Commit message (Collapse) | Author | Age | Files | Lines | |
---|---|---|---|---|---|
* | Fix clippy warning | René Kijewski | 2022-03-23 | 1 | -1/+1 |
| | |||||
* | Actix Web v4.0 is here | René Kijewski | 2022-02-25 | 2 | -5/+5 |
| | |||||
* | Increment patch versions of askama_{shared,escape} | René Kijewski | 2022-02-16 | 1 | -1/+1 |
| | |||||
* | Make json filter safe | René Kijewski | 2022-02-16 | 3 | -18/+25 |
| | | | | | | | | | | | | | | | | | | | | | Previously the built-in json filter had an issue that made it unsafe to use in HTML data. When used in HTML attributes an attacker who is able to supply an arbitrary string that should be JSON encoded could close the containing HTML element e.g. with `"</div>"`, and write arbitrary HTML code afterwards as long as they use apostrophes instead of quotation marks. The programmer could make this use case safe by explicitly escaping the JSON result: `{{data|json|escape}}`. In a `<script>` context the json filter was not usable at all, because in scripts HTML escaped entities are not parsed outside of XHTML documents. Without using the safe filter an attacker could close the current script using `"</script>"`. This PR fixes the problem by always escaping less-than, greater-than, ampersand, and apostrophe characters using their JSON unicode escape sequence `\u00xx`. Unless the programmer explicitly uses the safe filter, quotation marks are HTML encoded as `"`. In scripts the programmer should use the safe filter, otherwise not. | ||||
* | askama_mendes: upgrade mendes to 0.0.62 (#636) | Dirkjan Ochtman | 2022-02-09 | 1 | -1/+1 |
| | |||||
* | Add markdown filter | René Kijewski | 2022-02-07 | 3 | -3/+96 |
| | |||||
* | Enable tracking of the offending span of an error | René Kijewski | 2022-02-07 | 1 | -5/+24 |
| | |||||
* | Take reference to AST ident only once | René Kijewski | 2022-02-03 | 1 | -12/+17 |
| | |||||
* | Replace if-let with match | René Kijewski | 2022-02-03 | 1 | -4/+6 |
| | |||||
* | Replace custom Cow with actual Cow | René Kijewski | 2022-02-03 | 3 | -47/+42 |
| | |||||
* | Remove used optional dependency | René Kijewski | 2022-01-31 | 1 | -1/+0 |
| | |||||
* | Remove `panic!()` in `loop.cycle([])` | René Kijewski | 2022-01-31 | 1 | -1/+1 |
| | |||||
* | Don't wrap in StrLit just to extract the str imm. | René Kijewski | 2022-01-31 | 1 | -20/+4 |
| | |||||
* | Update comment in TemplateInput::new() | René Kijewski | 2022-01-31 | 1 | -1/+1 |
| | |||||
* | Make is_shadowing_variable() failable | René Kijewski | 2022-01-31 | 1 | -12/+24 |
| | |||||
* | Allow comments in `{% match %}` and remove panic! | René Kijewski | 2022-01-31 | 1 | -19/+2 |
| | |||||
* | Parse tuple expressions | René Kijewski | 2022-01-28 | 2 | -3/+163 |
| | | | | | | | Askama understands how to destructure tuples in let and match statements, but it does not understand how to build a tuple. This PR fixes this shortcoming. | ||||
* | Implement error propagation expression: `?` (#590) | René Kijewski | 2022-01-28 | 3 | -6/+30 |
| | | | | | | This change allows using the operator `?` in askama expressions. It works like the same operator in Rust: if a `Result` is `Ok`, it is unwrapped. If it is an error, then the `render()` method fails with this error value. | ||||
* | Unify handling of calls (#614) | René Kijewski | 2022-01-27 | 2 | -145/+157 |
| | | | | | Instead of having `Expr::VarCall`, `Expr::PathCall` and `Expr::MethodCall`, this PR unifies the handling of calls by removing the former three variants, and introducing `Expr::Call`. | ||||
* | Replace `&PathBuf` with `&Path` | René Kijewski | 2022-01-24 | 2 | -9/+9 |
| | | | | | PathBuf is to String like Path is to str, so `&PathBuf` is a pointer to a pointer. Clippy does not likes that. | ||||
* | Tweak attribute parsing some more | Dirkjan Ochtman | 2022-01-13 | 1 | -10/+7 |
| | |||||
* | Make sure '#[template(…)]' is given exactly once | René Kijewski | 2022-01-13 | 1 | -16/+22 |
| | |||||
* | Rename "meta" in proc_macro parser | René Kijewski | 2022-01-13 | 1 | -3/+3 |
| | |||||
* | Add template argument for contexts' hasher | René Kijewski | 2022-01-12 | 1 | -2/+2 |
