handlebars-source 4.7.8 → 4.7.10

data/handlebars.runtime.js

@@ -1,7 +1,7 @@
 /**!
 
  @license
- handlebars v4.7.8
+ handlebars v4.7.10
 
 Copyright (C) 2011-2019 by Yehuda Katz
 
@@ -95,7 +95,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	// Each of these augment the Handlebars object. No need to setup here.
 	// (This is done to easily share code between commonjs and browse envs)
 
-	var _handlebarsSafeString = __webpack_require__(76);
+	var _handlebarsSafeString = __webpack_require__(75);
 
 	var _handlebarsSafeString2 = _interopRequireDefault(_handlebarsSafeString);
 
@@ -107,11 +107,11 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	var Utils = _interopRequireWildcard(_handlebarsUtils);
 
-	var _handlebarsRuntime = __webpack_require__(77);
+	var _handlebarsRuntime = __webpack_require__(76);
 
 	var runtime = _interopRequireWildcard(_handlebarsRuntime);
 
-	var _handlebarsNoConflict = __webpack_require__(82);
+	var _handlebarsNoConflict = __webpack_require__(81);
 
 	var _handlebarsNoConflict2 = _interopRequireDefault(_handlebarsNoConflict);
 
@@ -209,7 +209,7 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	var _internalProtoAccess = __webpack_require__(72);
 
-	var VERSION = '4.7.8';
+	var VERSION = '4.7.10';
 	exports.VERSION = VERSION;
 	var COMPILER_REVISION = 8;
 	exports.COMPILER_REVISION = COMPILER_REVISION;
@@ -383,8 +383,9 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	function escapeExpression(string) {
 	  if (typeof string !== 'string') {
-	    // don't escape SafeStrings, since they're already safe
-	    if (string && string.toHTML) {
+	    // don't escape SafeStrings, since they're already safe. Other values with a
+	    // "toHTML" key, e.g. from JSON context data, are escaped like any object.
+	    if (string && typeof string.toHTML === 'function') {
 	      return string.toHTML();
 	    } else if (string == null) {
 	      return '';
@@ -447,11 +448,15 @@ return /******/ (function(modules) { // webpackBootstrap
 	      column = undefined,
 	      endColumn = undefined;
 
-	  if (loc) {
+	  // Hand-built ASTs may carry a partial loc; never let the location
+	  // bookkeeping mask the actual error message.
+	  if (loc && loc.start) {
 	    line = loc.start.line;
-	    endLineNumber = loc.end.line;
 	    column = loc.start.column;
-	    endColumn = loc.end.column;
+	    if (loc.end) {
+	      endLineNumber = loc.end.line;
+	      endColumn = loc.end.column;
+	    }
 
 	    message += ' - ' + line + ':' + column;
 	  }
@@ -586,7 +591,8 @@ return /******/ (function(modules) { // webpackBootstrap
 	  if (instance.helpers[helperName]) {
 	    instance.hooks[helperName] = instance.helpers[helperName];
 	    if (!keepHelper) {
-	      delete instance.helpers[helperName];
+	      // Using delete is slow
+	      instance.helpers[helperName] = undefined;
 	    }
 	  }
 	}
@@ -658,6 +664,26 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	var _exception2 = _interopRequireDefault(_exception);
 
+	/**
+	 * Close an unfinished iterator after the block body threw, like for...of does,
+	 * so that generators can run their cleanup code.
+	 *
+	 * Errors thrown while closing, including by a `return` getter, are ignored:
+	 * the block's error is the cause and is the one the caller must see.
+	 *
+	 * @param {Iterator} iterator the iterator that was being consumed
+	 */
+	function closeIterator(iterator) {
+	  try {
+	    var _close = iterator['return'];
+	    if (_utils.isFunction(_close)) {
+	      _close.call(iterator);
+	    }
+	  } catch (closeError) {
+	    // NOP
+	  }
+	}
+
 	exports['default'] = function (instance) {
 	  instance.registerHelper('each', function (context, options) {
 	    if (!options) {
@@ -683,7 +709,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	      data = _utils.createFrame(options.data);
 	    }
 
