express-hbs 2.5.0 → 2.5.1

package/.claude/worktrees/security-patches-review-c621ea/test/localTemplateOptions.js

@@ -0,0 +1,125 @@
+'use strict';
+var assert = require('assert');
+var path = require('path');
+var hbs = require('..');
+var H = require('./helpers');
+
+describe('local template options', function () {
+  var dirname = path.join(__dirname, 'localTemplateOptions');
+
+  describe('express3', function () {
+    it('merges res.locals._templateOptions with the self._templateOptions', function (done) {
+      var instance = hbs.create();
+      var render = instance.express3({
+        restrictLayoutsTo: dirname,
+      });
+      instance.updateTemplateOptions({
+        data: {
+          greeting: 'Hello,',
+          firstName: 'Freddy',
+          lastName: 'Krueger',
+        },
+      });
+
+      var locals = H.createLocals('express3', dirname, {
+        _templateOptions: {
+          data: {
+            lastName: 'Mercury',
+          },
+        },
+      });
+
+      render(path.join(dirname, 'template.hbs'), locals, function (err, html) {
+        assert.ifError(err);
+        assert.strictEqual(H.stripWs(html), H.stripWs('Hello, Freddy Mercury'));
+        done(err);
+      });
+    });
+
+    it('removes _templateOptions from the locals data', function (done) {
+      var instance = hbs.create();
+      var render = instance.express3({
+        restrictLayoutsTo: dirname,
+      });
+      instance.updateTemplateOptions({
+        data: {
+          greeting: 'Hello,',
+          firstName: 'Freddy',
+          lastName: 'Krueger',
+        },
+      });
+
+      var locals = H.createLocals('express3', dirname, {
+        _templateOptions: {
+          data: {
+            lastName: 'Mercury',
+          },
+        },
+      });
+
+      render(path.join(dirname, 'data-access-template.hbs'), locals, function (err, html) {
+        assert.ifError(err);
+        assert.strictEqual(H.stripWs(html), H.stripWs(''));
+        done(err);
+      });
+    });
+  });
+
+  describe('express4', function () {
+    it('merges res.locals._templateOptions with the self._templateOptions', function (done) {
+      var instance = hbs.create();
+      var render = instance.express4({
+        restrictLayoutsTo: dirname,
+      });
+      instance.updateTemplateOptions({
+        data: {
+          greeting: 'Hello,',
+          firstName: 'Freddy',
+          lastName: 'Krueger',
+        },
+      });
+
+      var locals = H.createLocals('express4', dirname, {
+        _templateOptions: {
+          data: {
+            lastName: 'Mercury',
+          },
+        },
+      });
+
+      render(path.join(dirname, 'template.hbs'), locals, function (err, html) {
+        assert.ifError(err);
+        assert.strictEqual(H.stripWs(html), H.stripWs('Hello, Freddy Mercury'));
+        done(err);
+      });
+    });
+
+    it('removes _templateOptions from the locals data', function (done) {
+      var instance = hbs.create();
+      var render = instance.express3({
+        restrictLayoutsTo: dirname,
+      });
+      instance.updateTemplateOptions({
+        data: {
+          greeting: 'Hello,',
+          firstName: 'Freddy',
+          lastName: 'Krueger',
+        },
+      });
+
+      var locals = H.createLocals('express3', dirname, {
+        _templateOptions: {
+          data: {
+            lastName: 'Mercury',
+          },
+        },
+      });
+
+      render(path.join(dirname, 'data-access-template.hbs'), locals, function (err, html) {
+        assert.ifError(err);
+        assert.strictEqual(H.stripWs(html), H.stripWs(''));
+        done(err);
+      });
+    });
+  });
+});

