Backport changes made to tera

Cargo.toml

@@ -38,13 +38,18 @@ chrono-tz = {version = "0.9", optional = true}
 # used in get_random function
 rand = {version = "0.8", optional = true}
 
+# used in async
+tokio = {version = "1", optional = true}
+async-recursion = {version = "1", optional = true}
+
 [dev-dependencies]
 serde_derive = "1.0"
 pretty_assertions = "1"
 tempfile = "3"
 
 [features]
-default = ["builtins"]
+default = ["builtins", "async"]
+async = ["dep:async-recursion", "dep:tokio"]
 builtins = ["urlencode", "slug", "humansize", "chrono", "chrono-tz", "rand"]
 urlencode = ["percent-encoding"]
 preserve_order = ["serde_json/preserve_order"]

benches/big_context.rs

@@ -71,7 +71,7 @@ fn bench_big_loop_big_object(b: &mut test::Bencher) {
     )])
     .unwrap();
     let mut context = Context::new();
-    context.insert("objects", &objects);
+    context.insert("objects", &objects).unwrap();
     let rendering = tera.render("big_loop.html", &context).expect("Good render");
     assert_eq!(&rendering[..], "0123");
     // cloning as making the context is the bottleneck part
@@ -93,8 +93,8 @@ fn bench_macro_big_object(b: &mut test::Bencher) {
     ])
     .unwrap();
     let mut context = Context::new();
-    context.insert("big_object", &big_object);
-    context.insert("iterations", &(0..500).collect::<Vec<usize>>());
+    context.insert("big_object", &big_object).unwrap();
+    context.insert("iterations", &(0..500).collect::<Vec<usize>>()).unwrap();
     let rendering = tera.render("big_loop.html", &context).expect("Good render");
     assert_eq!(rendering.len(), 500);
     assert_eq!(rendering.chars().next().expect("Char"), '1');
@@ -116,7 +116,7 @@ fn bench_macro_big_object_no_loop_with_set(b: &mut test::Bencher) {
     )])
     .unwrap();
     let mut context = Context::new();
-    context.insert("two_fields", &TwoFields::new());
+    context.insert("two_fields", &TwoFields::new()).unwrap();
     let rendering = tera.render("no_loop.html", &context).expect("Good render");
     assert_eq!(&rendering[..], "\nA\nB\nC\n");
     // cloning as making the context is the bottleneck part
@@ -143,7 +143,7 @@ fn bench_macro_big_object_no_loop_macro_call(b: &mut test::Bencher) {
     ])
     .unwrap();
     let mut context = Context::new();
-    context.insert("two_fields", &TwoFields::new());
+    context.insert("two_fields", &TwoFields::new()).unwrap();
     let rendering = tera.render("no_loop.html", &context).expect("Good render");
     assert_eq!(&rendering[..], "A");
     // cloning as making the context is the bottleneck part

benches/templates.rs

@@ -24,7 +24,7 @@ pub fn big_table(b: &mut test::Bencher) {
     let mut tera = Tera::default();
     tera.add_raw_templates(vec![("big-table.html", BIG_TABLE_TEMPLATE)]).unwrap();
     let mut ctx = Context::new();
-    ctx.insert("table", &table);
+    ctx.insert("table", &table).unwrap();
 
     b.iter(|| tera.render("big-table.html", &ctx));
 }
@@ -46,7 +46,7 @@ pub fn teams(b: &mut test::Bencher) {
     let mut tera = Tera::default();
     tera.add_raw_templates(vec![("teams.html", TEAMS_TEMPLATE)]).unwrap();
     let mut ctx = Context::new();
-    ctx.insert("year", &2015);
+    ctx.insert("year", &2015).unwrap();
     ctx.insert(
         "teams",
         &vec![
@@ -55,7 +55,8 @@ pub fn teams(b: &mut test::Bencher) {
             Team { name: "Guangzhou".into(), score: 22 },
             Team { name: "Shandong".into(), score: 12 },
         ],
-    );
+    )
+    .unwrap();
 