-	    function execIteration(field, index, last) {
+	    function execIteration(field, index, last, value) {
 	      if (data) {
 	        data.key = field;
 	        data.index = index;
@@ -695,9 +721,9 @@ return /******/ (function(modules) { // webpackBootstrap
 	        }
 	      }
 
-	      ret = ret + fn(context[field], {
+	      ret = ret + fn(value, {
 	        data: data,
-	        blockParams: _utils.blockParams([context[field], field], [contextPath + field, null])
+	        blockParams: _utils.blockParams([value, field], [contextPath + field, null])
 	      });
 	    }
 
@@ -705,18 +731,24 @@ return /******/ (function(modules) { // webpackBootstrap
 	      if (_utils.isArray(context)) {
 	        for (var j = context.length; i < j; i++) {
 	          if (i in context) {
-	            execIteration(i, i, i === context.length - 1);
+	            execIteration(i, i, i === context.length - 1, context[i]);
 	          }
 	        }
 	      } else if (typeof _Symbol === 'function' && context[_Symbol$iterator]) {
-	        var newContext = [];
 	        var iterator = _getIterator(context);
-	        for (var it = iterator.next(); !it.done; it = iterator.next()) {
-	          newContext.push(it.value);
-	        }
-	        context = newContext;
-	        for (var j = context.length; i < j; i++) {
-	          execIteration(i, i, i === context.length - 1);
+	        var current = iterator.next();
+	        while (!current.done) {
+	          var next = iterator.next();
+	          try {
+	            execIteration(i, i, next.done, current.value);
+	          } catch (e) {
+	            if (!next.done) {
+	              closeIterator(iterator);
+	            }
+	            throw e;
+	          }
+	          current = next;
+	          i++;
 	        }
 	      } else {
 	        (function () {
@@ -727,13 +759,13 @@ return /******/ (function(modules) { // webpackBootstrap
 	            // the last iteration without have to scan the object twice and create
 	            // an itermediate keys array.
 	            if (priorKey !== undefined) {
-	              execIteration(priorKey, i - 1);
+	              execIteration(priorKey, i - 1, false, context[priorKey]);
 	            }
 	            priorKey = key;
 	            i++;
 	          });
 	          if (priorKey !== undefined) {
-	            execIteration(priorKey, i - 1, true);
+	            execIteration(priorKey, i - 1, true, context[priorKey]);
 	          }
 	        })();
 	      }
@@ -1970,9 +2002,10 @@ return /******/ (function(modules) { // webpackBootstrap
 	exports.__esModule = true;
 	exports.createProtoAccessControl = createProtoAccessControl;
 	exports.resultIsAllowed = resultIsAllowed;
+	exports.isPrototypeConstructor = isPrototypeConstructor;
 	exports.resetLoggedProperties = resetLoggedProperties;
 
-	var _createNewLookupObject = __webpack_require__(75);
+	var _utils = __webpack_require__(4);
 
 	var _logger = __webpack_require__(71);
 
@@ -1981,23 +2014,28 @@ return /******/ (function(modules) { // webpackBootstrap
 	var loggedProperties = _Object$create(null);
 
 	function createProtoAccessControl(runtimeOptions) {
-	  var defaultMethodWhiteList = _Object$create(null);
-	  defaultMethodWhiteList['constructor'] = false;
-	  defaultMethodWhiteList['__defineGetter__'] = false;
-	  defaultMethodWhiteList['__defineSetter__'] = false;
-	  defaultMethodWhiteList['__lookupGetter__'] = false;
-
-	  var defaultPropertyWhiteList = _Object$create(null);
+	  // Create an object with "null"-prototype to avoid truthy results on
+	  // prototype properties.
+	  var propertyWhiteList = _Object$create(null);
 	  // eslint-disable-next-line no-proto
-	  defaultPropertyWhiteList['__proto__'] = false;
+	  propertyWhiteList['__proto__'] = false;
+	  _utils.extend(propertyWhiteList, runtimeOptions.allowedProtoProperties);
+
+	  var methodWhiteList = _Object$create(null);
+	  methodWhiteList['constructor'] = false;
+	  methodWhiteList['__defineGetter__'] = false;
+	  methodWhiteList['__defineSetter__'] = false;
+	  methodWhiteList['__lookupGetter__'] = false;
+	  methodWhiteList['__lookupSetter__'] = false;
+	  _utils.extend(methodWhiteList, runtimeOptions.allowedProtoMethods);
 