package/.claude/worktrees/security-patches-review-c621ea/test/multiple.js

@@ -0,0 +1,115 @@
+'use strict';
+
+var request = require('supertest');
+var assert = require('assert');
+var express = require('express');
+var hbs = require('..');
+
+describe('multiple directories', function () {
+  var app;
+
+  beforeEach(function () {
+    app = express();
+    app.engine(
+      'hbs',
+      hbs.express3({
+        restrictLayoutsTo: './test/views/multiple',
+      }),
+    );
+    app.set('view engine', 'hbs');
+    app.get('/test1', function (req, res) {
+      res.render('test1');
+    });
+    app.get('/test2', function (req, res) {
+      res.render('test2');
+    });
+    app.get('/collide', function (req, res) {
+      res.render('collide');
+    });
+    app.get('/error', function (req, res) {
+      res.render('error');
+    });
+  });
+
+  it('should handle single folder', function (done) {
+    app.set('views', './test/views/multiple/views1');
+    request(app)
+      .get('/test1')
+      .end(function (err, res) {
+        assert.ifError(err);
+        var expected = '<h1>test1</h1>\n';
+        assert.equal(res.text, expected);
+        done();
+      });
+  });
+
+  it('should handle multiple folders', function (done) {
+    app.set('views', ['./test/views/multiple/views1', './test/views/multiple/views2']);
+    request(app)
+      .get('/test2')
+      .end(function (err, res) {
+        assert.ifError(err);
+        var expected = '<h1>test2</h1>\n';
+        assert.equal(res.text, expected);
+        done();
+      });
+  });
+
+  describe('should handle multiple folders in specific order', function () {
+    it('views1, views2', function (done) {
+      app.set('views', ['./test/views/multiple/views1', './test/views/multiple/views2']);
+      request(app)
+        .get('/collide')
+        .end(function (err, res) {
+          assert.ifError(err);
+          var expected = '<h1>collide1</h1>\n';
+          assert.equal(res.text, expected);
+          done();
+        });
+    });
+
+    it('views2, views1', function (done) {
+      app.set('views', ['./test/views/multiple/views2', './test/views/multiple/views1']);
+      request(app)
+        .get('/collide')
+        .end(function (err, res) {
+          assert.ifError(err);
+          var expected = '<h1>collide2</h1>\n';
+          assert.equal(res.text, expected);
+          done();
+        });
+    });
+  });
+
+  describe('should report the filename in error', function () {
+    it('should report from first folder', function (done) {
+      app.set('views', ['./test/views/multiple/views1', './test/views/multiple/views2']);
+      app.use(function (err, req, res, next) {
+        res.status(500).send(err.stack);
+      });
+
+      request(app)
+        .get('/error')
+        .end(function (err, res) {
+          assert.ifError(err);
+          assert(res.error.text.indexOf('views1/error.hbs]') > 0);
+          done();
+        });
+    });
+
+    it('should report from second folder', function (done) {
+      app.set('views', ['./test/views/multiple/views2', './test/views/multiple/views1']);
+      app.use(function (err, req, res, next) {
+        res.status(500).send(err.stack);
+      });
+
+      request(app)
+        .get('/error')
+        .end(function (err, res) {
+          assert.ifError(err);
+          assert(res.error.text.indexOf('views2/error.hbs]') > 0);
+          done();
+        });
+    });
+  });
+});

package/.claude/worktrees/security-patches-review-c621ea/test/nonExpress.js

@@ -0,0 +1,36 @@
+var assert = require('assert');
+var hbs = require('..');
+var H = require('./helpers');
+
+describe('non-express', function () {
+  describe('viewsDir', function () {
+    var dirname = __dirname + '/views/viewsDir';
+
+    it('should use viewsDir options', function (done) {
+      var render = hbs.create().express3({
+        viewsDir: dirname,
+        restrictLayoutsTo: dirname,
+      });
+      var locals = H.createLocals('express3', dirname);
+
+      render(dirname + '/sub/directive.hbs', locals, function (err, html) {
+        assert.equal('<vd>directive</vd>', H.stripWs(html));
+        done();
+      });
+    });
+
+    it('should work with layoutsDir', function (done) {
+      var render = hbs.create().express3({
+        viewsDir: dirname,
+        layoutsDir: dirname + '/layouts',
+        restrictLayoutsTo: dirname,
+      });
+      var locals = H.createLocals('express3', dirname, { layout: 'default.hbs' });
+
+      render(dirname + '/sub/lay.hbs', locals, function (err, html) {
+        assert.equal('<vd>lay</vd>', H.stripWs(html));
+        done();
+      });
+    });
+  });
+});

package/.claude/worktrees/security-patches-review-c621ea/test/optionsSpecs.js

@@ -0,0 +1,22 @@
+var assert = require('assert');
+var hbs = require('..');
+var path = require('path');
+var H = require('./helpers');
+var fs = require('fs');
+
+describe('options', function () {
+  var dirname = path.join(__dirname, 'views/beautify');
+
+  it('should pretty print HTML', function (done) {
+    var hb = hbs.create();
+    var render = hb.express3({ beautify: true, restrictLayoutsTo: dirname });
+    var locals = H.createLocals('express3', dirname, {});
+
+    render(dirname + '/index.hbs', locals, function (err, html) {
+      assert.ifError(err);
+      var expected = fs.readFileSync(dirname + '/expected.hbs', 'utf8');
+      assert.equal(html.trim(), expected.trim());
+      done();
+    });
+  });
+});

