vue - npm Package Compare versions

Comparing version 0.12.12 to 0.12.13-csp

package.json

 {
   "name": "vue",
-  "version": "0.12.12",
+  "version": "0.12.13-csp",
   "author": "Evan You <[e-mail]>",
@@ -34,3 +34,3 @@ "license": "MIT",
     "codecov.io": "^0.1.2",
-    "eslint": "^1.1.0",
+    "eslint": "^1.3.1",
     "grunt": "^0.4.5",
@@ -49,2 +49,3 @@ "grunt-eslint": "^17.1.0",
     "karma-sauce-launcher": "^0.2.14",
+    "notevil": "^1.0.0",
     "phantomjs": "^1.9.17",
@@ -51,0 +52,0 @@ "semver": "^5.0.1",

src/api/child.js

@@ -17,4 +17,6 @@ var _ = require('../util')
   opts = opts || {}
+  var ChildVue
   var parent = this
-  var ChildVue
+  // transclusion context
+  var context = opts._context || parent
   var inherit = opts.inherit !== undefined
@@ -24,19 +26,12 @@ ? opts.inherit
   if (inherit) {
-    var ctors = parent._childCtors
+    var ctors = context._childCtors
     ChildVue = ctors[BaseCtor.cid]
     if (!ChildVue) {
-      var optionName = BaseCtor.options.name
-      var className = optionName
-        ? _.classify(optionName)
-        : 'VueComponent'
-      ChildVue = new Function(
-        'return function ' + className + ' (options) {' +
-        'this.constructor = ' + className + ';' +
-        'this._init(options) }'
-      )()
+      ChildVue = function VueComponent (options) {
+        this.constructor = ChildVue
+        this._init(options)
+      }
       ChildVue.options = BaseCtor.options
       ChildVue.linker = BaseCtor.linker
-      // important: transcluded inline repeaters should
-      // inherit from outer scope rather than host
-      ChildVue.prototype = opts._context || this
+      ChildVue.prototype = context
       ctors[BaseCtor.cid] = ChildVue
@@ -43,0 +38,0 @@ }

src/api/global.js

@@ -39,7 +39,5 @@ var _ = require('../util')
   var Super = this
-  var Sub = createClass(
-    extendOptions.name ||
-    Super.options.name ||
-    'VueComponent'
-  )
+  var Sub = function VueComponent (options) {
+    _.Vue.call(this, options)
+  }
   Sub.prototype = Object.create(Super.prototype)
@@ -64,18 +62,2 @@ Sub.prototype.constructor = Sub
 /**
- * A function that returns a sub-class constructor with the
- * given name. This gives us much nicer output when
- * logging instances in the console.
- *
- * @param {String} name
- * @return {Function}
- */
-
-function createClass (name) {
-  return new Function(
-    'return function ' + _.classify(name) +
-    ' (options) { this._init(options) }'
-  )()
-}
-
-/**
  * Plugin system
@@ -82,0 +64,0 @@ *

src/directives/model/index.js

@@ -53,5 +53,6 @@ var _ = require('../../util')
     }
+    el.__v_model = this
     handler.bind.call(this)
     this.update = handler.update
-    this.unbind = handler.unbind
+    this._unbind = handler.unbind
   },
@@ -76,3 +77,8 @@
     }
+  },
+
+  unbind: function () {
+    this.el.__v_model = null
+    this._unbind && this._unbind()
   }
 }

src/directives/repeat.js

@@ -24,2 +24,17 @@ var _ = require('../util')
   bind: function () {
+
+    // some helpful tips...
+    /* istanbul ignore if */
+    if (
+      process.env.NODE_ENV !== 'production' &&
+      this.el.tagName === 'OPTION' &&
+      this.el.parentNode && this.el.parentNode.__v_model
+    ) {
+      _.warn(
+        'Don\'t use v-repeat for v-model options; ' +
+        'use the `options` param instead: ' +
+        'http://vuejs.org/guide/forms.html#Dynamic_Select_Options'
+      )
+    }
+
     // support for item in array syntax
@@ -63,15 +78,2 @@ var inMatch = this.expression.match(/(.*) in (.*)/)
     this.cache = Object.create(null)
-
-    // some helpful tips...
-    /* istanbul ignore if */
-    if (
-      process.env.NODE_ENV !== 'production' &&
-      this.el.tagName === 'OPTION'
-    ) {
-      _.warn(
-        'Don\'t use v-repeat for v-model options; ' +
-        'use the `options` param instead: ' +
-        'http://vuejs.org/guide/forms.html#Dynamic_Select_Options'
-      )
-    }
   },
@@ -195,2 +197,8 @@
   update: function (data) {
+    if (process.env.NODE_ENV !== 'production' && !_.isArray(data)) {
+      _.warn(
+        'v-repeat pre-converts Objects into Arrays, and ' +
+        'v-repeat filters should always return Arrays.'
+      )
+    }
     if (this.componentId) {
@@ -269,2 +277,10 @@ var state = this.componentState
       if (vm) { // reusable instance
+
+        if (process.env.NODE_ENV !== 'production' && vm._reused) {
+          _.warn(
+            'Duplicate objects found in v-repeat="' + this.expression + '": ' +
+            JSON.stringify(raw)
+          )
+        }
+
         vm._reused = true
@@ -467,3 +483,3 @@ vm.$index = i // update $index
         process.env.NODE_ENV !== 'production' && _.warn(
-          'Duplicate track-by key in v-repeat: ' + id
+          'Duplicate objects with the same track-by key in v-repeat: ' + id
         )
@@ -478,4 +494,4 @@ }
           process.env.NODE_ENV !== 'production' && _.warn(
-            'Duplicate objects are not supported in v-repeat ' +
-            'when using components or transitions.'
+            'Duplicate objects found in v-repeat="' + this.expression + '": ' +
+            JSON.stringify(data)
           )
@@ -482,0 +498,0 @@ }

