express-hbs 2.4.2 → 2.5.1

package/.claude/worktrees/security-patches-review-c621ea/test/localTemplateOptions.js

@@ -0,0 +1,125 @@
+'use strict';
+var assert = require('assert');
+var path = require('path');
+var hbs = require('..');
+var H = require('./helpers');
+
+describe('local template options', function () {
+  var dirname = path.join(__dirname, 'localTemplateOptions');
+
+  describe('express3', function () {
+    it('merges res.locals._templateOptions with the self._templateOptions', function (done) {
+      var instance = hbs.create();
+      var render = instance.express3({
+        restrictLayoutsTo: dirname,
+      });
+      instance.updateTemplateOptions({
+        data: {
+          greeting: 'Hello,',
+          firstName: 'Freddy',
+          lastName: 'Krueger',
+        },
+      });
+
+      var locals = H.createLocals('express3', dirname, {
+        _templateOptions: {
+          data: {
+            lastName: 'Mercury',
+          },
+        },
+      });
+
+      render(path.join(dirname, 'template.hbs'), locals, function (err, html) {
+        assert.ifError(err);
+        assert.strictEqual(H.stripWs(html), H.stripWs('Hello, Freddy Mercury'));
+        done(err);
+      });
+    });
+
+    it('removes _templateOptions from the locals data', function (done) {
+      var instance = hbs.create();
+      var render = instance.express3({
+        restrictLayoutsTo: dirname,
+      });
+      instance.updateTemplateOptions({
+        data: {
+          greeting: 'Hello,',
+          firstName: 'Freddy',
+          lastName: 'Krueger',
+        },
+      });
+
+      var locals = H.createLocals('express3', dirname, {
+        _templateOptions: {
+          data: {
+            lastName: 'Mercury',
+          },
+        },
+      });
+
+      render(path.join(dirname, 'data-access-template.hbs'), locals, function (err, html) {
+        assert.ifError(err);
+        assert.strictEqual(H.stripWs(html), H.stripWs(''));
+        done(err);
+      });
+    });
+  });
+
+  describe('express4', function () {
+    it('merges res.locals._templateOptions with the self._templateOptions', function (done) {
+      var instance = hbs.create();
+      var render = instance.express4({
+        restrictLayoutsTo: dirname,
+      });
+      instance.updateTemplateOptions({
+        data: {
+          greeting: 'Hello,',
+          firstName: 'Freddy',
+          lastName: 'Krueger',
+        },
+      });
+
+      var locals = H.createLocals('express4', dirname, {
+        _templateOptions: {
+          data: {
+            lastName: 'Mercury',
+          },
+        },
+      });
+
+      render(path.join(dirname, 'template.hbs'), locals, function (err, html) {
+        assert.ifError(err);
+        assert.strictEqual(H.stripWs(html), H.stripWs('Hello, Freddy Mercury'));
+        done(err);
+      });
+    });
+
+    it('removes _templateOptions from the locals data', function (done) {
+      var instance = hbs.create();
+      var render = instance.express3({
+        restrictLayoutsTo: dirname,
+      });
+      instance.updateTemplateOptions({
+        data: {
+          greeting: 'Hello,',
+          firstName: 'Freddy',
+          lastName: 'Krueger',
+        },
+      });
+
+      var locals = H.createLocals('express3', dirname, {
+        _templateOptions: {
+          data: {
+            lastName: 'Mercury',
+          },
+        },
+      });
+
+      render(path.join(dirname, 'data-access-template.hbs'), locals, function (err, html) {
+        assert.ifError(err);
+        assert.strictEqual(H.stripWs(html), H.stripWs(''));
+        done(err);
+      });
+    });
+  });
+});

