express-hbs 2.3.5 → 2.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/workflows/test.yml +5 -5
- package/LICENSE +1 -1
- package/README.md +5 -1
- package/lib/resolver.js +11 -2
- package/package.json +9 -9
|
@@ -3,20 +3,20 @@ on:
|
|
|
3
3
|
pull_request:
|
|
4
4
|
push:
|
|
5
5
|
branches:
|
|
6
|
-
-
|
|
6
|
+
- main
|
|
7
7
|
- 'renovate/*'
|
|
8
8
|
|
|
9
9
|
jobs:
|
|
10
10
|
build:
|
|
11
|
-
runs-on: ubuntu-
|
|
11
|
+
runs-on: ubuntu-latest
|
|
12
12
|
if: github.event_name == 'push' || (github.event_name == 'pull_request' && !startsWith(github.head_ref, 'renovate/'))
|
|
13
13
|
strategy:
|
|
14
14
|
matrix:
|
|
15
|
-
node: [
|
|
15
|
+
node: [ 14, 16, 18 ]
|
|
16
16
|
name: Node ${{ matrix.node }}
|
|
17
17
|
steps:
|
|
18
|
-
- uses: actions/checkout@
|
|
19
|
-
- uses: actions/setup-node@
|
|
18
|
+
- uses: actions/checkout@v3
|
|
19
|
+
- uses: actions/setup-node@v3
|
|
20
20
|
with:
|
|
21
21
|
node-version: ${{ matrix.node }}
|
|
22
22
|
- run: yarn
|
package/LICENSE
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
The MIT License (MIT)
|
|
2
2
|
|
|
3
|
-
Copyright (c) 2012-
|
|
3
|
+
Copyright (c) 2012-2023 Barc, Inc., Ghost Foundation
|
|
4
4
|
|
|
5
5
|
Permission is hereby granted, free of charge, to any person obtaining a copy of
|
|
6
6
|
this software and associated documentation files (the "Software"), to deal in
|
package/README.md
CHANGED
|
@@ -99,6 +99,10 @@ There are three ways to use a layout, listed in precedence order
|
|
|
99
99
|
|
|
100
100
|
2. As an option to render
|
|
101
101
|
|
|
102
|
+
## ⚠️ This creates a potential security vulnerability:
|
|
103
|
+
|
|
104
|
+
Do not use this option in conjunction with passing user submitted data to res.render e.g. `res.render('index', req.query)`. This allows users to read arbitrary files from your filesystem!
|
|
105
|
+
|
|
102
106
|
```js
|
|
103
107
|
res.render('veggies', {
|
|
104
108
|
title: 'My favorite veggies',
|
|
@@ -297,4 +301,4 @@ Big thanks to all [CONTRIBUTORS](https://github.com/TryGhost/express-hbs/contrib
|
|
|
297
301
|
|
|
298
302
|
The MIT License (MIT)
|
|
299
303
|
|
|
300
|
-
Copyright (c) 2012-
|
|
304
|
+
Copyright (c) 2012-2023 Barc, Inc., Ghost Foundation - Released under the [MIT license](LICENSE).
|
package/lib/resolver.js
CHANGED
|
@@ -5,11 +5,17 @@ var Promise = require('bluebird');
|
|
|
5
5
|
var generateId = require('./generate-id');
|
|
6
6
|
|
|
7
7
|
var ID_LENGTH = 8;
|
|
8
|
-
var ID_PREFIX = '
|
|
8
|
+
var ID_PREFIX = '__aSyNcId__';
|
|
9
|
+
|
|
10
|
+
// NOTE: We must include a character which is escaped by Handlebars in the "async id"
|
|
11
|
+
// This is so that when using an async helper "inline", such as {{asyncHelper "foo"}}
|
|
12
|
+
// the content is correctly escaped depending on whether double or triple braces.
|
|
13
|
+
var ID_ESCAPED_STRING = '<_';
|
|
14
|
+
|
|
9
15
|
var ID_SUFFIX = '__';
|
|
10
16
|
|
|
11
17
|
function resolve(cache, fn, context) {
|
|
12
|
-
var id = ID_PREFIX + generateId(ID_LENGTH) + ID_SUFFIX;
|
|
18
|
+
var id = ID_PREFIX + ID_ESCAPED_STRING + generateId(ID_LENGTH) + ID_SUFFIX;
|
|
13
19
|
cache[id] = new Promise(function(passed, failed) {
|
|
14
20
|
try {
|
|
15
21
|
fn(context, function(res) {
|
|
@@ -31,6 +37,9 @@ function done(cache, callback) {
|
|
|
31
37
|
}
|
|
32
38
|
|
|
33
39
|
function hasResolvers(text) {
|
|
40
|
+
// NOTE: We specifically search the text for the ID_PREFIX **NOT** including the escapable character
|
|
41
|
+
// This is because that character can be escaped in the text, and lead us to not finding unresolved
|
|
42
|
+
// async helper outputs.
|
|
34
43
|
if (text.search(ID_PREFIX) > 0) {
|
|
35
44
|
return true;
|
|
36
45
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "express-hbs",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.4.1",
|
|
4
4
|
"description": "Express handlebars template engine complete with multiple layouts, partials and blocks.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"express4",
|
|
@@ -29,14 +29,14 @@
|
|
|
29
29
|
"author": "Mario Gutierrez <mario@barc.com>",
|
|
30
30
|
"license": "MIT",
|
|
31
31
|
"devDependencies": {
|
|
32
|
-
"cookie-parser": "
|
|
33
|
-
"eslint": "
|
|
34
|
-
"express": "
|
|
35
|
-
"i18n": "
|
|
36
|
-
"mocha": "
|
|
37
|
-
"nyc": "
|
|
38
|
-
"rewire": "
|
|
39
|
-
"supertest": "
|
|
32
|
+
"cookie-parser": "1.4.6",
|
|
33
|
+
"eslint": "8.47.0",
|
|
34
|
+
"express": "4.18.2",
|
|
35
|
+
"i18n": "0.15.1",
|
|
36
|
+
"mocha": "10.2.0",
|
|
37
|
+
"nyc": "15.1.0",
|
|
38
|
+
"rewire": "7.0.0",
|
|
39
|
+
"supertest": "6.3.3"
|
|
40
40
|
},
|
|
41
41
|
"dependencies": {
|
|
42
42
|
"bluebird": "^3.5.3",
|