From 43cdd943b2f152dcde775ecc5d32f8dc08b75066 Mon Sep 17 00:00:00 2001
From: Rich Harris <richard.a.harris@gmail.com>
Date: Wed, 12 Dec 2018 21:03:39 -0500
Subject: [PATCH] prevent invalid scripts

---
 src/compile/Component.ts                      | 55 ++++++++++++++-----
 .../errors.json                               | 15 +++++
 .../input.html                                |  7 +++
 .../errors.json                               | 15 +++++
 .../multiple-script-module-context/input.html |  7 +++
 .../script-invalid-context/errors.json        | 15 +++++
 .../samples/script-invalid-context/input.html |  3 +
 7 files changed, 104 insertions(+), 13 deletions(-)
 create mode 100644 test/validator/samples/multiple-script-default-context/errors.json
 create mode 100644 test/validator/samples/multiple-script-default-context/input.html
 create mode 100644 test/validator/samples/multiple-script-module-context/errors.json
 create mode 100644 test/validator/samples/multiple-script-module-context/input.html
 create mode 100644 test/validator/samples/script-invalid-context/errors.json
 create mode 100644 test/validator/samples/script-invalid-context/input.html

diff --git a/src/compile/Component.ts b/src/compile/Component.ts
index 92fdab212c..37abcb591a 100644
--- a/src/compile/Component.ts
+++ b/src/compile/Component.ts
@@ -38,17 +38,6 @@ childKeys.EachBlock = childKeys.IfBlock = ['children', 'else'];
 childKeys.Attribute = ['value'];
 childKeys.ExportNamedDeclaration = ['declaration', 'specifiers'];
 
-function get_context(script) {
-	const context = script.attributes.find(attribute => attribute.name === 'context');
-	if (!context) return 'default';
-
-	if (context.value.length !== 1 || context.value[0].type !== 'Text') {
-		throw new Error(`context attribute must be static`);
-	}
-
-	return context.value[0].data;
-}
-
 export default class Component {
 	stats: Stats;
 
@@ -132,8 +121,25 @@ export default class Component {
 		this.stylesheet = new Stylesheet(source, ast, options.filename, options.dev);
 		this.stylesheet.validate(this);
 
-		this.module_script = ast.js.find(script => get_context(script) === 'module');
-		this.instance_script = ast.js.find(script => get_context(script) === 'default');
+		const module_scripts = ast.js.filter(script => this.get_context(script) === 'module');
+		const instance_scripts = ast.js.filter(script => this.get_context(script) === 'default');
+
+		if (module_scripts.length > 1) {
+			this.error(module_scripts[1], {
+				code: `invalid-script`,
+				message: `A component can only have one <script context="module"> element`
+			});
+		}
+
+		if (instance_scripts.length > 1) {
+			this.error(instance_scripts[1], {
+				code: `invalid-script`,
+				message: `A component can only have one instance-level <script> element`
+			});
+		}
+
+		this.module_script = module_scripts[0];
+		this.instance_script = instance_scripts[0];
 
 		this.meta = process_meta(this, this.ast.html.children);
 		this.namespace = namespaces[this.meta.namespace] || this.meta.namespace;
@@ -884,6 +890,29 @@ export default class Component {
 			message: `'${name}' is not defined`
 		});
 	}
+
+	get_context(script) {
+		const context = script.attributes.find(attribute => attribute.name === 'context');
+		if (!context) return 'default';
+
+		if (context.value.length !== 1 || context.value[0].type !== 'Text') {
+			this.error(script, {
+				code: 'invalid-script',
+				message: `context attribute must be static`
+			});
+		}
+
+		const value = context.value[0].data;
+
+		if (value !== 'module') {
+			this.error(context, {
+				code: `invalid-script`,
+				message: `If the context attribute is supplied, its value must be "module"`
+			});
+		}
+
+		return value;
+	}
 }
 
 function process_meta(component, nodes) {
diff --git a/test/validator/samples/multiple-script-default-context/errors.json b/test/validator/samples/multiple-script-default-context/errors.json
new file mode 100644
index 0000000000..6e9a53d691
--- /dev/null
+++ b/test/validator/samples/multiple-script-default-context/errors.json
@@ -0,0 +1,15 @@
+[{
+	"code": "invalid-script",
+	"message": "A component can only have one instance-level <script> element",
+	"pos": 30,
+	"start": {
+		"line": 5,
+		"column": 0,
+		"character": 30
+	},
+	"end": {
+		"line": 7,
+		"column": 9,
+		"character": 58
+	}
+}]
\ No newline at end of file
diff --git a/test/validator/samples/multiple-script-default-context/input.html b/test/validator/samples/multiple-script-default-context/input.html
new file mode 100644
index 0000000000..9fdca4ccfc
--- /dev/null
+++ b/test/validator/samples/multiple-script-default-context/input.html
@@ -0,0 +1,7 @@
+<script>
+	let foo;
+</script>
+
+<script>
+	let bar;
+</script>
\ No newline at end of file
diff --git a/test/validator/samples/multiple-script-module-context/errors.json b/test/validator/samples/multiple-script-module-context/errors.json
new file mode 100644
index 0000000000..ef8dc15273
--- /dev/null
+++ b/test/validator/samples/multiple-script-module-context/errors.json
@@ -0,0 +1,15 @@
+[{
+	"code": "invalid-script",
+	"message": "A component can only have one <script context=\"module\"> element",
+	"pos": 47,
+	"start": {
+		"line": 5,
+		"column": 0,
+		"character": 47
+	},
+	"end": {
+		"line": 7,
+		"column": 9,
+		"character": 92
+	}
+}]
\ No newline at end of file
diff --git a/test/validator/samples/multiple-script-module-context/input.html b/test/validator/samples/multiple-script-module-context/input.html
new file mode 100644
index 0000000000..b43f3cb8c8
--- /dev/null
+++ b/test/validator/samples/multiple-script-module-context/input.html
@@ -0,0 +1,7 @@
+<script context="module">
+	let foo;
+</script>
+
+<script context="module">
+	let bar;
+</script>
\ No newline at end of file
diff --git a/test/validator/samples/script-invalid-context/errors.json b/test/validator/samples/script-invalid-context/errors.json
new file mode 100644
index 0000000000..9c276d932d
--- /dev/null
+++ b/test/validator/samples/script-invalid-context/errors.json
@@ -0,0 +1,15 @@
+[{
+	"code": "invalid-script",
+	"message": "If the context attribute is supplied, its value must be \"module\"",
+	"pos": 8,
+	"start": {
+		"line": 1,
+		"column": 8,
+		"character": 8
+	},
+	"end": {
+		"line": 1,
+		"column": 22,
+		"character": 22
+	}
+}]
\ No newline at end of file
diff --git a/test/validator/samples/script-invalid-context/input.html b/test/validator/samples/script-invalid-context/input.html
new file mode 100644
index 0000000000..d25935d25b
--- /dev/null
+++ b/test/validator/samples/script-invalid-context/input.html
@@ -0,0 +1,3 @@
+<script context="nope">
+	let foo;
+</script>
\ No newline at end of file