@brilab-mailer/template-handlebars 0.0.5-5 → 0.1.0

package/lib/handlebars-template.engine.d.ts

@@ -14,6 +14,11 @@ export declare class HandlebarsTemplateEngine implements MailerTemplateEngine {
     constructor(options: HandlebarsConfig);
     private registerI18nHelpers;
     private registerPartialsHelpers;
+    /**
+     * Resolves `<baseDir>/<key>.hbs` and guarantees the result stays inside
+     * `baseDir`, rejecting path-traversal keys like `../../etc/passwd`.
+     */
+    private resolveWithin;
     private loadTemplate;
     private loadLayout;
     render(templateKey: string, context?: Record<string, any>, options?: {

package/lib/handlebars-template.engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlebars-template.engine.d.ts","sourceRoot":"","sources":["../../src/lib/handlebars-template.engine.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,oBAAoB,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACX,sCAAsC,EACtC,MAAM,0BAA0B,CAAC;AAMlC,UAAU,gBACT,SAAQ,sCAAsC;CAC9C;AAED,qBACa,wBAAyB,YAAW,oBAAoB;IAanE,OAAO,CAAC,QAAQ,CAAC,OAAO;IAZzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAuB;IAE3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkD;IAChF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkD;IAE9E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAInB,OAAO,EAAE,gBAAgB;IAoB3C,OAAO,CAAC,mBAAmB;IAqB3B,OAAO,CAAC,uBAAuB;IAkC/B,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,UAAU;IAaZ,MAAM,CACX,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EACjC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAA6B,GACxD,OAAO,CAAC,MAAM,CAAC;CAYlB"}
+{"version":3,"file":"handlebars-template.engine.d.ts","sourceRoot":"","sources":["../../src/lib/handlebars-template.engine.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,oBAAoB,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACX,sCAAsC,EACtC,MAAM,0BAA0B,CAAC;AAMlC,UAAU,gBACT,SAAQ,sCAAsC;CAC9C;AAED,qBACa,wBAAyB,YAAW,oBAAoB;IAanE,OAAO,CAAC,QAAQ,CAAC,OAAO;IAZzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAuB;IAE3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkD;IAChF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkD;IAE9E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAInB,OAAO,EAAE,gBAAgB;IAoB3C,OAAO,CAAC,mBAAmB;IAqB3B,OAAO,CAAC,uBAAuB;IAkC/B;;;OAGG;IACH,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,UAAU;IAaZ,MAAM,CACX,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EACjC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAA6B,GACxD,OAAO,CAAC,MAAM,CAAC;CAYlB"}

package/lib/handlebars-template.engine.js

@@ -75,10 +75,22 @@ let HandlebarsTemplateEngine = class HandlebarsTemplateEngine {
         };
         registerRecursive(partialsPath);
     }
+    /**
+     * Resolves `<baseDir>/<key>.hbs` and guarantees the result stays inside
+     * `baseDir`, rejecting path-traversal keys like `../../etc/passwd`.
+     */
+    resolveWithin(baseDir, key) {
+        const root = path.resolve(baseDir);
+        const filePath = path.resolve(root, `${key}.hbs`);
+        if (filePath !== root && !filePath.startsWith(root + path.sep)) {
+            throw new Error(`Invalid template key (path traversal): ${key}`);
+        }
+        return filePath;
+    }
     loadTemplate(key) {
         if (this._cached && this.templateCache.has(key))
             return this.templateCache.get(key);
-        const filePath = path.join(this.templatesDir, `${key}.hbs`);
+        const filePath = this.resolveWithin(this.templatesDir, key);
         if (!fs.existsSync(filePath)) {
             throw new Error(`Template not found: ${filePath}`);
         }
@@ -90,7 +102,7 @@ let HandlebarsTemplateEngine = class HandlebarsTemplateEngine {
     loadLayout(key) {
         if (this._cached && this.layoutCache.has(key))
             return this.layoutCache.get(key);
-        const filePath = path.join(this.layoutsDir, `${key}.hbs`);
+        const filePath = this.resolveWithin(this.layoutsDir, key);
         if (!fs.existsSync(filePath))
             return null;
         const source = fs.readFileSync(filePath, 'utf8');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brilab-mailer/template-handlebars",
-  "version": "0.0.5-5",
+  "version": "0.1.0",
   "author": "Bohdan Radchenko <radchenkobs@gmail.com>",
   "type": "module",
   "main": "./index.js",
@@ -26,8 +26,8 @@
   "peerDependencies": {
     "@nestjs/common": "^10.0.0",
     "@nestjs/config": "^3.0.0",
-    "@brilab-mailer/contracts": "^0.0.5-5",
-    "@brilab-mailer/core": "^0.0.5-5"
+    "@brilab-mailer/contracts": "^0.1.0",
+    "@brilab-mailer/core": "^0.1.0"
   },
   "peerDependenciesMeta": {
     "@brilab-mailer/contracts": {