package/.claude/worktrees/security-patches-review-c621ea/test/resolverSpecs.js

@@ -0,0 +1,54 @@
+'use strict';
+
+var assert = require('assert');
+var generateId = require('../lib/generate-id');
+var resolver = require('../lib/resolver');
+
+describe('resolver', function () {
+  it('detects an unresolved helper at the start of rendered output', function () {
+    assert.equal(resolver.hasResolvers('__aSyNcId__<_12345678__'), true);
+  });
+
+  it('does not report rendered output without a resolver marker', function () {
+    assert.equal(resolver.hasResolvers('rendered output'), false);
+  });
+
+  it('resolves asynchronous helper output with its context', function (done) {
+    var cache = {};
+    var id = resolver.resolve(
+      cache,
+      function (context, callback) {
+        callback(context.value);
+      },
+      { value: 'resolved' },
+    );
+
+    resolver.done(cache, function (err, values) {
+      assert.ifError(err);
+      assert.equal(values[id], 'resolved');
+      done();
+    });
+  });
+
+  it('reports synchronous helper failures', function (done) {
+    var cache = {};
+    resolver.resolve(cache, function () {
+      throw new Error('helper failed');
+    });
+
+    resolver.done(cache, function (err) {
+      assert.equal(err.message, 'helper failed');
+      done();
+    });
+  });
+});
+
+describe('generateId', function () {
+  it('uses an eight-character default', function () {
+    assert.match(generateId(), /^[A-Za-z_]{8}$/);
+  });
+
+  it('uses the requested length', function () {
+    assert.match(generateId(16), /^[A-Za-z_]{16}$/);
+  });
+});

package/.claude/worktrees/security-patches-review-c621ea/test/views/beautify/expected.hbs

@@ -0,0 +1,9 @@
+<html>
+
+<head>head</head>
+
+<body>
+  <h1>heading 1</h1>
+  <h2>heading 2</h2>
+</body>
+<html>

package/.claude/worktrees/security-patches-review-c621ea/test/views/beautify/index.hbs

@@ -0,0 +1,2 @@
+<html>
+  <head>head</head> <body><h1>heading 1</h1><h2>heading 2</h2></body> <html>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/layout.server.view.html

@@ -0,0 +1 @@
+<html>{{{body}}}</html>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/partialsDir/partial1.server.view.html

@@ -0,0 +1 @@
+<partial>1</partial>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/partialsDir/partial2.server.view.html

@@ -0,0 +1 @@
+<partial>2</partial>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/partialsDir/subs/subPartial1.server.view.html

@@ -0,0 +1 @@
+<subpartial>1</subpartial>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/partialsDir/subs/subPartial2.server.view.html

@@ -0,0 +1 @@
+<subpartial>2</subpartial>

package/.claude/worktrees/security-patches-review-c621ea/test/views/customExtension/template.server.view.html

@@ -0,0 +1,5 @@
+{{!< layout}}
+{{> subs/subPartial1}}
+{{> partial1}}
+{{> subs/subPartial2}}
+{{> partial2}}

package/.claude/worktrees/security-patches-review-c621ea/test/views/disableLayoutDirective/aside.hbs

@@ -0,0 +1 @@
+aside

package/.claude/worktrees/security-patches-review-c621ea/test/views/disableLayoutDirective/index.hbs

@@ -0,0 +1,2 @@
+{{!< layouts/default}}
+dld

package/.claude/worktrees/security-patches-review-c621ea/test/views/disableLayoutDirective/layouts/default.hbs

@@ -0,0 +1 @@
+<dld>{{{body}}}</dld>

package/.claude/worktrees/security-patches-review-c621ea/test/views/helpers/home/async.hbs

@@ -0,0 +1,6 @@
+{{!< ../layouts/default}}
+asynctemplate
+{{async "foo"}}
+{{async "bar"}}
+{{async "bah"}}
+{{async "baz"}}

package/.claude/worktrees/security-patches-review-c621ea/test/views/helpers/home/index.hbs

@@ -0,0 +1,3 @@
+{{!< ../layouts/default}}
+index
+{{sync "index"}}

package/.claude/worktrees/security-patches-review-c621ea/test/views/helpers/layouts/default.hbs