package/.claude/worktrees/security-patches-review-c621ea/test/multiple.js

@@ -0,0 +1,115 @@
+'use strict';
+
+var request = require('supertest');
+var assert = require('assert');
+var express = require('express');
+var hbs = require('..');
+
+describe('multiple directories', function () {
+  var app;
+
+  beforeEach(function () {
+    app = express();
+    app.engine(
+      'hbs',
+      hbs.express3({
+        restrictLayoutsTo: './test/views/multiple',
+      }),
+    );
+    app.set('view engine', 'hbs');
+    app.get('/test1', function (req, res) {
+      res.render('test1');
+    });
+    app.get('/test2', function (req, res) {
+      res.render('test2');
+    });
+    app.get('/collide', function (req, res) {
+      res.render('collide');
+    });
+    app.get('/error', function (req, res) {
+      res.render('error');
+    });
+  });
+
+  it('should handle single folder', function (done) {
+    app.set('views', './test/views/multiple/views1');
+    request(app)
+      .get('/test1')
+      .end(function (err, res) {
+        assert.ifError(err);
+        var expected = '<h1>test1</h1>\n';
+        assert.equal(res.text, expected);
+        done();
+      });
+  });
+
+  it('should handle multiple folders', function (done) {
+    app.set('views', ['./test/views/multiple/views1', './test/views/multiple/views2']);
+    request(app)
+      .get('/test2')
+      .end(function (err, res) {
+        assert.ifError(err);
+        var expected = '<h1>test2</h1>\n';
+        assert.equal(res.text, expected);
+        done();
+      });
+  });
+
+  describe('should handle multiple folders in specific order', function () {
+    it('views1, views2', function (done) {
+      app.set('views', ['./test/views/multiple/views1', './test/views/multiple/views2']);
+      request(app)
+        .get('/collide')
+        .end(function (err, res) {
+          assert.ifError(err);
+          var expected = '<h1>collide1</h1>\n';
+          assert.equal(res.text, expected);
+          done();
+        });
+    });
+
+    it('views2, views1', function (done) {
+      app.set('views', ['./test/views/multiple/views2', './test/views/multiple/views1']);
+      request(app)
+        .get('/collide')
+        .end(function (err, res) {
+          assert.ifError(err);
+          var expected = '<h1>collide2</h1>\n';
+          assert.equal(res.text, expected);
+          done();
+        });
+    });
+  });
+
+  describe('should report the filename in error', function () {
+    it('should report from first folder', function (done) {
+      app.set('views', ['./test/views/multiple/views1', './test/views/multiple/views2']);
+      app.use(function (err, req, res, next) {
+        res.status(500).send(err.stack);
+      });
+
+      request(app)
+        .get('/error')
+        .end(function (err, res) {
+          assert.ifError(err);
+          assert(res.error.text.indexOf('views1/error.hbs]') > 0);
+          done();
+        });
+    });
+
+    it('should report from second folder', function (done) {
+      app.set('views', ['./test/views/multiple/views2', './test/views/multiple/views1']);
+      app.use(function (err, req, res, next) {
+        res.status(500).send(err.stack);
+      });
+
+      request(app)
+        .get('/error')
+        .end(function (err, res) {
+          assert.ifError(err);
+          assert(res.error.text.indexOf('views2/error.hbs]') > 0);
+          done();
+        });
+    });
+  });
+});

package/.claude/worktrees/security-patches-review-c621ea/test/nonExpress.js

@@ -0,0 +1,36 @@
+var assert = require('assert');
+var hbs = require('..');
+var H = require('./helpers');
+
+describe('non-express', function () {
+  describe('viewsDir', function () {
+    var dirname = __dirname + '/views/viewsDir';
+
+    it('should use viewsDir options', function (done) {
+      var render = hbs.create().express3({
+        viewsDir: dirname,
+        restrictLayoutsTo: dirname,
+      });
+      var locals = H.createLocals('express3', dirname);
+
+      render(dirname + '/sub/directive.hbs', locals, function (err, html) {
+        assert.equal('<vd>directive</vd>', H.stripWs(html));
+        done();
+      });
+    });
+
+    it('should work with layoutsDir', function (done) {
+      var render = hbs.create().express3({
+        viewsDir: dirname,
+        layoutsDir: dirname + '/layouts',
+        restrictLayoutsTo: dirname,
+      });
+      var locals = H.createLocals('express3', dirname, { layout: 'default.hbs' });
+
+      render(dirname + '/sub/lay.hbs', locals, function (err, html) {
+        assert.equal('<vd>lay</vd>', H.stripWs(html));
+        done();
+      });
+    });
+  });
+});

