psimsa/handlebars.js
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch '4.x'

Browse Source 
# Conflicts:
#	components/bower.json
#	components/handlebars.js.nuspec
#	components/package.json
#	package.json
This commit is contained in:
Nils Knappmeier
2019-04-13 16:48:27 +02:00
parent 1b04524a53 10b5fcf92e
commit 2f681d256f
25 changed files with 9111 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.travis.yml
+1
View File
@@ -3,6 +3,7 @@ before_install:
- npm install -g grunt-cli
script:
- grunt --stack travis
- multi-nodejs-test/run-tests.sh 0.10 0.12 4 5 6 7 8 9 10 11
email:
on_failure: change
on_success: never
Gruntfile.js
+15 -4
View File
@@ -12,7 +12,8 @@ module.exports = function(grunt) {
'bench/**/*.js',
'tasks/**/*.js',
'lib/**/!(*.min|parser).js',
'spec/**/!(*.amd|json2|require).js'
'spec/**/!(*.amd|json2|require).js',
'multi-nodejs-test/*.js'
]
},
@@ -122,8 +123,8 @@ module.exports = function(grunt) {
browsers: [
{browserName: 'chrome'},
{browserName: 'firefox', platform: 'Linux'},
{browserName: 'safari', version: 9, platform: 'OS X 10.11'},
{browserName: 'safari', version: 8, platform: 'OS X 10.10'},
// {browserName: 'safari', version: 9, platform: 'OS X 10.11'},
// {browserName: 'safari', version: 8, platform: 'OS X 10.10'},
{browserName: 'internet explorer', version: 11, platform: 'Windows 8.1'},
{browserName: 'internet explorer', version: 10, platform: 'Windows 8'}
]
@@ -143,6 +144,14 @@ module.exports = function(grunt) {
}
},
bgShell: {
checkTypes: {
cmd: 'npm run checkTypes',
bg: false,
fail: true
}
},
watch: {
scripts: {
options: {
@@ -158,6 +167,7 @@ module.exports = function(grunt) {
// Build a new version of the library
this.registerTask('build', 'Builds a distributable version of the current project', [
'eslint',
'bgShell:checkTypes',
'parser',
'node',
'globals']);
@@ -176,6 +186,7 @@ module.exports = function(grunt) {
grunt.loadNpmTasks('grunt-contrib-uglify');
grunt.loadNpmTasks('grunt-contrib-watch');
grunt.loadNpmTasks('grunt-babel');
grunt.loadNpmTasks('grunt-bg-shell');
grunt.loadNpmTasks('grunt-eslint');
grunt.loadNpmTasks('grunt-saucelabs');
grunt.loadNpmTasks('grunt-webpack');
@@ -183,7 +194,7 @@ module.exports = function(grunt) {
grunt.task.loadTasks('tasks');
grunt.registerTask('bench', ['metrics']);
grunt.registerTask('sauce', [] /* process.env.SAUCE_USERNAME ? ['tests', 'connect', 'saucelabs-mocha'] : [] */);
grunt.registerTask('sauce', process.env.SAUCE_USERNAME ? ['tests', 'connect', 'saucelabs-mocha'] : []);
grunt.registerTask('travis', process.env.PUBLISH ? ['default', 'sauce', 'metrics', 'publish:latest'] : ['default']);
bench/dist-size.js
+1 -1
View File
@@ -1,4 +1,4 @@
var async = require('async'),
var async = require('neo-async'),
fs = require('fs'),
zlib = require('zlib');
lib/handlebars/base.js
+1 -1
View File
@@ -4,7 +4,7 @@ import {registerDefaultHelpers} from './helpers';
import {registerDefaultDecorators} from './decorators';
import logger from './logger';
export const VERSION = '4.1.0';
export const VERSION = '4.1.2';
export const COMPILER_REVISION = 7;
export const REVISION_CHANGES = {
lib/handlebars/compiler/helpers.js
+1 -1
View File
@@ -24,7 +24,7 @@ export function SourceLocation(source, locInfo) {
export function id(token) {
if (/^\[.*\]$/.test(token)) {
return token.substr(1, token.length - 2);
return token.substring(1, token.length - 1);
} else {
return token;
}
lib/handlebars/helpers/lookup.js
+7 -1
View File
@@ -1,5 +1,11 @@
export default function(instance) {
instance.registerHelper('lookup', function(obj, field) {
return obj && obj[field];
if (!obj) {
return obj;
}
if (field === 'constructor' && !obj.propertyIsEnumerable(field)) {
return undefined;
}
return obj[field];
});
}
lib/precompiler.js
+1 -1
View File
@@ -1,5 +1,5 @@
/* eslint-disable no-console */
import Async from 'async';
import Async from 'neo-async';
import fs from 'fs';
import * as Handlebars from './handlebars';
import {basename} from 'path';