@@ -0,0 +1 @@
+<default>{{{body}}}</default>

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views1/collide.hbs

@@ -0,0 +1 @@
+<h1>collide1</h1>

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views1/error.hbs

@@ -0,0 +1 @@
+{{{http://google.co.uk}}

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views1/test1.hbs

@@ -0,0 +1 @@
+<h1>test1</h1>

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views2/collide.hbs

@@ -0,0 +1 @@
+<h1>collide2</h1>

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views2/error.hbs

@@ -0,0 +1 @@
+{{{http://google.co.uk}}

package/.claude/worktrees/security-patches-review-c621ea/test/views/multiple/views2/test2.hbs

@@ -0,0 +1 @@
+<h1>test2</h1>

package/.claude/worktrees/security-patches-review-c621ea/test/views/viewsDir/layouts/default.hbs

@@ -0,0 +1 @@
+<vd>{{{body}}}</vd>

package/.claude/worktrees/security-patches-review-c621ea/test/views/viewsDir/sub/directive.hbs

@@ -0,0 +1,2 @@
+{{!< ../layouts/default}}
+directive

package/.claude/worktrees/security-patches-review-c621ea/test/views/viewsDir/sub/lay.hbs

@@ -0,0 +1 @@
+lay

package/lib/hbs.js

@@ -100,7 +100,12 @@ ExpressHbs.prototype.cacheLayout = function(layoutFile, useCache, cb) {
   var self = this;
 
   if (this.restrictLayoutsTo) {
-    if (!layoutFile.startsWith(this.restrictLayoutsTo)) {
+    var relativePath = path.relative(this.restrictLayoutsTo, layoutFile);
+    var outside = relativePath === '..' ||
+      relativePath.startsWith('..' + path.sep) ||
+      path.isAbsolute(relativePath);
+
+    if (outside) {
       var err = new Error('Cannot read ' + layoutFile + ' it does not reside in ' + this.restrictLayoutsTo);
       return cb(err, null);
     }
@@ -341,7 +346,7 @@ ExpressHbs.prototype.compile = function(source, filename) {
   if (typeof source !== 'string') {
     throw new Error('registerPartial must be a string for empty comment workaround');
   }
-  if (source.indexOf('}}') === source.length - 2) {
+  if (source.length >= 2 && source.indexOf('}}') === source.length - 2) {
     source += ' ';
   }
 
@@ -645,10 +650,16 @@ ExpressHbs.prototype.___express = function ___express(filename, source, options,
       Object.keys(values).forEach(function(key) {
         values[key] = replaceValue(values, values[key]);
       });
-      res = replaceValue(values, res);
-      if (resolver.hasResolvers(res)) {
-        return handleAsync(null, res);
+      var replaced = replaceValue(values, res);
+      // Re-check against the live cache: nested async helpers may have registered new IDs
+      // while resolving. Stop if a pass made no progress so unknown IDs can never loop forever.
+      if (
+        replaced !== res &&
+        resolver.hasResolvers(replaced, options.resolverCache, self.Utils.escapeExpression)
+      ) {
+        return handleAsync(null, replaced);
       }
+      res = replaced;
       cb(null, res);
     });
   }

package/lib/resolver.js

@@ -41,14 +41,21 @@ function done(cache, callback) {
   });
 }
 
-function hasResolvers(text) {
+function hasResolvers(text, cache, escape) {
   // NOTE: We specifically search the text for the ID_PREFIX **NOT** including the escapable character
   // This is because that character can be escaped in the text, and lead us to not finding unresolved
   // async helper outputs.
-  if (text.search(ID_PREFIX) > 0) {
+  if (text.indexOf(ID_PREFIX) < 0) {
+    return false;
+  }
+  if (!cache) {
     return true;
   }
-  return false;
+  // Only report IDs that were actually generated by an async helper. The prefix can also
+  // appear in user-supplied data, which must never be treated as an unresolved helper.
+  return Object.keys(cache).some(function(id) {
+    return text.indexOf(id) >= 0 || (escape && text.indexOf(escape(id)) >= 0);
+  });
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "express-hbs",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "Express handlebars template engine complete with multiple layouts, partials and blocks.",
   "keywords": [
     "express4",

package/test/asyncSpecs.js

@@ -5,6 +5,7 @@ var assert = require('assert');
 var hbs = require('..');
 var asyncApp = require('./apps/async');
 var resolver = require('../lib/resolver');
+var H = require('./helpers');
 
