express-hbs 4.0.1 → 4.0.2

package/lib/hbs.js

@@ -348,7 +348,7 @@ ExpressHbs.prototype.compile = function (source, filename) {
   if (typeof source !== 'string') {
     throw new Error('registerPartial must be a string for empty comment workaround');
   }
-  if (source.indexOf('}}') === source.length - 2) {
+  if (source.length >= 2 && source.indexOf('}}') === source.length - 2) {
     source += ' ';
   }
 
@@ -643,10 +643,16 @@ ExpressHbs.prototype.___express = function ___express(filename, source, options,
       Object.keys(values).forEach(function (key) {
         values[key] = replaceValue(values, values[key]);
       });
-      res = replaceValue(values, res);
-      if (resolver.hasResolvers(res)) {
-        return handleAsync(null, res);
+      var replaced = replaceValue(values, res);
+      // Re-check against the live cache: nested async helpers may have registered new IDs
+      // while resolving. Stop if a pass made no progress so unknown IDs can never loop forever.
+      if (
+        replaced !== res &&
+        resolver.hasResolvers(replaced, options.resolverCache, self.Utils.escapeExpression)
+      ) {
+        return handleAsync(null, replaced);
       }
+      res = replaced;
       cb(null, res);
     });
   }

package/lib/resolver.js

@@ -42,14 +42,21 @@ function done(cache, callback) {
     });
 }
 
-function hasResolvers(text) {
+function hasResolvers(text, cache, escape) {
   // NOTE: We specifically search the text for the ID_PREFIX **NOT** including the escapable character
   // This is because that character can be escaped in the text, and lead us to not finding unresolved
   // async helper outputs.
-  if (text.search(ID_PREFIX) >= 0) {
+  if (text.indexOf(ID_PREFIX) < 0) {
+    return false;
+  }
+  if (!cache) {
     return true;
   }
-  return false;
+  // Only report IDs that were actually generated by an async helper. The prefix can also
+  // appear in user-supplied data, which must never be treated as an unresolved helper.
+  return Object.keys(cache).some(function (id) {
+    return text.indexOf(id) >= 0 || (escape && text.indexOf(escape(id)) >= 0);
+  });
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "express-hbs",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "Express handlebars template engine complete with multiple layouts, partials and blocks.",
   "keywords": [
     "express4",
@@ -28,7 +28,7 @@
   "author": "Mario Gutierrez <mario@barc.com>",
   "license": "MIT",
   "devDependencies": {
-    "@tryghost/pro-ship": "2.0.1",
+    "@tryghost/pro-ship": "2.0.3",
     "cookie-parser": "1.4.7",
     "express": "5.3.0",
     "i18n": "0.15.4",