fix: disallow sequence expressions in @const tags (#11357)

* fix: disallow sequence expressions in `@const` tags closes #11349 * allow parenthesized sequence expression
sveltejs · Apr 29, 2024 · 5e0845f · 5e0845f
1 parent 0cf10a3
commit 5e0845f
Show file tree

Hide file tree

Showing 6 changed files with 32 additions and 3 deletions.
diff --git a/.changeset/orange-masks-exercise.md b/.changeset/orange-masks-exercise.md
@@ -0,0 +1,5 @@
+---
+"svelte": patch
+---
+
+fix: disallow sequence expressions in `@const` tags
diff --git a/packages/svelte/messages/compile-errors/template.md b/packages/svelte/messages/compile-errors/template.md
@@ -94,7 +94,7 @@
 
 ## const_tag_invalid_expression
 
-> {@const ...} must be an assignment
+> {@const ...} must consist of a single variable declaration
 
 ## const_tag_invalid_placement
 

diff --git a/packages/svelte/src/compiler/errors.js b/packages/svelte/src/compiler/errors.js
@@ -729,12 +729,12 @@ export function component_invalid_directive(node) {
 }
 
 /**
- * {@const ...} must be an assignment
+ * {@const ...} must consist of a single variable declaration
  * @param {null | number | NodeLike} node
  * @returns {never}
  */
 export function const_tag_invalid_expression(node) {
-	e(node, "const_tag_invalid_expression", "{@const ...} must be an assignment");
+	e(node, "const_tag_invalid_expression", "{@const ...} must consist of a single variable declaration");
 }
 
 /**

diff --git a/packages/svelte/src/compiler/phases/1-parse/state/tag.js b/packages/svelte/src/compiler/phases/1-parse/state/tag.js
@@ -551,7 +551,15 @@ function special(parser) {
 		parser.eat('=', true);
 		parser.allow_whitespace();
 
+		const expression_start = parser.index;
 		const init = read_expression(parser);
+		if (
+			init.type === 'SequenceExpression' &&
+			!parser.template.substring(expression_start, init.start).includes('(')
+		) {
+			// const a = (b, c) is allowed but a = b, c = d is not;
+			e.const_tag_invalid_expression(init);
+		}
 		parser.allow_whitespace();
 
 		parser.eat('}', true);

diff --git a/packages/svelte/tests/compiler-errors/samples/const-tag-sequence/_config.js b/packages/svelte/tests/compiler-errors/samples/const-tag-sequence/_config.js
@@ -0,0 +1,9 @@
+import { test } from '../../test';
+
+export default test({
+	error: {
+		code: 'const_tag_invalid_expression',
+		message: '{@const ...} must consist of a single variable declaration',
+		position: [75, 93]
+	}
+});
diff --git a/packages/svelte/tests/compiler-errors/samples/const-tag-sequence/main.svelte b/packages/svelte/tests/compiler-errors/samples/const-tag-sequence/main.svelte
@@ -0,0 +1,7 @@
+{#if true}
+	{@const foo = ('bar', 'baz')}
+{/if}
+
+{#if true}
+	{@const foo = 'foo', bar = 'bar'}
+{/if}