var bareIdentifier = /^\s*(\w|\$)+\s*$/;
diff --git a/docs/modules/template.html b/docs/modules/template.html index 66ea4af77..bc5770181 100644 --- a/docs/modules/template.html +++ b/docs/modules/template.html @@ -897,9 +897,7 @@
In order to prevent third-party code injection through
+_.templateSettings.variable
, we test it against the following regular
+expression. It is intentionally a bit more liberal than just matching valid
+identifiers, but still prevents possible loopholes through defaults or
+destructuring assignment.
var bareIdentifier = /^\s*(\w|\$)+\s*$/;
JavaScript micro-templating, similar to John Resig’s implementation. Underscore templating handles arbitrary delimiters, preserves whitespace, and correctly escapes quotes within interpolated code. @@ -924,11 +941,11 @@
Combine delimiters into one regular expression via alternation.
@@ -943,11 +960,11 @@Compile the template source, escaping string literals appropriately.
@@ -970,11 +987,11 @@Insure against third-party code injection.
+ + if (!bareIdentifier.test(argument)) throw new Error(
+ 'variable is not a bare identifier: ' + argument
+ );
} else {
If a variable is not specified, place data values in local scope.
@@ -1025,11 +1058,11 @@Provide the compiled source as a convenience for precompilation.
diff --git a/docs/underscore-esm.html b/docs/underscore-esm.html index 66149e4e0..2441f23ab 100644 --- a/docs/underscore-esm.html +++ b/docs/underscore-esm.html @@ -2380,9 +2380,7 @@In order to prevent third-party code injection through
+_.templateSettings.variable
, we test it against the following regular
+expression. It is intentionally a bit more liberal than just matching valid
+identifiers, but still prevents possible loopholes through defaults or
+destructuring assignment.
var bareIdentifier = /^\s*(\w|\$)+\s*$/;
JavaScript micro-templating, similar to John Resig’s implementation. Underscore templating handles arbitrary delimiters, preserves whitespace, and correctly escapes quotes within interpolated code. @@ -2407,11 +2424,11 @@
Combine delimiters into one regular expression via alternation.
@@ -2426,11 +2443,11 @@Compile the template source, escaping string literals appropriately.
@@ -2453,11 +2470,11 @@Insure against third-party code injection.
+ + if (!bareIdentifier.test(argument)) throw new Error(
+ 'variable is not a bare identifier: ' + argument
+ );
} else {
If a variable is not specified, place data values in local scope.
@@ -2508,11 +2541,11 @@Provide the compiled source as a convenience for precompilation.
@@ -2526,11 +2559,11 @@Traverses the children of obj
along path
. If a child is a function, it
is invoked with its parent as context. Returns the value of the final
@@ -2558,11 +2591,11 @@
Generate a unique integer id (unique within the entire client session). Useful for temporary DOM ids.
@@ -2578,11 +2611,11 @@Start chaining a wrapped Underscore object.
@@ -2597,11 +2630,11 @@Internal function to execute sourceFunc
bound to context
with optional
args
. Determines whether to execute a function as a constructor or as a
@@ -2620,11 +2653,11 @@
Partially apply a function by creating a version that has had some of its
arguments pre-filled, without changing its dynamic this
context. _
acts
@@ -2652,11 +2685,11 @@
Create a function bound to a given object (assigning this
, and arguments,
optionally).
Internal helper for collection methods to determine whether a collection should be iterated as an array or as an object. @@ -2692,11 +2725,11 @@
Internal implementation of a recursive flatten
function.
Flatten current level of array or arguments object.
@@ -2744,11 +2777,11 @@Bind a number of an object’s methods to that object. Remaining arguments are the method names to be bound. Useful for ensuring that all callbacks @@ -2770,11 +2803,11 @@
Memoize an expensive function by storing its results.
@@ -2794,11 +2827,11 @@Delays a function for the given number of milliseconds, and then calls it with the arguments supplied.
@@ -2814,11 +2847,11 @@Defers a function, scheduling it to run after the current call stack has cleared.
@@ -2830,11 +2863,11 @@Returns a function, that, when invoked, will only be triggered at most once during a given window of time. Normally, the throttled function will run @@ -2888,11 +2921,11 @@
When a sequence of calls of the returned function ends, the argument
function is triggered. The end of a sequence is defined by the wait
@@ -2915,11 +2948,11 @@
This check is needed because func
can recursively invoke debounced
.
Returns the first function passed as an argument to the second, allowing you to adjust arguments, run code before and after, and @@ -2970,11 +3003,11 @@
Returns a negated version of the passed-in predicate.
@@ -2989,11 +3022,11 @@Returns a function that is the composition of a list of functions, each consuming the return value of the function that follows.
@@ -3014,11 +3047,11 @@Returns a function that will only be executed on and after the Nth call.
@@ -3035,11 +3068,11 @@Returns a function that will only be executed up to (but not including) the Nth call.
@@ -3060,11 +3093,11 @@Returns a function that will be executed at most one time, no matter how often you call it. Useful for lazy initialization.
@@ -3076,11 +3109,11 @@Returns the first key on an object that passes a truth test.
@@ -3098,11 +3131,11 @@Internal function to generate _.findIndex
and _.findLastIndex
.
Returns the first index on an array-like that passes a truth test.
@@ -3138,11 +3171,11 @@Returns the last index on an array-like that passes a truth test.
@@ -3153,11 +3186,11 @@Use a comparator function to figure out the smallest index at which an object should be inserted so as to maintain order. Uses binary search.
@@ -3178,11 +3211,11 @@Internal function to generate the _.indexOf
and _.lastIndexOf
functions.