     b.iter(|| tera.render("teams.html", &ctx));
 }

benches/tera.rs

@@ -105,8 +105,8 @@ fn bench_rendering_only_variable(b: &mut test::Bencher) {
     let mut tera = Tera::default();
     tera.add_raw_template("test.html", VARIABLE_ONLY).unwrap();
     let mut context = Context::new();
-    context.insert("product", &Product::new());
-    context.insert("username", &"bob");
+    context.insert("product", &Product::new()).unwrap();
+    context.insert("username", &"bob").unwrap();
 
     b.iter(|| tera.render("test.html", &context));
 }
@@ -116,8 +116,8 @@ fn bench_rendering_basic_template(b: &mut test::Bencher) {
     let mut tera = Tera::default();
     tera.add_raw_template("bench.html", SIMPLE_TEMPLATE).unwrap();
     let mut context = Context::new();
-    context.insert("product", &Product::new());
-    context.insert("username", &"bob");
+    context.insert("product", &Product::new()).unwrap();
+    context.insert("username", &"bob").unwrap();
 
     b.iter(|| tera.render("bench.html", &context));
 }
@@ -127,8 +127,8 @@ fn bench_rendering_only_parent(b: &mut test::Bencher) {
     let mut tera = Tera::default();
     tera.add_raw_templates(vec![("parent.html", PARENT_TEMPLATE)]).unwrap();
     let mut context = Context::new();
-    context.insert("product", &Product::new());
-    context.insert("username", &"bob");
+    context.insert("product", &Product::new()).unwrap();
+    context.insert("username", &"bob").unwrap();
 
     b.iter(|| tera.render("parent.html", &context));
 }
@@ -139,8 +139,8 @@ fn bench_rendering_only_macro_call(b: &mut test::Bencher) {
     tera.add_raw_templates(vec![("hey.html", USE_MACRO_TEMPLATE), ("macros.html", MACRO_TEMPLATE)])
         .unwrap();
     let mut context = Context::new();
-    context.insert("product", &Product::new());
-    context.insert("username", &"bob");
+    context.insert("product", &Product::new()).unwrap();
+    context.insert("username", &"bob").unwrap();
 
     b.iter(|| tera.render("hey.html", &context));
 }
@@ -151,8 +151,8 @@ fn bench_rendering_only_inheritance(b: &mut test::Bencher) {
     tera.add_raw_templates(vec![("parent.html", PARENT_TEMPLATE), ("child.html", CHILD_TEMPLATE)])
         .unwrap();
     let mut context = Context::new();
-    context.insert("product", &Product::new());
-    context.insert("username", &"bob");
+    context.insert("product", &Product::new()).unwrap();
+    context.insert("username", &"bob").unwrap();
 
     b.iter(|| tera.render("child.html", &context));
 }
@@ -167,8 +167,8 @@ fn bench_rendering_inheritance_and_macros(b: &mut test::Bencher) {
     ])
     .unwrap();
     let mut context = Context::new();
-    context.insert("product", &Product::new());
-    context.insert("username", &"bob");
+    context.insert("product", &Product::new()).unwrap();
+    context.insert("username", &"bob").unwrap();
 
     b.iter(|| tera.render("child.html", &context));
 }
@@ -209,7 +209,7 @@ fn bench_huge_loop(b: &mut test::Bencher) {
     )])
     .unwrap();
     let mut context = Context::new();
-    context.insert("rows", &rows);
+    context.insert("rows", &rows).unwrap();
 
     b.iter(|| tera.render("huge.html", &context.clone()));
 }
@@ -256,7 +256,7 @@ fn access_deep_object(b: &mut test::Bencher) {
     .unwrap();
     let mut context = Context::new();
     println!("{:?}", deep_object());
-    context.insert("deep_object", &deep_object());
+    context.insert("deep_object", &deep_object()).unwrap();
     assert!(tera.render("deep_object.html", &context).unwrap().contains("ornery"));
 