src/filters/index.js

@@ -110,2 +110,3 @@ var _ = require('../util')
   enter: 13,
+  space: 32,
   'delete': 46,
@@ -112,0 +113,0 @@ up: 38,

src/observer/array.js

@@ -31,3 +31,3 @@ var _ = require('../util')
     var ob = this.__ob__
-    var inserted
+    var inserted, removed
     switch (method) {
@@ -42,7 +42,13 @@ case 'push':
         inserted = args.slice(2)
+        removed = result
         break
+      case 'pop':
+      case 'shift':
+        removed = [result]
+        break
     }
     if (inserted) ob.observeArray(inserted)
+    if (removed) ob.unobserveArray(removed)
     // notify change
-    ob.dep.notify()
+    ob.notify()
     return result
@@ -49,0 +55,0 @@ })

src/observer/index.js

@@ -55,3 +55,3 @@ var _ = require('../util')
   } else if (
-    _.isObject(value) &&
+    (_.isArray(value) || _.isPlainObject(value)) &&
     !Object.isFrozen(value) &&
@@ -61,2 +61,9 @@ !value._isVue
     ob = new Observer(value)
+  } else if (process.env.NODE_ENV !== 'production') {
+    if (_.isObject(value) && !_.isArray(value) && !_.isPlainObject(value)) {
+      _.warn(
+        'Unobservable object found in data: ' +
+        Object.prototype.toString.call(value)
+      )
+    }
   }
@@ -109,3 +116,6 @@ if (ob && vm) {
   while (i--) {
-    this.observe(items[i])
+    var ob = this.observe(items[i])
+    if (ob) {
+      (ob.parents || (ob.parents = [])).push(this)
+    }
   }
@@ -115,2 +125,34 @@ }
 /**
+ * Remove self from the parent list of removed objects.
+ *
+ * @param {Array} items
+ */
+
+Observer.prototype.unobserveArray = function (items) {
+  var i = items.length
+  while (i--) {
+    var ob = items[i] && items[i].__ob__
+    if (ob) {
+      ob.parents.$remove(this)
+    }
+  }
+}
+
+/**
+ * Notify self dependency, and also parent Array dependency
+ * if any.
+ */
+
+Observer.prototype.notify = function () {
+  this.dep.notify()
+  var parents = this.parents
+  if (parents) {
+    var i = parents.length
+    while (i--) {
+      parents[i].notify()
+    }
+  }
+}
+
+/**
  * Convert a property into getter/setter so we can emit
@@ -136,8 +178,2 @@ * the events when the property is accessed/changed.
         }
-        if (_.isArray(val)) {
-          for (var e, i = 0, l = val.length; i < l; i++) {
-            e = val[i]
-            e && e.__ob__ && e.__ob__.dep.depend()
-          }
-        }
       }
@@ -144,0 +180,0 @@ return val

src/observer/object.js

@@ -24,3 +24,3 @@ var _ = require('../util')
     ob.convert(key, val)
-    ob.dep.notify()
+    ob.notify()
     if (ob.vms) {
@@ -73,3 +73,3 @@ var i = ob.vms.length
     }
-    ob.dep.notify()
+    ob.notify()
     if (ob.vms) {
@@ -76,0 +76,0 @@ var i = ob.vms.length

src/parsers/expression.js

 var _ = require('../util')
 var Path = require('./path')
 var Cache = require('../cache')
+var notevil = require('../../vendor/notevil')
 var expressionCache = new Cache(1000)
@@ -176,3 +177,9 @@
   try {
-    return new Function('scope', 'return ' + body + ';')
+    var fn = notevil.Function(
+      'scope', 'Math',
+      'return ' + body + ';'
+    )
+    return function (scope) {
+      return fn.call(this, scope, Math)
+    }
   } catch (e) {
@@ -202,3 +209,11 @@ process.env.NODE_ENV !== 'production' && _.warn(
   try {
-    return new Function('scope', 'value', body + '=value;')
+    var fn = notevil.Function(
+      'scope', 'value', 'Math',
+      body + ' = value;'
+    )
+    return function (scope, value) {
+      try {
+        fn.call(this, scope, value, Math)
+      } catch (e) {}
+    }
   } catch (e) {
@@ -205,0 +220,0 @@ process.env.NODE_ENV !== 'production' && _.warn(

src/parsers/path.js

 var _ = require('../util')
 var Cache = require('../cache')
 var pathCache = new Cache(1000)
-var identRE = exports.identRE = /^[$_a-zA-Z]+[\w$]*$/
+exports.identRE = /^[$_a-zA-Z]+[\w$]*$/
 
