jade - npm Package Compare versions

Comparing version 0.32.0 to 0.33.0

component.json

@@ -5,3 +5,3 @@ {
   "description": "Jade template runtime",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "keywords": [
@@ -8,0 +8,0 @@ "template"

lib/jade.js

@@ -109,3 +109,3 @@ /*!
     parser = parser.context();
-    runtime.rethrow(err, parser.filename, parser.lexer.lineno);
+    runtime.rethrow(err, parser.filename, parser.lexer.lineno, str);
   }
@@ -133,3 +133,5 @@ }
  *
- *   - `compileDebug` when `false` debugging code is stripped from the compiled template
+ *   - `compileDebug` when `false` debugging code is stripped from the compiled
+       template, when it is explicitly `true`, the source code is included in
+       the compiled template for better accuracy.
  *   - `filename` used to improve errors when `compileDebug` is not `false`
@@ -158,3 +160,3 @@ *
       , '} catch (err) {'
-      , '  jade.rethrow(err, jade.debug[0].filename, jade.debug[0].lineno);'
+      , '  jade.rethrow(err, jade.debug[0].filename, jade.debug[0].lineno' + (options.compileDebug === true ? ',' + JSON.stringify(str) : '') + ');'
       , '}'
@@ -161,0 +163,0 @@ ].join('\n');

lib/parser.js

@@ -634,2 +634,3 @@ /*!
 
+    var seenAttrs = false;
     // (attrs | class | id)*
@@ -645,2 +646,6 @@ out:
           case 'attrs':
+            if (seenAttrs) {
+              console.warn('You should not have jade tags with multiple attributes.');
+            }
+            seenAttrs = true;
             var tok = this.advance()
@@ -683,2 +688,9 @@ , obj = tok.attrs
         break;
+      case 'newline':
+      case 'indent':
+      case 'outdent':
+      case 'eos':
+        break;
+      default:
+        throw new Error('Unexpected token `' + this.peek().type + '` expected `text`, `code`, `:`, `newline` or `eos`')
     }
@@ -685,0 +697,0 @@

lib/runtime.js

@@ -123,4 +123,10 @@
       } else if ('class' == key) {
-        if (val = exports.escape(joinClasses(val))) {
-          buf.push(key + '="' + val + '"');
+        if (escaped && escaped[key]){
+          if (val = exports.escape(joinClasses(val))) {
+            buf.push(key + '="' + val + '"');
+          }
+        } else {
+          if (val = joinClasses(val)) {
+            buf.push(key + '="' + val + '"');
+          }
         }
@@ -164,8 +170,14 @@ } else if (escaped && escaped[key]) {
 
-exports.rethrow = function rethrow(err, filename, lineno){
-  if (!filename) throw err;
-  if (typeof window != 'undefined') throw err;
-
+exports.rethrow = function rethrow(err, filename, lineno, str){
+  if (!(err instanceof Error)) throw err;
+  if ((typeof window != 'undefined' || !filename) && !str) {
+    err.message += ' on line ' + lineno;
+    throw err;
+  }
+  try {
+    str =  str || require('fs').readFileSync(filename, 'utf8')
+  } catch (ex) {
+    rethrow(err, null, lineno)
+  }
   var context = 3
-    , str = require('fs').readFileSync(filename, 'utf8')
     , lines = str.split('\n')
@@ -172,0 +184,0 @@ , start = Math.max(lineno - context, 0)

package.json

 {
   "name": "jade",
   "description": "Jade template engine",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "author": "TJ Holowaychuk <[e-mail]>",
@@ -40,3 +40,3 @@ "repository": "git://github.com/visionmedia/jade",
     "test": "mocha -R spec",
-    "prepublish": "npm prune && linify transform bin",
+    "prepublish": "npm prune && linify transform bin && npm run build",
     "build": "npm run compile",
@@ -43,0 +43,0 @@ "compile": "npm run compile-full && npm run compile-runtime",

runtime.js

@@ -125,4 +125,10 @@ (function(e){if("function"==typeof bootstrap)bootstrap("jade",e);else if("object"==typeof exports)module.exports=e();else if("function"==typeof define&&define.amd)define(e);else if("undefined"!=typeof ses){if(!ses.ok())return;ses.makeJade=e}else"undefined"!=typeof window?window.jade=e():global.jade=e()})(function(){var define,ses,bootstrap,module,exports;
       } else if ('class' == key) {
-        if (val = exports.escape(joinClasses(val))) {
-          buf.push(key + '="' + val + '"');
+        if (escaped && escaped[key]){
+          if (val = exports.escape(joinClasses(val))) {
+            buf.push(key + '="' + val + '"');
+          }
+        } else {
+          if (val = joinClasses(val)) {
+            buf.push(key + '="' + val + '"');
+          }
         }
@@ -166,8 +172,14 @@ } else if (escaped && escaped[key]) {
 
-exports.rethrow = function rethrow(err, filename, lineno){
-  if (!filename) throw err;
-  if (typeof window != 'undefined') throw err;
-
+exports.rethrow = function rethrow(err, filename, lineno, str){
+  if (!(err instanceof Error)) throw err;
+  if ((typeof window != 'undefined' || !filename) && !str) {
+    err.message += ' on line ' + lineno;
+    throw err;
+  }
+  try {
+    str =  str || require('fs').readFileSync(filename, 'utf8')
+  } catch (ex) {
+    rethrow(err, null, lineno)
+  }
   var context = 3
-    , str = require('fs').readFileSync(filename, 'utf8')
     , lines = str.split('\n')
@@ -174,0 +186,0 @@ , start = Math.max(lineno - context, 0)

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

High entropy strings

Supply chain risk

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Worsened metrics

Total package byte prevSize

345424

decreased by-11%

Lines of code

8848

decreased by-9.52%

Number of medium supply chain risk alerts

8

increased by14.29%

No dependency changes