     b.iter(|| tera.render("deep_object.html", &context));
@@ -274,7 +274,7 @@ fn access_deep_object_with_literal(b: &mut test::Bencher) {
     )])
     .unwrap();
     let mut context = Context::new();
-    context.insert("deep_object", &deep_object());
+    context.insert("deep_object", &deep_object()).unwrap();
     assert!(tera.render("deep_object.html", &context).unwrap().contains("ornery"));
 
     b.iter(|| tera.render("deep_object.html", &context));

examples/basic/main.rs

@@ -32,10 +32,10 @@ pub fn do_nothing_filter(value: &Value, _: &HashMap<String, Value>) -> Result<Va
 
 fn main() {
     let mut context = Context::new();
-    context.insert("username", &"Bob");
-    context.insert("numbers", &vec![1, 2, 3]);
-    context.insert("show_all", &false);
-    context.insert("bio", &"<script>alert('pwnd');</script>");
+    context.insert("username", &"Bob").unwrap();
+    context.insert("numbers", &vec![1, 2, 3]).unwrap();
+    context.insert("show_all", &false).unwrap();
+    context.insert("bio", &"<script>alert('pwnd');</script>").unwrap();
 
     // A one off template
     Tera::one_off("hello", &Context::new(), true).unwrap();

examples/bench/main.rs

@@ -27,7 +27,7 @@ fn main() {
     let mut tera = Tera::default();
     tera.add_raw_templates(vec![("big-table.html", BIG_TABLE_TEMPLATE)]).unwrap();
     let mut ctx = Context::new();
-    ctx.insert("table", &table);
+    ctx.insert("table", &table).unwrap();
 
     let _ = tera.render("big-table.html", &ctx).unwrap();
     println!("Done!");

src/builtins/filters/array.rs

@@ -297,7 +297,7 @@ pub fn concat(value: &Value, args: &HashMap<String, Value>) -> Result<Value> {
                     arr.push(val.clone());
                 }
             }
-            _ => unreachable!("Got something other than an array??"),
+            _ => return Err(Error::msg("The `concat` filter can only concat with an array")),
         }
     } else {
         arr.push(value.clone());

src/builtins/filters/object.rs

@@ -1,7 +1,7 @@
 /// Filters operating on numbers
 use std::collections::HashMap;
 
-use serde_json::value::Value;
+use serde_json::{to_value, value::Value};
 
 use crate::errors::{Error, Result};
 
@@ -29,6 +29,29 @@ pub fn get(value: &Value, args: &HashMap<String, Value>) -> Result<Value> {
     }
 }
 
+/// Merge two objects, the second object is indicated by the `with` argument.
+/// The second object's values will overwrite the first's in the event of a key conflict.
+pub fn merge(value: &Value, args: &HashMap<String, Value>) -> Result<Value> {
+    let left = match value.as_object() {
+        Some(val) => val,
+        None => return Err(Error::msg("Filter `merge` was used on a value that isn't an object")),
+    };
+    let with = match args.get("with") {
+        Some(val) => val,
+        None => return Err(Error::msg("The `merge` filter has to have a `with` argument")),
+    };
+    match with.as_object() {
+        Some(right) => {
+            let mut result = left.clone();
+            result.extend(right.clone());
+            // We've already confirmed both sides were HashMaps, the result is a HashMap -
+            // - so unwrap
+            Ok(to_value(result).unwrap())
+        }
+        None => Err(Error::msg("The `with` argument for the `get` filter must be an object")),
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -87,4 +110,27 @@ mod tests {
         assert!(result.is_ok());
         assert_eq!(result.unwrap(), to_value("default").unwrap());
     }
+
+    #[test]
+    fn test_merge_filter() {
+        let mut obj_1 = HashMap::new();
+        obj_1.insert("1".to_string(), "first".to_string());
+        obj_1.insert("2".to_string(), "second".to_string());
+
+        let mut obj_2 = HashMap::new();
+        obj_2.insert("2".to_string(), "SECOND".to_string());
+        obj_2.insert("3".to_string(), "third".to_string());
+
+        let mut args = HashMap::new();
+        args.insert("with".to_string(), to_value(obj_2).unwrap());
+
+        let result = merge(&to_value(&obj_1).unwrap(), &args);
+        assert!(result.is_ok());
+
+        let mut expected = HashMap::new();
+        expected.insert("1".to_string(), "first".to_string());
+        expected.insert("2".to_string(), "SECOND".to_string());
+        expected.insert("3".to_string(), "third".to_string());
+        assert_eq!(result.unwrap(), to_value(expected).unwrap());
+    }
 }

src/builtins/functions.rs

@@ -74,6 +74,16 @@ pub fn range(args: &HashMap<String, Value>) -> Result<Value> {
         ));
     }
 