 	  return {
 	    properties: {
-	      whitelist: _createNewLookupObject.createNewLookupObject(defaultPropertyWhiteList, runtimeOptions.allowedProtoProperties),
+	      whitelist: propertyWhiteList,
 	      defaultValue: runtimeOptions.allowProtoPropertiesByDefault
 	    },
 	    methods: {
-	      whitelist: _createNewLookupObject.createNewLookupObject(defaultMethodWhiteList, runtimeOptions.allowedProtoMethods),
+	      whitelist: methodWhiteList,
 	      defaultValue: runtimeOptions.allowProtoMethodsByDefault
 	    }
 	  };
@@ -2011,6 +2049,25 @@ return /******/ (function(modules) { // webpackBootstrap
 	  }
 	}
 
+	/**
+	 * Detect a prototype object's own "constructor" back-reference, e.g.
+	 * `Function.prototype.constructor === Function`. Because "constructor" is an
+	 * "own" property of such objects, it would otherwise bypass the prototype-access
+	 * checks and expose dangerous constructors (allowing arbitrary code execution).
+	 *
+	 * Only functions can be constructors, so other values are never treated as one
+	 * and their `prototype` is never read.
+	 *
+	 * @param {*} parent the object the property is being read from
+	 * @param {string} propertyName the property being looked up
+	 * @param {*} result the already-resolved value of `parent[propertyName]`
+	 * @returns {boolean} true if the lookup resolves `parent`'s own constructor
+	 */
+
+	function isPrototypeConstructor(parent, propertyName, result) {
+	  return propertyName === 'constructor' && typeof result === 'function' && parent === result.prototype;
+	}
+
 	function checkWhiteList(protoAccessControlForType, propertyName) {
 	  if (protoAccessControlForType.whitelist[propertyName] !== undefined) {
 	    return protoAccessControlForType.whitelist[propertyName] === true;
@@ -2052,34 +2109,6 @@ return /******/ (function(modules) { // webpackBootstrap
 
 /***/ }),
 /* 75 */
-/***/ (function(module, exports, __webpack_require__) {
-
-	'use strict';
-
-	var _Object$create = __webpack_require__(73)['default'];
-
-	exports.__esModule = true;
-	exports.createNewLookupObject = createNewLookupObject;
-
-	var _utils = __webpack_require__(4);
-
-	/**
-	 * Create a new object with "null"-prototype to avoid truthy results on prototype properties.
-	 * The resulting object can be used with "object[property]" to check if a property exists
-	 * @param {...object} sources a varargs parameter of source objects that will be merged
-	 * @returns {object}
-	 */
-
-	function createNewLookupObject() {
-	  for (var _len = arguments.length, sources = Array(_len), _key = 0; _key < _len; _key++) {
-	    sources[_key] = arguments[_key];
-	  }
-
-	  return _utils.extend.apply(undefined, [_Object$create(null)].concat(sources));
-	}
-
-/***/ }),
-/* 76 */
 /***/ (function(module, exports) {
 
 	// Build out our basic SafeString type
@@ -2098,12 +2127,12 @@ return /******/ (function(modules) { // webpackBootstrap
 	module.exports = exports['default'];
 
 /***/ }),
-/* 77 */
+/* 76 */
 /***/ (function(module, exports, __webpack_require__) {
 
 	'use strict';
 
-	var _Object$seal = __webpack_require__(78)['default'];
+	var _Object$seal = __webpack_require__(77)['default'];
 
 	var _Object$keys = __webpack_require__(59)['default'];
 