package/.claude/worktrees/security-patches-review-c621ea/test/optionsSpecs.js

@@ -0,0 +1,22 @@
+var assert = require('assert');
+var hbs = require('..');
+var path = require('path');
+var H = require('./helpers');
+var fs = require('fs');
+
+describe('options', function () {
+  var dirname = path.join(__dirname, 'views/beautify');
+
+  it('should pretty print HTML', function (done) {
+    var hb = hbs.create();
+    var render = hb.express3({ beautify: true, restrictLayoutsTo: dirname });
+    var locals = H.createLocals('express3', dirname, {});
+
+    render(dirname + '/index.hbs', locals, function (err, html) {
+      assert.ifError(err);
+      var expected = fs.readFileSync(dirname + '/expected.hbs', 'utf8');
+      assert.equal(html.trim(), expected.trim());
+      done();
+    });
+  });
+});

package/.claude/worktrees/security-patches-review-c621ea/test/resolverSpecs.js

@@ -0,0 +1,54 @@
+'use strict';
+
+var assert = require('assert');
+var generateId = require('../lib/generate-id');
+var resolver = require('../lib/resolver');
+
+describe('resolver', function () {
+  it('detects an unresolved helper at the start of rendered output', function () {
+    assert.equal(resolver.hasResolvers('__aSyNcId__<_12345678__'), true);
+  });
+
+  it('does not report rendered output without a resolver marker', function () {
+    assert.equal(resolver.hasResolvers('rendered output'), false);
+  });
+
+  it('resolves asynchronous helper output with its context', function (done) {
+    var cache = {};
+    var id = resolver.resolve(
+      cache,
+      function (context, callback) {
+        callback(context.value);
+      },
+      { value: 'resolved' },
+    );
+
+    resolver.done(cache, function (err, values) {
+      assert.ifError(err);
+      assert.equal(values[id], 'resolved');
+      done();
+    });
+  });
+
+  it('reports synchronous helper failures', function (done) {
+    var cache = {};
+    resolver.resolve(cache, function () {
+      throw new Error('helper failed');
+    });
+
+    resolver.done(cache, function (err) {
+      assert.equal(err.message, 'helper failed');
+      done();
+    });
+  });
+});
+
+describe('generateId', function () {
+  it('uses an eight-character default', function () {
+    assert.match(generateId(), /^[A-Za-z_]{8}$/);
+  });
+
+  it('uses the requested length', function () {
+    assert.match(generateId(16), /^[A-Za-z_]{16}$/);
+  });
+});

package/.claude/worktrees/security-patches-review-c621ea/test/views/beautify/expected.hbs

@@ -0,0 +1,9 @@
+<html>
+
+<head>head</head>
+
+<body>
+  <h1>heading 1</h1>
+  <h2>heading 2</h2>
+</body>
+<html>

package/.claude/worktrees/security-patches-review-c621ea/test/views/beautify/index.hbs

@@ -0,0 +1,2 @@
+<html>
+  <head>head</head> <body><h1>heading 1</h1><h2>heading 2</h2></body> <html>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/layout.server.view.html

@@ -0,0 +1 @@
+<html>{{{body}}}</html>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/partialsDir/partial1.server.view.html

@@ -0,0 +1 @@
+<partial>1</partial>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/partialsDir/partial2.server.view.html

@@ -0,0 +1 @@
+<partial>2</partial>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/partialsDir/subs/subPartial1.server.view.html

@@ -0,0 +1 @@
+<subpartial>1</subpartial>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/partialsDir/subs/subPartial2.server.view.html

@@ -0,0 +1 @@
+<subpartial>2</subpartial>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/template.server.view.html

@@ -0,0 +1,5 @@
+{{!< layout}}
+{{> subs/subPartial1}}
+{{> partial1}}
+{{> subs/subPartial2}}
+{{> partial2}}

package/.claude/worktrees/security-patches-review-c621ea/test/views/disableLayoutDirective/aside.hbs

@@ -0,0 +1 @@
+aside

package/.claude/worktrees/security-patches-review-c621ea/test/views/disableLayoutDirective/index.hbs

@@ -0,0 +1,2 @@
+{{!< layouts/default}}
+dld

package/.claude/worktrees/security-patches-review-c621ea/test/views/disableLayoutDirective/layouts/default.hbs

@@ -0,0 +1 @@
+<dld>{{{body}}}</dld>

package/.claude/worktrees/security-patches-review-c621ea/test/views/helpers/home/async.hbs