+    let expected_num_elements = (end - start) / step_by;
+
+    if expected_num_elements > crate::constraints::RANGE_MAX_ELEMENTS {
+        return Err(Error::msg(format!(
+            "Function `range` was called with a range that would generate {} elements, but the maximum allowed is {}",
+            expected_num_elements,
+            crate::constraints::RANGE_MAX_ELEMENTS
+        )));
+    }
+
     let mut i = start;
     let mut res = vec![];
     while i < end {
@@ -171,29 +181,6 @@ pub fn get_random(args: &HashMap<String, Value>) -> Result<Value> {
     Ok(Value::Number(res.into()))
 }
 
-pub fn get_env(args: &HashMap<String, Value>) -> Result<Value> {
-    let name = match args.get("name") {
-        Some(val) => match from_value::<String>(val.clone()) {
-            Ok(v) => v,
-            Err(_) => {
-                return Err(Error::msg(format!(
-                    "Function `get_env` received name={} but `name` can only be a string",
-                    val
-                )));
-            }
-        },
-        None => return Err(Error::msg("Function `get_env` didn't receive a `name` argument")),
-    };
-
-    match std::env::var(&name).ok() {
-        Some(res) => Ok(Value::String(res)),
-        None => match args.get("default") {
-            Some(default) => Ok(default.clone()),
-            None => Err(Error::msg(format!("Environment variable `{}` not found", &name))),
-        },
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use std::collections::HashMap;
@@ -309,33 +296,4 @@ mod tests {
         assert!(res.as_i64().unwrap() >= 5);
         assert!(res.as_i64().unwrap() < 10);
     }
-
-    #[test]
-    fn get_env_existing() {
-        std::env::set_var("TERA_TEST", "true");
-        let mut args = HashMap::new();
-        args.insert("name".to_string(), to_value("TERA_TEST").unwrap());
-        let res = get_env(&args).unwrap();
-        assert!(res.is_string());
-        assert_eq!(res.as_str().unwrap(), "true");
-        std::env::remove_var("TERA_TEST");
-    }
-
-    #[test]
-    fn get_env_non_existing_no_default() {
-        let mut args = HashMap::new();
-        args.insert("name".to_string(), to_value("UNKNOWN_VAR").unwrap());
-        let res = get_env(&args);
-        assert!(res.is_err());
-    }
-
-    #[test]
-    fn get_env_non_existing_with_default() {
-        let mut args = HashMap::new();
-        args.insert("name".to_string(), to_value("UNKNOWN_VAR").unwrap());
-        args.insert("default".to_string(), to_value("false").unwrap());
-        let res = get_env(&args).unwrap();
-        assert!(res.is_string());
-        assert_eq!(res.as_str().unwrap(), "false");
-    }
 }

src/constraints.rs

@@ -0,0 +1,15 @@
+/// Renderer limits
+pub const RENDER_BLOCK_MAX_DEPTH: usize = 5;
+pub const RENDER_BODY_MAX_DEPTH: usize = 20;
+
+/// Stack frame size limit
+pub const STACK_FRAME_MAX_ENTRIES: usize = 50;
+
+/// STACK_FRAME_MAX_SIZE
+pub const STACK_FRAME_MAX_SIZE: usize = 1024 * 1024 * 4;
+
+/// eval_expression max array element size
+pub const EXPRESSION_MAX_ARRAY_LENGTH: usize = 100;
+
+// range max elements
+pub const RANGE_MAX_ELEMENTS: usize = 500;