@nka212bg/backend-utils 0.1.51 → 0.1.52

package/mailSmsTools/index.js

@@ -176,7 +176,7 @@ const createInstance = (options = {}) => {
 
                     const mailOptions = {
                         from: name ? { name, address: smtpUser } : smtpUser,
-                        // html: handlebars({ template: defaultTemplate, content, subject, logoUrl: `${process.env.BASE_URL}/logo_black.png` }),
+                        // html: handlebars(defaultTemplate, { content, subject, logoUrl: `${process.env.BASE_URL}/logo_black.png` }),
                         html,
                         subject,
                         to: e,

package/misc.js

@@ -118,17 +118,14 @@ exports.createToken = ({ length = 14, type } = {}) => {
     }
 };
 
-exports.handlebars = ({ template, ...params } = {}) => {
-    const placeholders = template.match(/(\{\{)(.*?)(\}\})/g);
+exports.escapeHtml = (s) => String(s).replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
 
-    for (const p in params) {
-        const placeholder = placeholders.find((e) => e.includes(p));
-        if (!placeholder) continue;
-
-        template = template.replace(RegExp(placeholder, "g"), params[p]);
-    }
-
-    return template;
+// {{ key }} → raw (trusted), {{{ key }}} → HTML-escaped (untrusted); supports nested keys like {{ user.name }}
+exports.handlebars = (template = "", params = {}) => {
+    return template.replace(/\{\{(\{?)\s*([\w.]+)\s*\}?\}\}/g, (match, safe, key) => {
+        const value = key.split(".").reduce((o, k) => o?.[k], params);
+        return value == null ? match : safe ? this.escapeHtml(value) : value;
+    });
 };
 
 exports.shortCount = (value, bites) => {

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@nka212bg/backend-utils",
     "author": "nka212bg",
-    "version": "0.1.51",
+    "version": "0.1.52",
     "main": "index.js",
     "dependencies": {
         "@maxmind/geoip2-node": "^5.0.0",