@@ -0,0 +1,6 @@
+{{!< ../layouts/default}}
+asynctemplate
+{{async "foo"}}
+{{async "bar"}}
+{{async "bah"}}
+{{async "baz"}}

package/.claude/worktrees/security-patches-review-c621ea/test/views/helpers/home/index.hbs

@@ -0,0 +1,3 @@
+{{!< ../layouts/default}}
+index
+{{sync "index"}}

package/.claude/worktrees/security-patches-review-c621ea/test/views/helpers/layouts/default.hbs

@@ -0,0 +1 @@
+<default>{{{body}}}</default>

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views1/collide.hbs

@@ -0,0 +1 @@
+<h1>collide1</h1>

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views1/error.hbs

@@ -0,0 +1 @@
+{{{http://google.co.uk}}

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views1/test1.hbs

@@ -0,0 +1 @@
+<h1>test1</h1>

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views2/collide.hbs

@@ -0,0 +1 @@
+<h1>collide2</h1>

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views2/error.hbs

@@ -0,0 +1 @@
+{{{http://google.co.uk}}

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views2/test2.hbs

@@ -0,0 +1 @@
+<h1>test2</h1>

package/.claude/worktrees/security-patches-review-c621ea/test/views/viewsDir/layouts/default.hbs

@@ -0,0 +1 @@
+<vd>{{{body}}}</vd>

package/.claude/worktrees/security-patches-review-c621ea/test/views/viewsDir/sub/directive.hbs

@@ -0,0 +1,2 @@
+{{!< ../layouts/default}}
+directive

package/.claude/worktrees/security-patches-review-c621ea/test/views/viewsDir/sub/lay.hbs

@@ -0,0 +1 @@
+lay

package/README.md

@@ -43,6 +43,7 @@ hbs.express4({
   partialsDir: "{String/Array} [Required] Path to partials templates, one or several directories",
 
   // OPTIONAL settings
+  restrictLayoutsTo: "{String} Absolute path to a directory to restrict layout directive reading from",
   blockHelperName: "{String} Override 'block' helper name.",
   contentHelperName: "{String} Override 'contentFor' helper name.",
   defaultLayout: "{String} Absolute path to default layout template",
@@ -99,9 +100,9 @@ There are three ways to use a layout, listed in precedence order
 
 2.  As an option to render
 
-    ## ⚠️ This creates a potential security vulnerability:
+    ## ⚠️ This creates a potential security vulnerability if used without a `restrictLayoutsTo`:
 
-    Do not use this option in conjunction with passing user submitted data to res.render e.g. `res.render('index', req.query)`. This allows users to read arbitrary files from your filesystem!
+    The `restrictLayoutsTo` option will restrict reading layouts to a particular directory, if you do not pass this option then do not use the `layout` option in conjunction with passing user submitted data to res.render e.g. `res.render('index', req.query)`. This allows users to read arbitrary files from your filesystem!
 
     ```js
     res.render('veggies', {

package/example/app-layoutsDir.js

@@ -19,7 +19,8 @@ app.use(express.static(relative('public')));
 app.engine('hbs', hbs.express4({
   partialsDir: [relative('views/partials'), relative('views/partials-other')],
   layoutsDir: relative('views/layout'),
-  defaultLayout: relative('views/layout/default.hbs')
+  defaultLayout: relative('views/layout/default.hbs'),
+  restrictLayoutsTo: relative('views/layout')
 }));
 app.set('view engine', 'hbs');
 app.set('views', relative('views'));

package/example/app.js

@@ -20,7 +20,8 @@ function create(hbs, env) {
   // Hook in express-hbs and tell it where known directories reside
   app.engine('hbs', hbs.express4({
     partialsDir: [relative('views/partials'), relative('views/partials-other')],
-    defaultLayout: relative('views/layout/default.hbs')
+    defaultLayout: relative('views/layout/default.hbs'),
+    restrictLayoutsTo: viewsDir
   }));
   app.set('view engine', 'hbs');
   app.set('views', viewsDir);

package/lib/hbs.js

@@ -99,6 +99,18 @@ ExpressHbs.prototype.declaredLayoutFile = function(str, filename) {
 ExpressHbs.prototype.cacheLayout = function(layoutFile, useCache, cb) {
   var self = this;
 