 function makeUserRequest(app, user, cb) {
   request(app)
@@ -66,4 +67,63 @@ describe('async', function() {
       done();
     });
   });
+
+  describe('literal async id prefix in data', function () {
+    var dirname = __dirname + '/views/asyncPrefix';
+
+    function createRender() {
+      var hb = hbs.create();
+      hb.registerAsyncHelper('async', function (s, cb) {
+        setTimeout(function () {
+          cb(new hb.SafeString('async-' + s));
+        }, 1);
+      });
+      return hb.express4({ viewsDir: dirname });
+    }
+
+    function renderValue(file, locals, cb) {
+      var render = createRender();
+      render(dirname + '/' + file, H.createLocals('express4', dirname, locals), cb);
+    }
+
+    it('renders prefix text in the middle of data verbatim', function (done) {
+      renderValue('body.hbs', { body: 'x __aSyNcId__ y' }, function (err, html) {
+        if (err) return done(err);
+        assert.equal(html.trim(), 'hello x __aSyNcId__ y');
+        done();
+      });
+    });
+
+    [
+      '__aSyNcId__',
+      '__aSyNcId__ start',
+      'middle __aSyNcId__ text',
+      '__aSyNcId__<_abcdefgh__',
+      'x __aSyNcId__<_abcdefgh__ y',
+    ].forEach(function (value) {
+      it('renders ' + JSON.stringify(value) + ' escaped and unescaped', function (done) {
+        renderValue('index.hbs', { value: value }, function (err, html) {
+          if (err) return done(err);
+          var escaped = hbs.Utils.escapeExpression(value);
+          assert.equal(html.trim(), 'hello ' + escaped + '|' + value + '|async-a');
+          done();
+        });
+      });
+    });
+
+    it('renders prefix text in data alongside nested async helpers', function (done) {
+      var app = asyncApp.create(hbs.create(), 'production');
+      request(app)
+        .get('/')
+        .set('Cookie', 'user=__aSyNcId__')
+        .end(function (err, res) {
+          if (err) return done(err);
+          assert.notEqual(res.text.indexOf('Hello, __aSyNcId__'), -1);
+          assert.notEqual(res.text.indexOf('This should welcome __aSyNcId__.'), -1);
+          assert.notEqual(res.text.indexOf('Title 1 Comment 1'), -1);
+          assert.equal(res.text.indexOf('This should not show!'), -1);
+          done();
+        });
+    });
+  });
 });

package/test/handlebarsSpecs.js

@@ -92,4 +92,23 @@ describe('express-hbs', function() {
       assert(hbs !== hbs2 && hbs !== hbs3 && hbs2 !== hbs3);
     });
   });
+
+  describe('compile', function () {
+    it('should pad a template that ends with its only closing tag', function () {
+      var hb = hbs.create();
+      hb.onCompile = function (exhbs, source) {
+        return source;
+      };
+      assert.equal(hb.compile('{{! comment }}'), '{{! comment }} ');
+    });
+
+    it('should not pad a one-character template', function () {
+      var hb = hbs.create();
+      hb.onCompile = function (exhbs, source) {
+        return source;
+      };
+      assert.equal(hb.compile('x'), 'x');
+      assert.equal(hb.compile(''), '');
+    });
+  });
 });

package/test/layoutSpecs.js

@@ -102,6 +102,36 @@ describe('layouts', function() {
       });
     });
 
+    it('should allow a layout inside a relative restrictLayoutsTo', function(done) {
+      var render = hbs.create().express3({
+        restrictLayoutsTo: path.relative(process.cwd(), dirname)
+      });
+      var locals = createLocals('express3', dirname, { layout: 'layouts/default' });
+
+      render(dirname + '/aside.hbs', locals, function(err, html) {
+        if (err) return done(err);
+        assert.equal('<dld>aside</dld>', stripWs(html));
+        done();
+      });
+    });
+
+    it('should error when a layout is in a sibling directory sharing the restrictLayoutsTo prefix', function(done) {
+      var restrictLayoutsTo = path.join(dirname, 'lay');
+      var render = hbs.create().express3({
+        restrictLayoutsTo: restrictLayoutsTo
+      });
+      var locals = createLocals('express3', dirname, { layout: 'layouts/default' });
+
+      render(dirname + '/aside.hbs', locals, function(err) {
+        assert.ok(err, 'expected an error');
+        assert.ok(
+          err.message.includes('does not reside in ' + restrictLayoutsTo),
+          'unexpected error: ' + err.message
+        );
+        done();
+      });
+    });
+
     it ('should not process template-specified layout when options.layout is falsy', function(done) {
       var render = hbs.create().express3({
         restrictLayoutsTo: dirname