@@ -2131,7 +2160,7 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	var _helpers = __webpack_require__(9);
 
-	var _internalWrapHelper = __webpack_require__(81);
+	var _internalWrapHelper = __webpack_require__(80);
 
 	var _internalProtoAccess = __webpack_require__(72);
 
@@ -2180,16 +2209,26 @@ return /******/ (function(modules) { // webpackBootstrap
 	    }
 	    partial = env.VM.resolvePartial.call(this, partial, context, options);
 
-	    var extendedOptions = Utils.extend({}, options, {
-	      hooks: this.hooks,
-	      protoAccessControl: this.protoAccessControl
-	    });
+	    options.hooks = this.hooks;
+	    options.protoAccessControl = this.protoAccessControl;
+
+	    var result = env.VM.invokePartial.call(this, partial, context, options);
 
-	    var result = env.VM.invokePartial.call(this, partial, context, extendedOptions);
+	    // An empty result normally means the partial is template source that still
+	    // has to be compiled. A function partial has already been invoked, so an
+	    // empty result from it is a bug in that partial.
+	    if (result == null && Utils.isFunction(partial)) {
+	      throw new _exception2['default']('The partial ' + options.name + ' returned no output: partials must return a string');
+	    }
 
 	    if (result == null && env.compile) {
+	      // Only template source registered as a partial may be compiled here.
+	      // Anything else (e.g. an AST-shaped object) must not become code.
+	      if (typeof partial !== 'string') {
+	        throw new _exception2['default']('The partial ' + options.name + ' could not be compiled: partials must be strings or functions returning strings');
+	      }
 	      options.partials[options.name] = env.compile(partial, templateSpec.compilerOptions, env);
-	      result = options.partials[options.name](context, extendedOptions);
+	      result = options.partials[options.name](context, options);
 	    }
 	    if (result != null) {
 	      if (options.indent) {
@@ -2224,7 +2263,12 @@ return /******/ (function(modules) { // webpackBootstrap
 	      if (result == null) {
 	        return result;
 	      }
-	      if (Object.prototype.hasOwnProperty.call(parent, propertyName)) {
+	      // Own properties are trusted context data and returned as-is, except for
+	      // a prototype's own "constructor" back-reference (e.g.
+	      // Function.prototype.constructor === Function): that must still pass the
+	      // prototype-access deny list, otherwise the Function constructor becomes
+	      // reachable and arbitrary code can be executed.
+	      if (Object.prototype.hasOwnProperty.call(parent, propertyName) && !_internalProtoAccess.isPrototypeConstructor(parent, propertyName, result)) {
 	        return result;
 	      }
 
@@ -2238,7 +2282,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	      for (var i = 0; i < len; i++) {
 	        var result = depths[i] && container.lookupProperty(depths[i], name);
 	        if (result != null) {
-	          return depths[i][name];
+	          return result;
 	        }
 	      }
 	    },
@@ -2320,8 +2364,9 @@ return /******/ (function(modules) { // webpackBootstrap
 
 	  ret._setup = function (options) {
 	    if (!options.partial) {
-	      var mergedHelpers = Utils.extend({}, env.helpers, options.helpers);
-	      wrapHelpersToPassLookupProperty(mergedHelpers, container);
+	      var mergedHelpers = {};
+	      addHelpers(mergedHelpers, env.helpers, container);
+	      addHelpers(mergedHelpers, options.helpers, container);
 	      container.helpers = mergedHelpers;
 