Return the position of the first occurrence of an item in an array, or -1 if the item is not included in the array. @@ -3233,11 +3266,11 @@
Return the position of the last occurrence of an item in an array, or -1 if the item is not included in the array.
@@ -3249,11 +3282,11 @@Return the first value which passes a truth test.
@@ -3268,11 +3301,11 @@Convenience version of a common use case of _.find
: getting the first
object containing specific key:value
pairs.
The cornerstone for collection functions, an each
implementation, aka forEach
.
@@ -3318,11 +3351,11 @@
Return the results of applying the iteratee to each element.
@@ -3343,11 +3376,11 @@Internal helper to create a reducing function, iterating left or right.
@@ -3358,11 +3391,11 @@Wrap code that reassigns argument variables in a separate function than
the one that accesses arguments.length
to avoid a perf hit. (#1991)
Reduce builds up a single result from a list of values, aka inject
,
or foldl
.
The right-associative version of reduce, also known as foldr
.
Return all the elements that pass a truth test.
@@ -3446,11 +3479,11 @@Return all the elements for which a truth test fails.
@@ -3463,11 +3496,11 @@Determine whether all of the elements pass a truth test.
@@ -3487,11 +3520,11 @@Determine if at least one element in the object passes a truth test.
@@ -3511,11 +3544,11 @@Determine if the array or object contains a given item (using ===
).
Invoke a method (with arguments) on every item in a collection.
@@ -3565,11 +3598,11 @@Convenience version of a common use case of _.map
: fetching a property.
Convenience version of a common use case of _.filter
: selecting only
objects containing specific key:value
pairs.
Return the maximum element (or element-based computation).
@@ -3637,11 +3670,11 @@Return the minimum element (or element-based computation).
@@ -3674,11 +3707,11 @@Sample n random values from a collection using the modern version of the Fisher-Yates shuffle. @@ -3708,11 +3741,11 @@
Shuffle a collection.
@@ -3725,11 +3758,11 @@Sort the object’s values by a criterion produced by an iteratee.
@@ -3758,11 +3791,11 @@An internal function used for aggregate “group by” operations.
@@ -3783,11 +3816,11 @@Groups the object’s values by a criterion. Pass either a string attribute to group by, or a function that returns the criterion.
@@ -3801,11 +3834,11 @@Indexes the object’s values by a criterion, similar to _.groupBy
, but for
when you know that your index values will be unique.
Counts instances of an object that group by a certain criterion. Pass either a string attribute to count by, or a function that returns the @@ -3838,11 +3871,11 @@
Split a collection into two arrays: one whose elements all pass the given truth test, and one whose elements all do not pass the truth test.
@@ -3856,11 +3889,11 @@Safely create a real, live array from anything iterable.
@@ -3875,11 +3908,11 @@Keep surrogate pair characters together.
@@ -3894,11 +3927,11 @@Return the number of elements in a collection.
@@ -3912,11 +3945,11 @@Internal _.pick
helper function to determine whether key
is an enumerable
property name of obj
.
Return a copy of the object only containing the allowed properties.
@@ -3962,11 +3995,11 @@Return a copy of the object without the disallowed properties.
@@ -3989,11 +4022,11 @@Returns everything but the last entry of the array. Especially useful on the arguments object. Passing n will return all the values in @@ -4008,11 +4041,11 @@
Get the first element of an array. Passing n will return the first N
values in the array. The guard check allows it to work with _.map
.
Returns everything but the first entry of the array
. Especially useful on
the arguments
object. Passing an n will return the rest N values in the
@@ -4047,11 +4080,11 @@
Get the last element of an array. Passing n will return the last N values in the array.
@@ -4067,11 +4100,11 @@Trim out all falsy values from an array.
@@ -4084,11 +4117,11 @@Flatten out an array, either recursively (by default), or up to depth
.
Passing true
or false
as depth
means 1
or Infinity
, respectively.
Take the difference between one array and a number of other arrays. Only the elements present in just the first array will remain.
@@ -4123,11 +4156,11 @@Return a version of the array that does not contain the specified value(s).
@@ -4140,11 +4173,11 @@Produce a duplicate-free version of the array. If the array has already been sorted, you have the option of using a faster algorithm. @@ -4184,11 +4217,11 @@
Produce an array that contains the union: each distinct element from all of the passed-in arrays.
@@ -4202,11 +4235,11 @@Produce an array that contains every item shared between all the passed-in arrays.
@@ -4231,11 +4264,11 @@Complement of zip. Unzip accepts an array of arrays and groups each array’s elements on shared indices.
@@ -4255,11 +4288,11 @@Zip together multiple lists into a single array – elements that share an index go together.
@@ -4271,11 +4304,11 @@Converts lists into objects. Pass either a single array of [key, value]
pairs, or two parallel arrays of the same length – one of keys, and one of
@@ -4298,11 +4331,11 @@
Generate an integer Array containing an arithmetic progression. A port of
the native Python range()
function. See
@@ -4332,11 +4365,11 @@
Chunk a single array into multiple arrays, each containing count
or fewer
items.
Helper function to continue chaining intermediate results.
@@ -4373,11 +4406,11 @@Add your own custom functions to the Underscore object.
@@ -4398,11 +4431,11 @@Add all mutator Array
functions to the wrapper.
Add all accessor Array
functions to the wrapper.
Named Exports
@@ -4611,11 +4644,11 @@Default Export
@@ -4624,11 +4657,11 @@Add all of the Underscore functions to the wrapper object.
@@ -4639,11 +4672,11 @@Legacy Node.js API.
@@ -4654,11 +4687,11 @@ESM Exports
@@ -4671,11 +4704,11 @@