';
+        throw new errors_1.InvalidCommandError("Unexpected ".concat(cmdName, " outside of ").concat(isIf ? 'IF statement' : 'FOR loop', " context"), cmd);
     // First time we visit an END-IF node, we assign it the arbitrary name
@@ -764,0 +774,0 @@ // generated when the IF was processed

package.json

 {
   "name": "docx-templates",
-  "version": "4.11.2",
+  "version": "4.11.3",
   "description": "Template-based docx report creation",
@@ -29,3 +29,2 @@ "main": "lib/index.js",
     "rollup": "rollup -c",
-    "travis": "yarn compile && yarn test",
     "jest": "jest --watch --coverage",
@@ -44,5 +43,4 @@ "test": "yarn lint && yarn testCovFull",
   "dependencies": {
-    "jszip": "^3.5.0",
-    "sax": "1.2.4",
-    "timm": "^1.6.2"
+    "jszip": "^3.10.1",
+    "sax": "1.2.4"
   },
@@ -49,0 +47,0 @@ "devDependencies": {

README.md

@@ -1,2 +0,2 @@
-# Docx-templates [![Build Status](https://travis-ci.org/guigrpa/docx-templates.svg)](https://travis-ci.org/guigrpa/docx-templates) [![Coverage Status](https://coveralls.io/repos/github/guigrpa/docx-templates/badge.svg?branch=master)](https://coveralls.io/github/guigrpa/docx-templates?branch=master) [![npm version](https://img.shields.io/npm/v/docx-templates.svg)](https://www.npmjs.com/package/docx-templates)
+# Docx-templates [![Coverage Status](https://coveralls.io/repos/github/guigrpa/docx-templates/badge.svg?branch=master)](https://coveralls.io/github/guigrpa/docx-templates?branch=master) [![npm version](https://img.shields.io/npm/v/docx-templates.svg)](https://www.npmjs.com/package/docx-templates)
 
@@ -3,0 +3,0 @@ Template-based docx report creation for both Node and the browser. ([See the blog post](http://guigrpa.github.io/2017/01/01/word-docs-the-relay-way/)).

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Dependency count

2

decreased by-33.33%

Number of package files

31

increased by3.33%

Lines of code

3743

increased by0.86%

Worsened metrics

Total package byte prevSize

1202914

decreased by-18.59%

Dependency changes

• - Removedtimm@^1.6.2

• - Removedtimm@1.7.1(transitive)

• Updatedjszip@^3.10.1