| | | | | | In askama_shared::generate a custom hasher for the contexts can be given, so Heritage needs to accept the argument to. | ||||
* | `&Option<T>` → `Option<&T>` | René Kijewski | 2022-01-12 | 1 | -3/+3 |
| | |||||
* | Fully qualify some more paths in generated code | René Kijewski | 2022-01-12 | 1 | -3/+3 |
| | |||||
* | Determine Content-Type during compilation | René Kijewski | 2022-01-07 | 2 | -0/+10 |
| | |||||
* | Make TemplateInput::extension() reusable | René Kijewski | 2022-01-07 | 1 | -1/+7 |
| | |||||
* | Unshadow function escaping() | René Kijewski | 2022-01-07 | 1 | -3/+3 |
| | |||||
* | Move extension_to_mime_type() to askama_shared | René Kijewski | 2022-01-07 | 3 | -0/+30 |
| | |||||
* | Optimize parsing of ranges | René Kijewski | 2022-01-06 | 1 | -17/+13 |
| | | | | | | | | | | Right now almost every expression needs to be parsed twice: `expr_any()` first parses the left-hand side of a range expression, and if no `..` or `..=` was found the left-hand expression is parsed again, this time as the result of the function. This diff removes the second parsing step by first looking for `.. (opt rhs)`, then for `lhs .. (opt rhs)`. | ||||
* | Add `#[inline]` to trivial trait implementations | René Kijewski | 2022-01-06 | 1 | -0/+9 |
| | |||||
* | Remove the iron integration from generator | René Kijewski | 2022-01-06 | 2 | -27/+0 |
| | | | | | | | Issue #527 removed the askama_iron package, but not the integration if someone uses askama_derive's feature with "iron". The old askama_iron crate uses askama v0.10, so it will still work. | ||||
* | Add `#![forbid(unsafe_code)]` to all crates except askama_escape | René Kijewski | 2022-01-06 | 1 | -0/+1 |
| | |||||
* | Add `#![deny(unreachable_pub)]` to all crates | René Kijewski | 2022-01-06 | 1 | -0/+1 |
| | |||||
* | Omit implicit lifetimes | René Kijewski | 2022-01-06 | 4 | -7/+7 |
| | |||||
* | Same number of repeats in macro pattern and body | René Kijewski | 2022-01-06 | 1 | -1/+1 |
| | |||||
* | No need to build a String when it gets referenced as &str implicitly | René Kijewski | 2022-01-06 | 1 | -6/+0 |
| | |||||
* | Combine imports from the same module | René Kijewski | 2022-01-06 | 1 | -2/+1 |
| | |||||
* | Update for actix-web beta | René Kijewski | 2022-01-05 | 1 | -7/+3 |
| | |||||
* | Bump version number for askama_shared | Dirkjan Ochtman | 2022-01-04 | 1 | -1/+1 |
| | |||||
* | askama_rocket: revert to rocket 0.4 for release | Dirkjan Ochtman | 2022-01-04 | 1 | -2/+4 |
| | |||||
* | askama_actix: revert to actix-web v3 for release | Dirkjan Ochtman | 2022-01-04 | 1 | -3/+4 |
| | |||||
* | Use a separate trait for object safety (#579) | Dirkjan Ochtman | 2021-12-15 | 1 | -17/+5 |
| | | | | | | | | | | | | | | | | | | This is relatively major change to the main trait's API. For context, I always started from the concept of monomorphized traits, but later several contributors asked about object safety. At that point I made `Template` object-safe, and then even later added a `SizedTemplate` to make some things easier for people who don't need object safety. However, having object-safety in the primary trait is bad for performance (a substantial number of calls into the virtual `Write` trait is relatively slow), and I don't think those who don't need object safety should pay for the cost of having it. Additionally, I feel using associated consts for the extension and size hint is more idiomatic than having accessor methods. I don't know why I didn't use these from the start -- maybe associated consts didn't exist yet, or I didn't yet know how/when to use them. Askama is pretty old at this point... | ||||
* | updated for actix-web 4.0.0-beta.14 | CrunkLord420 | 2021-12-14 | 1 | -1/+2 |
| | |||||
* | Use char for patterns where possible | Dirkjan Ochtman | 2021-12-08 | 2 | -3/+3 |
| | |||||
* | Update axum to 0.4 (by switching to axum-core) | Michael Alyn Miller | 2021-12-05 | 1 | -5/+3 |
| | |||||
* | Move askama_mendes integration into Askama repo (#561) | Dirkjan Ochtman | 2021-12-01 | 1 | -2/+2 |
| | |||||
* | Merge pull request #562 from djc/prepare-0.12 | René Kijewski | 2021-11-30 | 1 | -3/+2 |
|\ | | | | | Prepare 0.12 | ||||
| * | Bump version numbers | Dirkjan Ochtman | 2021-11-24 | 1 | -2/+2 |
| | |