+  if (this.restrictLayoutsTo) {
+    var relativePath = path.relative(this.restrictLayoutsTo, layoutFile);
+    var outside = relativePath === '..' ||
+      relativePath.startsWith('..' + path.sep) ||
+      path.isAbsolute(relativePath);
+
+    if (outside) {
+      var err = new Error('Cannot read ' + layoutFile + ' it does not reside in ' + this.restrictLayoutsTo);
+      return cb(err, null);
+    }
+  }
+
   // assume hbs extension
   if (path.extname(layoutFile) === '') layoutFile += this._options.extname;
 
@@ -254,6 +266,8 @@ ExpressHbs.prototype.express3 = function(options) {
   // Absolute path to the layouts directory
   this.layoutsDir = this._options.layoutsDir;
 
+  this.restrictLayoutsTo = this._options.restrictLayoutsTo;
+
   // express passes this through ___express func, gulp pass in an option
   this.viewsDir = null;
   this.viewsDirOpt = this._options.viewsDir;
@@ -332,7 +346,7 @@ ExpressHbs.prototype.compile = function(source, filename) {
   if (typeof source !== 'string') {
     throw new Error('registerPartial must be a string for empty comment workaround');
   }
-  if (source.indexOf('}}') === source.length - 2) {
+  if (source.length >= 2 && source.indexOf('}}') === source.length - 2) {
     source += ' ';
   }
 
@@ -636,10 +650,16 @@ ExpressHbs.prototype.___express = function ___express(filename, source, options,
       Object.keys(values).forEach(function(key) {
         values[key] = replaceValue(values, values[key]);
       });
-      res = replaceValue(values, res);
-      if (resolver.hasResolvers(res)) {
-        return handleAsync(null, res);
+      var replaced = replaceValue(values, res);
+      // Re-check against the live cache: nested async helpers may have registered new IDs
+      // while resolving. Stop if a pass made no progress so unknown IDs can never loop forever.
+      if (
+        replaced !== res &&
+        resolver.hasResolvers(replaced, options.resolverCache, self.Utils.escapeExpression)
+      ) {
+        return handleAsync(null, replaced);
       }
+      res = replaced;
       cb(null, res);
     });
   }

package/lib/resolver.js

@@ -41,14 +41,21 @@ function done(cache, callback) {
   });
 }
 
-function hasResolvers(text) {
+function hasResolvers(text, cache, escape) {
   // NOTE: We specifically search the text for the ID_PREFIX **NOT** including the escapable character
   // This is because that character can be escaped in the text, and lead us to not finding unresolved
   // async helper outputs.
-  if (text.search(ID_PREFIX) > 0) {
+  if (text.indexOf(ID_PREFIX) < 0) {
+    return false;
+  }
+  if (!cache) {
     return true;
   }
-  return false;
+  // Only report IDs that were actually generated by an async helper. The prefix can also
+  // appear in user-supplied data, which must never be treated as an unresolved helper.
+  return Object.keys(cache).some(function(id) {
+    return text.indexOf(id) >= 0 || (escape && text.indexOf(escape(id)) >= 0);
+  });
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "express-hbs",
-  "version": "2.4.2",
+  "version": "2.5.1",
   "description": "Express handlebars template engine complete with multiple layouts, partials and blocks.",
   "keywords": [
     "express4",
@@ -30,7 +30,7 @@
   "license": "MIT",
   "devDependencies": {
     "cookie-parser": "1.4.6",
-    "eslint": "8.48.0",
+    "eslint": "8.54.0",
     "express": "4.18.2",
     "i18n": "0.15.1",
     "mocha": "10.2.0",

package/test/apps/async/index.js

@@ -65,7 +65,8 @@ function create(hbs, env) {
 
   // Hook in express-hbs and tell it where known directories reside
   app.engine('hbs', hbs.express4({
-    defaultLayout: path.join(viewsDir, "layout.hbs")
+    defaultLayout: path.join(viewsDir, 'layout.hbs'),
+    restrictLayoutsTo: viewsDir
   }));
   app.set('view engine', 'hbs');
   app.set('views', viewsDir);

package/test/apps/i18n/index.js

@@ -31,7 +31,8 @@ function create(hbs, env) {
 
   // Hook in express-hbs and tell it where known directories reside
   app.engine('hbs', hbs.express3({
-    i18n: i18n
+    i18n: i18n,
+    restrictLayoutsTo: viewsDir
   }));
   app.set('view engine', 'hbs');
   app.set('views', viewsDir);