multi-nodejs-test/.eslintrc.js
+114
View File
@@ -0,0 +1,114 @@
module.exports = {
"extends": "eslint:recommended",
"globals": {
"self": false
},
"env": {
"node": true
},
"rules": {
// overrides eslint:recommended defaults
"no-sparse-arrays": "off",
"no-func-assign": "off",
"no-console": "off",
"no-debugger": "warn",
"no-unreachable": "warn",
// Possible Errors //
//-----------------//
"no-unsafe-negation": "error",
// Best Practices //
//----------------//
"curly": "error",
"default-case": "warn",
"dot-notation": ["error", { "allowKeywords": false }],
"guard-for-in": "warn",
"no-alert": "error",
"no-caller": "error",
"no-div-regex": "warn",
"no-eval": "error",
"no-extend-native": "error",
"no-extra-bind": "error",
"no-floating-decimal": "error",
"no-implied-eval": "error",
"no-iterator": "error",
"no-labels": "error",
"no-lone-blocks": "error",
"no-loop-func": "error",
"no-multi-spaces": "error",
"no-multi-str": "warn",
"no-global-assign": "error",
"no-new": "error",
"no-new-func": "error",
"no-new-wrappers": "error",
"no-octal-escape": "error",
"no-process-env": "error",
"no-proto": "error",
"no-return-assign": "error",
"no-script-url": "error",
"no-self-compare": "error",
"no-sequences": "error",
"no-throw-literal": "error",
"no-unused-expressions": "error",
"no-warning-comments": "warn",
"no-with": "error",
"radix": "error",
"wrap-iife": "error",
// Variables //
//-----------//
"no-catch-shadow": "error",
"no-label-var": "error",
"no-shadow-restricted-names": "error",
"no-undef-init": "error",
"no-use-before-define": ["error", "nofunc"],
// Stylistic Issues //
//------------------//
"comma-dangle": ["error", "never"],
"quote-props": ["error", "as-needed", { "keywords": true, "unnecessary": false }],
"brace-style": ["error", "1tbs", { "allowSingleLine": true }],
"camelcase": "error",
"comma-spacing": ["error", { "before": false, "after": true }],
"comma-style": ["error", "last"],
"consistent-this": ["warn", "self"],
"eol-last": "error",
"func-style": ["error", "declaration"],
"key-spacing": ["error", {
"beforeColon": false,
"afterColon": true
}],
"new-cap": "error",
"new-parens": "error",
"no-array-constructor": "error",
"no-lonely-if": "error",
"no-mixed-spaces-and-tabs": "error",
"no-nested-ternary": "warn",
"no-new-object": "error",
"no-spaced-func": "error",
"no-trailing-spaces": "error",
"no-extra-parens": ["error", "functions"],
"quotes": ["error", "single", "avoid-escape"],
"semi": "error",
"semi-spacing": ["error", { "before": false, "after": true }],
"keyword-spacing": "error",
"space-before-blocks": ["error", "always"],
"space-before-function-paren": ["error", { "anonymous": "never", "named": "never" }],
"space-in-parens": ["error", "never"],
"space-infix-ops": "error",
"space-unary-ops": "error",
"spaced-comment": ["error", "always", { "markers": [","] }],
"wrap-regex": "warn",
// ECMAScript 6 //
//--------------//
"no-var": "off"
},
"parserOptions": {
"sourceType": "module"
}
}
multi-nodejs-test/expected.txt
+1
View File
@@ -0,0 +1 @@
Author: Yehuda
multi-nodejs-test/run-handlebars.js
Executable
+13
View File
@@ -0,0 +1,13 @@
// This test should run with node 0.10 as long as Handlebars has been compiled before
var Handlebars = require('../');
var fs = require('fs');
console.log('Testing build Handlebars with Node version ' + process.version);
var template = fs.readFileSync(require.resolve('./template.txt.hbs'), 'utf-8');
var compiledOutput = Handlebars.compile(template)({author: 'Yehuda'}).trim();
var expectedOutput = fs.readFileSync(require.resolve('./expected.txt'), 'utf-8').trim();
if (compiledOutput !== expectedOutput) {
throw new Error('Compiled output (' + compiledOutput + ') did not match expected output (' + expectedOutput + ')');
}
console.log('Success');
multi-nodejs-test/run-tests.sh
Executable
+21
View File
@@ -0,0 +1,21 @@
#!/bin/bash
cd "$( dirname "$( readlink -f "$0" )" )"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
