v4.1.2-0

added browser to package.json, resolves #1102

.travis.yml

@@ -3,6 +3,7 @@ before_install:
 - npm install -g grunt-cli
 script:
 - grunt --stack travis
+- multi-nodejs-test/run-tests.sh 0.10 0.12 4 5 6 7 8 9 10 11
 email:
   on_failure: change
   on_success: never

Gruntfile.js

@@ -12,7 +12,8 @@ module.exports = function(grunt) {
         'bench/**/*.js',
         'tasks/**/*.js',
         'lib/**/!(*.min|parser).js',
-        'spec/**/!(*.amd|json2|require).js'
+        'spec/**/!(*.amd|json2|require).js',
+        'multi-nodejs-test/*.js'
       ]
     },
 
@@ -166,8 +167,8 @@ module.exports = function(grunt) {
           browsers: [
             {browserName: 'chrome'},
             {browserName: 'firefox', platform: 'Linux'},
-            {browserName: 'safari', version: 9, platform: 'OS X 10.11'},
-            {browserName: 'safari', version: 8, platform: 'OS X 10.10'},
+            // {browserName: 'safari', version: 9, platform: 'OS X 10.11'},
+            // {browserName: 'safari', version: 8, platform: 'OS X 10.10'},
             {browserName: 'internet explorer', version: 11, platform: 'Windows 8.1'},
             {browserName: 'internet explorer', version: 10, platform: 'Windows 8'}
           ]
@@ -186,6 +187,14 @@ module.exports = function(grunt) {
       }
     },
 
+    bgShell: {
+      checkTypes: {
+        cmd: 'npm run checkTypes',
+        bg: false,
+        fail: true
+      }
+    },
+
     watch: {
       scripts: {
         options: {
@@ -201,6 +210,7 @@ module.exports = function(grunt) {
   // Build a new version of the library
   this.registerTask('build', 'Builds a distributable version of the current project', [
                     'eslint',
+                    'bgShell:checkTypes',
                     'parser',
                     'node',
                     'globals']);
@@ -221,6 +231,7 @@ module.exports = function(grunt) {
   grunt.loadNpmTasks('grunt-contrib-uglify');
   grunt.loadNpmTasks('grunt-contrib-watch');
   grunt.loadNpmTasks('grunt-babel');
+  grunt.loadNpmTasks('grunt-bg-shell');
   grunt.loadNpmTasks('grunt-eslint');
   grunt.loadNpmTasks('grunt-saucelabs');
   grunt.loadNpmTasks('grunt-webpack');

appveyor.yml

@@ -1,8 +1,7 @@
 # Test against these versions of Node.js
 environment:
   matrix:
-    - nodejs_version: "4"
-    - nodejs_version: "5"
+    - nodejs_version: "10"
 
 platform:
   - x64

bench/dist-size.js

@@ -1,4 +1,4 @@
-var async = require('async'),
+var async = require('neo-async'),
     fs = require('fs'),
     zlib = require('zlib');
 

components/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "4.0.12",
+  "version": "4.1.2-0",
   "main": "handlebars.js",
   "license": "MIT",
   "dependencies": {}

components/handlebars.js.nuspec

@@ -2,7 +2,7 @@
 <package>
 	<metadata>
 		<id>handlebars.js</id>
-		<version>4.0.12</version>
+		<version>4.1.2-0</version>
 		<authors>handlebars.js Authors</authors>
 		<licenseUrl>https://github.com/wycats/handlebars.js/blob/master/LICENSE</licenseUrl>
 		<projectUrl>https://github.com/wycats/handlebars.js/</projectUrl>

components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "4.0.12",
+  "version": "4.1.2-0",
   "license": "MIT",
   "jspm": {
     "main": "handlebars",

lib/handlebars/base.js

@@ -4,7 +4,7 @@ import {registerDefaultHelpers} from './helpers';
 import {registerDefaultDecorators} from './decorators';
 import logger from './logger';
 
