1 line
7.3 KiB
Plaintext
1 line
7.3 KiB
Plaintext
|
{"version":3,"file":"static.js","sources":["src/static.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2020 Google LLC\n * SPDX-License-Identifier: BSD-3-Clause\n */\n\n// Any new exports need to be added to the export statement in\n// `packages/lit/src/index.all.ts`.\n\nimport {html as coreHtml, svg as coreSvg, TemplateResult} from './lit-html.js';\n\nexport interface StaticValue {\n /** The value to interpolate as-is into the template. */\n _$litStatic$: string;\n\n /**\n * A value that can't be decoded from ordinary JSON, make it harder for\n * a attacker-controlled data that goes through JSON.parse to produce a valid\n * StaticValue.\n */\n r: typeof brand;\n}\n\n/**\n * Prevents JSON injection attacks.\n *\n * The goals of this brand:\n * 1) fast to check\n * 2) code is small on the wire\n * 3) multiple versions of Lit in a single page will all produce mutually\n * interoperable StaticValues\n * 4) normal JSON.parse (without an unusual reviver) can not produce a\n * StaticValue\n *\n * Symbols satisfy (1), (2), and (4). We use Symbol.for to satisfy (3), but\n * we don't care about the key, so we break ties via (2) and use the empty\n * string.\n */\nconst brand = Symbol.for('');\n\n/** Safely extracts the string part of a StaticValue. */\nconst unwrapStaticValue = (value: unknown): string | undefined => {\n if ((value as Partial<StaticValue>)?.r !== brand) {\n return undefined;\n }\n return (value as Partial<StaticValue>)?.['_$litStatic$'];\n};\n\n/**\n * Wraps a string so that it behaves like part of the static template\n * strings instead of a dynamic value.\n *\n * Users must take care to ensure that adding the static string to the template\n * results in well-formed HTML, or else templates may break unexpectedly.\n *\n * Note that this function is unsafe to use on untrusted content, as it will be\n * directly parsed into HTML. Do not pass user input to this function\n * without sanitizing it.\n *\n * Static values can be changed, but they will cause a complete re-render\n * since they effectively create a new template.\n */\nexport const unsafeStatic = (value: string): StaticValue => ({\n ['_$litStatic$']: value,\n r: brand,\n});\n\nconst textFromStatic = (value: StaticValue) => {\n if (value['_$litStatic$'] !== undefined) {\n return value['_$litStatic$'];\n } else {\n throw new Error(\n `Value passed to 'literal' function must be a 'literal' result: ${value}. Use 'unsafeStatic' to pass non-literal values, but\n take care to ensure page security.`\n );\n }\n};\n\n/**\n * Tags a string literal so that it behaves like part of the static template\n * strings instead of a dynamic value.\n *\n * The only values that may be used in template expressions are other tagged\n * `literal` results or `unsafeStatic` values (note that untrusted content\n * should never be passed to `unsafeStatic`).\n *\n * Users must take care to ensure that adding the static string to the template\n * results in well-formed HTML, or else templates may break unexpectedly.\n *\n * Static values can be changed, but they will cause a complete re-render since\n * they effectively create a new template.\n */\nexport const literal = (\n strings: TemplateStringsArray,\n ...values: unknown[]\n): StaticValue => ({\n ['_$litStatic$']: values.reduce(\n (acc, v, idx) => acc + textFromStatic(v as StaticValue) + strings[idx + 1],\n strings[0]\n ) as string,\n r: brand,\n});\n\nconst stringsCache = new Map<string, TemplateStringsArray>();\n\n/**\n * Wraps a lit-html template tag (`html` or `svg`) to add static value support.\n */\nexport const withStatic =\n (coreTag: typeof coreHtml | typeof coreSvg) =>\n (strings: TemplateStringsArray, ...values: unknown[]): TemplateResult => {\n const l = values.length;\n let staticValue: string | undefined;\n let dynamicValue: unknown;\n const staticStrings: Array<string> = [];\n const dynamicValues: Array<unknown> = [];\n let i = 0;\n let hasStatics = false;\n let s: string;\n\n while (i < l) {\n s = st
|