# This script tests with precompiler and the built distribution with multiple NodeJS version.
# The rest of the travis-build will only work with newer NodeJS versions, because the build
# tools don't support older versions.
# However, the built distribution should work with older NodeJS versions as well.
# This test is simple by design. It merely ensures, that calling Handlebars does not fail with old versions.
# It does (almost) not test for correctness, because that is already done in the mocha-tests.
# And it does not use any NodeJS based testing framwork to make this part independent of the Node version.
# A list of NodeJS versions is expected as cli-args
echo "Handlebars should be able to run in various versions of NodeJS"
for i in "$@" ; do
nvm install "$i"
nvm exec "$i" node ./run-handlebars.js >/dev/null || exit 1
nvm exec "$i" node ../bin/handlebars template.txt.hbs >/dev/null || exit 1
echo Success
done
multi-nodejs-test/template.txt.hbs
+1
View File
@@ -0,0 +1 @@
Author: {{author}}
package-lock.json
Generated
+8676
View File
File diff suppressed because it is too large Load Diff
package.json
+8 -3
View File
@@ -21,7 +21,7 @@
"node": ">=0.4.7"
},
"dependencies": {
"async": "^2.5.0",
"neo-async": "^2.6.0",
"source-map": "^0.6.1",
"yargs": "^3.32.0"
},
@@ -33,10 +33,12 @@
"babel-loader": "^5.0.0",
"babel-runtime": "^5.1.10",
"benchmark": "~1.0",
"dtslint": "^0.5.5",
"dustjs-linkedin": "^2.0.2",
"eco": "~1.1.0-rc-3",
"grunt": "^1.0.3",
"grunt-babel": "^5.0.0",
"grunt-bg-shell": "^2.3.3",
"grunt-cli": "^1",
"grunt-contrib-clean": "^1",
"grunt-contrib-concat": "^1",
@@ -54,16 +56,18 @@
"mock-stdin": "^0.3.0",
"mustache": "^2.1.3",
"semver": "^5.0.1",
"typescript": "^3.4.3",
"underscore": "^1.5.1",
"webpack": "^1.12.6",
"webpack-dev-server": "^1.12.1"
},
"main": "lib/index.js",
"types": "lib/handlebars.d.ts",
"types": "types/index.d.ts",
"bin": {
"handlebars": "bin/handlebars"
},
"scripts": {
"checkTypes": "dtslint types",
"test": "grunt"
},
"jspm": {
@@ -83,6 +87,7 @@
"lib",
"print-script",
"release-notes.md",
"runtime.js"
"runtime.js",
"types/*.d.ts"
]
}
release-notes.md
+36 -1
View File
@@ -2,7 +2,42 @@
## Development
[Commits](https://github.com/wycats/handlebars.js/compare/v4.1.0...master)
[Commits](https://github.com/wycats/handlebars.js/compare/v4.1.2...master)
## v4.1.2 - April 13th, 2019
Chore/Test:
- [#1515](https://github.com/wycats/handlebars.js/pull/1515) - Port over linting and test for typings ([@zimmi88](https://api.github.com/users/zimmi88))
- chore: add missing typescript dependency, add package-lock.json - 594f1e3
- test: remove safari from saucelabs - 871accc
Bugfixes:
- fix: prevent RCE through the "lookup"-helper - cd38583
Compatibility notes:
Access to the constructor of a class thought `{{lookup obj "constructor" }}` is now prohibited. This closes
a leak that only half closed in versions 4.0.13 and 4.1.0, but it is a slight incompatibility.