@@ -233,21 +233,2 @@ // actions
 /**
- * Format a accessor segment based on its type.
- *
- * @param {String} key
- * @return {Boolean}
- */
-
-function formatAccessor (key) {
-  if (identRE.test(key)) { // identifier
-    return '.' + key
-  } else if (+key === key >>> 0) { // bracket index
-    return '[' + key + ']'
-  } else if (key.charAt(0) === '*') {
-    return '[o' + formatAccessor(key.slice(1)) + ']'
-  } else { // bracket string
-    return '["' + key.replace(/"/g, '\\"') + '"]'
-  }
-}
-
-/**
  * Compiles a getter function with a fixed path.
@@ -261,4 +242,18 @@ * The fixed path getter supresses errors.
 exports.compileGetter = function (path) {
-  var body = 'return o' + path.map(formatAccessor).join('')
-  return new Function('o', body)
+  return function get (obj) {
+    var original = obj
+    var segment
+    for (var i = 0, l = path.length; i < l; i++) {
+      segment = path[i]
+      if (segment.charAt(0) === '*') {
+        segment = original[segment.slice(1)]
+      }
+      obj = obj[segment]
+      if (i === l - 1) {
+        return obj
+      } else if (!_.isObject(obj)) {
+        return
+      }
+    }
+  }
 }
@@ -265,0 +260,0 @@

src/transition/transition.js

@@ -40,2 +40,3 @@ var _ = require('../util')
   this.justEntered = false
+  this.entered = this.left = false
   this.typeCache = {}
@@ -83,3 +84,7 @@ // bind
   op()
+  this.entered = false
   this.callHookWithCb('enter')
+  if (this.entered) {
+    return // user called done synchronously.
+  }
   this.cancel = this.hooks && this.hooks.enterCancelled
@@ -100,12 +105,16 @@ queue.push(this.enterNextTick)
   }, this)
+  var enterDone = this.enterDone
   var type = this.getCssTransitionType(this.enterClass)
-  var enterDone = this.enterDone
-  if (type === TYPE_TRANSITION) {
-    // trigger transition by removing enter class now
+  if (!this.pendingJsCb) {
+    if (type === TYPE_TRANSITION) {
+      // trigger transition by removing enter class now
+      removeClass(this.el, this.enterClass)
+      this.setupCssCb(transitionEndEvent, enterDone)
+    } else if (type === TYPE_ANIMATION) {
+      this.setupCssCb(animationEndEvent, enterDone)
+    } else {
+      enterDone()
+    }
+  } else if (type === TYPE_TRANSITION) {
     removeClass(this.el, this.enterClass)
-    this.setupCssCb(transitionEndEvent, enterDone)
-  } else if (type === TYPE_ANIMATION) {
-    this.setupCssCb(animationEndEvent, enterDone)
-  } else if (!this.pendingJsCb) {
-    enterDone()
   }
@@ -119,2 +128,3 @@ }
 p.enterDone = function () {
+  this.entered = true
   this.cancel = this.pendingJsCb = null
@@ -153,3 +163,7 @@ removeClass(this.el, this.enterClass)
   addClass(this.el, this.leaveClass)
+  this.left = false
   this.callHookWithCb('leave')
+  if (this.left) {
+    return // user called done synchronously.
+  }
   this.cancel = this.hooks && this.hooks.leaveCancelled
@@ -193,2 +207,3 @@ // only need to handle leaveDone if
 p.leaveDone = function () {
+  this.left = true
   this.cancel = this.pendingJsCb = null
@@ -195,0 +210,0 @@ this.op()

src/util/lang.js

@@ -194,4 +194,5 @@ /**
 var toString = Object.prototype.toString
+var OBJECT_STRING = '[object Object]'
 exports.isPlainObject = function (obj) {
-  return toString.call(obj) === '[object Object]'
+  return toString.call(obj) === OBJECT_STRING
 }
@@ -267,3 +268,4 @@
 exports.indexOf = function (arr, obj) {
-  for (var i = 0, l = arr.length; i < l; i++) {
+  var i = arr.length
+  while (i--) {
     if (arr[i] === obj) return i
@@ -270,0 +272,0 @@ }

src/watcher.js

@@ -99,4 +99,4 @@ var _ = require('./util')
         (config.debug
-          ? '' :
-          'Turn on debug mode to see stack trace.'
+          ? ''
+          : 'Turn on debug mode to see stack trace.'
         ), e
@@ -103,0 +103,0 @@ )

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

897297

increased by66.44%

Number of package files

73

increased by1.39%

Lines of code

26124

increased by46.08%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Dev dependency count

22

increased by4.76%

Number of low supply chain risk alerts

52

increased by6.12%

No dependency changes