 	      if (templateSpec.usePartial) {
@@ -2387,21 +2432,24 @@ return /******/ (function(modules) { // webpackBootstrap
 	function resolvePartial(partial, context, options) {
 	  if (!partial) {
 	    if (options.name === '@partial-block') {
-	      partial = options.data['partial-block'];
+	      partial = lookupOwnProperty(options.data, 'partial-block');
 	    } else {
-	      partial = options.partials[options.name];
+	      partial = lookupOwnProperty(options.partials, options.name);
 	    }
-	  } else if (!partial.call && !options.name) {
-	    // This is a dynamic partial that returned a string
+	  } else if (typeof partial !== 'function' && !options.name) {
+	    // This is a dynamic partial that returned a name rather than a compiled
+	    // partial. Only functions are accepted as partials here; any other value
+	    // (including an object with a "call" property) is treated as a name, so
+	    // that context data can never be compiled as a template.
 	    options.name = partial;
-	    partial = options.partials[partial];
+	    partial = lookupOwnProperty(options.partials, partial);
 	  }
 	  return partial;
 	}
 
 	function invokePartial(partial, context, options) {
 	  // Use the current closure context to save the partial-block if this partial
-	  var currentPartialBlock = options.data && options.data['partial-block'];
+	  var currentPartialBlock = lookupOwnProperty(options.data, 'partial-block');
 	  options.partial = true;
 	  if (options.ids) {
 	    options.data.contextPath = options.ids[0] || options.data.contextPath;
@@ -2443,6 +2491,12 @@ return /******/ (function(modules) { // webpackBootstrap
 	  return '';
 	}
 
+	function lookupOwnProperty(obj, name) {
+	  if (obj && Object.prototype.hasOwnProperty.call(obj, name)) {
+	    return obj[name];
+	  }
+	}
+
 	function initData(context, data) {
 	  if (!data || !('root' in data)) {
 	    data = data ? _base.createFrame(data) : {};
@@ -2460,9 +2514,10 @@ return /******/ (function(modules) { // webpackBootstrap
 	  return prog;
 	}
 
-	function wrapHelpersToPassLookupProperty(mergedHelpers, container) {
-	  _Object$keys(mergedHelpers).forEach(function (helperName) {
-	    var helper = mergedHelpers[helperName];
+	function addHelpers(mergedHelpers, helpers, container) {
+	  if (!helpers) return;
+	  _Object$keys(helpers).forEach(function (helperName) {
+	    var helper = helpers[helperName];
 	    mergedHelpers[helperName] = passLookupPropertyOption(helper, container);
 	  });
 	}
@@ -2470,25 +2525,26 @@ return /******/ (function(modules) { // webpackBootstrap
 	function passLookupPropertyOption(helper, container) {
 	  var lookupProperty = container.lookupProperty;
 	  return _internalWrapHelper.wrapHelper(helper, function (options) {
-	    return Utils.extend({ lookupProperty: lookupProperty }, options);
+	    options.lookupProperty = lookupProperty;
+	    return options;
 	  });
 	}
 
 /***/ }),
-/* 78 */
+/* 77 */
 /***/ (function(module, exports, __webpack_require__) {
 
-	module.exports = { "default": __webpack_require__(79), __esModule: true };
+	module.exports = { "default": __webpack_require__(78), __esModule: true };
 
 /***/ }),
-/* 79 */
+/* 78 */
 /***/ (function(module, exports, __webpack_require__) {
 
-	__webpack_require__(80);
+	__webpack_require__(79);
 	module.exports = __webpack_require__(20).Object.seal;
 
 /***/ }),
-/* 80 */
+/* 79 */
 /***/ (function(module, exports, __webpack_require__) {
 
 	// 19.1.2.17 Object.seal(O)
@@ -2501,7 +2557,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	});
 
 /***/ }),
-/* 81 */
+/* 80 */
 /***/ (function(module, exports) {
 
 	'use strict';
@@ -2524,7 +2580,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	}
 
 /***/ }),
-/* 82 */
+/* 81 */
 /***/ (function(module, exports) {
 
 	/* global globalThis */

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: handlebars-source
 version: !ruby/object:Gem::Version
-  version: 4.7.8
+  version: 4.7.10
 platform: ruby
 authors:
 - Yehuda Katz
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-08-02 00:00:00.000000000 Z
+date: 2026-10-05 00:00:00.000000000 Z
 dependencies: []
 description: Handlebars.js source code wrapper for (pre)compilation gems.
 email:
@@ -39,7 +39,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: Handlebars.js source code wrapper