This kind of access is not the intended use of Handlebars and leads to the vulnerability described
in #1495. We will **not** increase the major version, because such use is not intended or documented,
and because of the potential impact of the issue (we fear that most people won't use a new major version
and the issue may not be resolved on many systems).
[Commits](https://github.com/wycats/handlebars.js/compare/v4.1.1...v4.1.2)
## v4.1.1 - March 16th, 2019
Bugfixes:
- fix: add "runtime.d.ts" to allow "require('handlebars/runtime')" in TypeScript - 5cedd62
Refactorings:
- replace "async" with "neo-async" - 048f2ce
- use "substring"-function instead of "substr" - 445ae12
Compatibility notes:
- This is a bugfix release. There are no breaking change and no new features.
[Commits](https://github.com/wycats/handlebars.js/compare/v4.1.0...v4.1.1)
## v4.1.0 - February 7th, 2019
New Features
runtime.d.ts
Vendored
+5
View File
@@ -0,0 +1,5 @@
import Handlebars = require('handlebars')
declare module "handlebars/runtime" {
}
spec/security.js
+15 -3
View File
@@ -2,22 +2,34 @@ describe('security issues', function() {
describe('GH-1495: Prevent Remote Code Execution via constructor', function() {
it('should not allow constructors to be accessed', function() {
shouldCompileTo('{{constructor.name}}', {}, '');
shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {}, '');
});
it('should allow the "constructor" property to be accessed if it is enumerable', function() {
shouldCompileTo('{{constructor.name}}', {'constructor': {
'name': 'here we go'
}}, 'here we go');
shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {'constructor': {
'name': 'here we go'
}}, 'here we go');
});
it('should allow prototype properties that are not constructors', function() {
class TestClass {
get abc() {
function TestClass() {
}
Object.defineProperty(TestClass.prototype, 'abc', {
get: function() {
return 'xyz';
}
}
});
shouldCompileTo('{{#with this as |obj|}}{{obj.abc}}{{/with}}',
new TestClass(), 'xyz');
shouldCompileTo('{{#with this as |obj|}}{{lookup obj "abc"}}{{/with}}',
new TestClass(), 'xyz');
});
});
});
src/handlebars.l
+2 -2
View File
@@ -4,7 +4,7 @@
%{
function strip(start, end) {
return yytext = yytext.substr(start, yyleng-end);
return yytext = yytext.substring(start, yyleng - end + start);
}
%}
@@ -59,7 +59,7 @@ ID [^\s!"#%-,\.\/;->@\[-\^`\{-~]+/{LOOKAHEAD}
if (this.conditionStack[this.conditionStack.length-1] === 'raw') {
return 'CONTENT';
} else {
yytext = yytext.substr(5, yyleng-9);
strip(5, 9);
return 'END_RAW_BLOCK';
}
}
tasks/metrics.js
+1 -1
View File
@@ -1,5 +1,5 @@
var _ = require('underscore'),
async = require('async'),
async = require('neo-async'),
metrics = require('../bench');
module.exports = function(grunt) {
tasks/publish.js
+2 -2
View File
@@ -1,5 +1,5 @@
var _ = require('underscore'),
async = require('async'),
async = require('neo-async'),
AWS = require('aws-sdk'),
git = require('./util/git'),
semver = require('semver');
@@ -66,7 +66,7 @@ module.exports = function(grunt) {
var s3 = new AWS.S3(),
bucket = process.env.S3_BUCKET_NAME;
async.forEach(_.keys(files), function(file, callback) {
async.each(_.keys(files), function(file, callback) {
var params = {Bucket: bucket, Key: file, Body: grunt.file.read(files[file])};
s3.putObject(params, function(err) {
if (err) {
tasks/version.js
+1 -1
View File
@@ -1,4 +1,4 @@
var async = require('async'),
var async = require('neo-async'),
git = require('./util/git'),
semver = require('semver');
lib/handlebars.d.ts → types/index.d.ts
Vendored
+2 -1
View File
@@ -8,8 +8,9 @@
* - Sergei Dorogin <https://github.com/evil-shrike>
* - webbiesdk <https://github.com/webbiesdk>
* For full history prior to their migration to handlebars.js, please see:
* https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/handlebars
* https://github.com/DefinitelyTyped/DefinitelyTyped/commits/1ce60bdc07f10e0b076778c6c953271c072bc894/types/handlebars/index.d.ts
*/
// TypeScript Version: 2.3
declare namespace Handlebars {
export interface TemplateDelegate<T = any> {
types/test.ts
+91
View File
@@ -0,0 +1,91 @@
/* These test cases were imported from https://github.com/DefinitelyTyped/DefinitelyTyped
* and includes previous contributions from the DefinitelyTyped community.
* For full history prior to their migration to handlebars.js, please see:
* https://github.com/DefinitelyTyped/DefinitelyTyped/commits/1ce60bdc07f10e0b076778c6c953271c072bc894/types/handlebars/handlebars-tests.ts
*/
import * as Handlebars from 'handlebars';
const context = {
author: { firstName: 'Alan', lastName: 'Johnson' },
body: 'I Love Handlebars',
comments: [{
author: { firstName: 'Yehuda', lastName: 'Katz' },
body: 'Me too!'
}]
};
Handlebars.registerHelper('fullName', (person: typeof context.author) => {
return person.firstName + ' ' + person.lastName;
});
Handlebars.registerHelper('agree_button', function(this: any) {
return new Handlebars.SafeString(
'<button>I agree. I ' + this.emotion + ' ' + this.name + '</button>'
);
});
const source1 = '<p>Hello, my name is {{name}}. I am from {{hometown}}. I have ' +
'{{kids.length}} kids:</p>' +
'<ul>{{#kids}}<li>{{name}} is {{age}}</li>{{/kids}}</ul>';
const template1 = Handlebars.compile(source1);
template1({ name: "Alan", hometown: "Somewhere, TX", kids: [{name: "Jimmy", age: 12}, {name: "Sally", age: 4}]});
Handlebars.registerHelper('link_to', (context: typeof post) => {
return '<a href="' + context.url + '">' + context.body + '</a>';
});
const post = { url: "/hello-world", body: "Hello World!" };
const context2 = { posts: [post] };
const source2 = '<ul>{{#posts}}<li>{{{link_to this}}}</li>{{/posts}}</ul>';
const template2: HandlebarsTemplateDelegate<{ posts: { url: string, body: string }[] }> = Handlebars.compile(source2);
template2(context2);
Handlebars.registerHelper('link_to', (title: string, context: typeof post) => {
return '<a href="/posts' + context.url + '">' + title + '!</a>';
});
const context3 = { posts: [{url: '/hello-world', body: 'Hello World!'}] };
const source3 = '<ul>{{#posts}}<li>{{{link_to "Post" this}}}</li>{{/posts}}</ul>';
const template3 = Handlebars.compile<typeof context3>(source3);
template3(context3);
const source4 = '<ul>{{#people}}<li>{{#link}}{{name}}{{/link}}</li>{{/people}}</ul>';
Handlebars.registerHelper('link', function(this: any, context: any) {
return '<a href="/people/' + this.id + '">' + context.fn(this) + '</a>';
});
const template4 = Handlebars.compile<{ people: { name: string, id: number }[] }>(source4);
const data2 = { 'people': [
{ 'name': 'Alan', 'id': 1 },
{ 'name': 'Yehuda', 'id': 2 }
]};
template4(data2);
const source5 = '<ul>{{#people}}<li>{{> link}}</li>{{/people}}</ul>';
Handlebars.registerPartial('link', '<a href="/people/{{id}}">{{name}}</a>');
const template5 = Handlebars.compile(source5);
const data3 = { 'people': [
{ 'name': 'Alan', 'id': 1 },
{ 'name': 'Yehuda', 'id': 2 }
]};
template5(data3);
const source6 = '{{#list nav}}<a href="{{url}}">{{title}}</a>{{/list}}';
const template6 = Handlebars.compile(source6);
Handlebars.registerHelper('list', (context, options: Handlebars.HelperOptions) => {
let ret = "<ul>";
for(let i=0, j=context.length; i<j; i++) {
ret = ret + "<li>" + options.fn(context[i]) + "</li>";
}
return ret + "</ul>";
});
template6([{url:"", title:""}])
const escapedExpression = Handlebars.Utils.escapeExpression('<script>alert(\'xss\');</script>');
Handlebars.helpers !== undefined;
const parsedTmpl = Handlebars.parse('<p>Hello, my name is {{name}}.</p>', {
srcName: "/foo/bar/baz.hbs",
ignoreStandalone: true
});
const parsedTmplWithoutOptions = Handlebars.parse('<p>Hello, my name is {{name}}.</p>');
types/tsconfig.json
+16
View File
@@ -0,0 +1,16 @@
{
"compilerOptions": {
"module": "commonjs",
"lib": ["es6"],
"noImplicitAny": true,
"noImplicitThis": true,
"strictNullChecks": true,
"strictFunctionTypes": true,
"noEmit": true,
"baseUrl": ".",
"paths": {
"handlebars": ["."]
}
}
}
types/tslint.json
+79
View File
@@ -0,0 +1,79 @@
{
"extends": "dtslint/dtslint.json",
"rules": {
"adjacent-overload-signatures": false,
"array-type": false,
"arrow-return-shorthand": false,
"ban-types": false,
"callable-types": false,
"comment-format": false,
"dt-header": false,
"eofline": false,
"export-just-namespace": false,
"import-spacing": false,
"interface-name": false,
"interface-over-type-literal": false,
"jsdoc-format": false,
"max-line-length": false,
"member-access": false,
"new-parens": false,
"no-any-union": false,
"no-boolean-literal-compare": false,
"no-conditional-assignment": false,
"no-consecutive-blank-lines": false,
"no-construct": false,
"no-declare-current-package": false,
"no-duplicate-imports": false,
"no-duplicate-variable": false,
"no-empty-interface": false,
"no-for-in-array": false,
"no-inferrable-types": false,
"no-internal-module": false,
"no-irregular-whitespace": false,
"no-mergeable-namespace": false,
"no-misused-new": false,
"no-namespace": false,
"no-object-literal-type-assertion": false,
"no-padding": false,
"no-redundant-jsdoc": false,
"no-redundant-jsdoc-2": false,
"no-redundant-undefined": false,
"no-reference-import": false,
"no-relative-import-in-test": false,
"no-self-import": false,
"no-single-declare-module": false,
"no-string-throw": false,
"no-unnecessary-callback-wrapper": false,
"no-unnecessary-class": false,
"no-unnecessary-generics": false,
"no-unnecessary-qualifier": false,
"no-unnecessary-type-assertion": false,
"no-useless-files": false,
"no-var-keyword": false,
"no-var-requires": false,
"no-void-expression": false,
"no-trailing-whitespace": false,
"object-literal-key-quotes": false,
"object-literal-shorthand": false,
"one-line": false,
"one-variable-per-declaration": false,
"only-arrow-functions": false,
"prefer-conditional-expression": false,
"prefer-const": false,
"prefer-declare-function": false,
"prefer-for-of": false,
"prefer-method-signature": false,
"prefer-template": false,
"radix": false,
"semicolon": false,
"space-before-function-paren": false,
"space-within-parens": false,
"strict-export-declare-modifiers": false,
"trim-file": false,
"triple-equals": false,
"typedef-whitespace": false,
"unified-signatures": false,
"void-return": false,
"whitespace": false
}
}