-export const VERSION = '4.0.12';
+export const VERSION = '4.1.2-0';
 export const COMPILER_REVISION = 7;
 
 export const REVISION_CHANGES = {

lib/handlebars/compiler/helpers.js

@@ -24,7 +24,7 @@ export function SourceLocation(source, locInfo) {
 
 export function id(token) {
   if (/^\[.*\]$/.test(token)) {
-    return token.substr(1, token.length - 2);
+    return token.substring(1, token.length - 1);
   } else {
     return token;
   }

lib/handlebars/helpers/lookup.js

@@ -1,5 +1,11 @@
 export default function(instance) {
   instance.registerHelper('lookup', function(obj, field) {
-    return obj && obj[field];
+    if (!obj) {
+      return obj;
+    }
+    if (field === 'constructor' && !obj.propertyIsEnumerable(field)) {
+      return undefined;
+    }
+    return obj[field];
   });
 }

lib/precompiler.js

@@ -1,5 +1,5 @@
 /* eslint-disable no-console */
-import Async from 'async';
+import Async from 'neo-async';
 import fs from 'fs';
 import * as Handlebars from './handlebars';
 import {basename} from 'path';

multi-nodejs-test/.eslintrc.js

@@ -0,0 +1,114 @@
+module.exports = {
+  "extends": "eslint:recommended",
+  "globals": {
+    "self": false
+  },
+  "env": {
+    "node": true
+  },
+  "rules": {
+    // overrides eslint:recommended defaults
+    "no-sparse-arrays": "off",
+    "no-func-assign": "off",
+    "no-console": "off",
+    "no-debugger": "warn",
+    "no-unreachable": "warn",
+
+    // Possible Errors //
+    //-----------------//
+    "no-unsafe-negation": "error",
+
+
+    // Best Practices //
+    //----------------//
+    "curly": "error",
+    "default-case": "warn",
+    "dot-notation": ["error", { "allowKeywords": false }],
+    "guard-for-in": "warn",
+    "no-alert": "error",
+    "no-caller": "error",
+    "no-div-regex": "warn",
+    "no-eval": "error",
+    "no-extend-native": "error",
+    "no-extra-bind": "error",
+    "no-floating-decimal": "error",
+    "no-implied-eval": "error",
+    "no-iterator": "error",
+    "no-labels": "error",
+    "no-lone-blocks": "error",
+    "no-loop-func": "error",
+    "no-multi-spaces": "error",
+    "no-multi-str": "warn",
+    "no-global-assign": "error",
+    "no-new": "error",
+    "no-new-func": "error",
+    "no-new-wrappers": "error",
+    "no-octal-escape": "error",
+    "no-process-env": "error",
+    "no-proto": "error",
+    "no-return-assign": "error",
+    "no-script-url": "error",
+    "no-self-compare": "error",
+    "no-sequences": "error",
+    "no-throw-literal": "error",
+    "no-unused-expressions": "error",
+    "no-warning-comments": "warn",
+    "no-with": "error",
+    "radix": "error",
+    "wrap-iife": "error",
+
+
+    // Variables //
+    //-----------//
+    "no-catch-shadow": "error",
+    "no-label-var": "error",
+    "no-shadow-restricted-names": "error",
+    "no-undef-init": "error",
+    "no-use-before-define": ["error", "nofunc"],
+
+
+    // Stylistic Issues //
+    //------------------//
+    "comma-dangle": ["error", "never"],
+    "quote-props": ["error", "as-needed", { "keywords": true, "unnecessary": false }],
+    "brace-style": ["error", "1tbs", { "allowSingleLine": true }],
+    "camelcase": "error",
+    "comma-spacing": ["error", { "before": false, "after": true }],
+    "comma-style": ["error", "last"],
+    "consistent-this": ["warn", "self"],
+    "eol-last": "error",
+    "func-style": ["error", "declaration"],
+    "key-spacing": ["error", {
+      "beforeColon": false,
+      "afterColon": true
+    }],
+    "new-cap": "error",
+    "new-parens": "error",
+    "no-array-constructor": "error",
+    "no-lonely-if": "error",
+    "no-mixed-spaces-and-tabs": "error",
+    "no-nested-ternary": "warn",
+    "no-new-object": "error",
+    "no-spaced-func": "error",
+    "no-trailing-spaces": "error",
+    "no-extra-parens": ["error", "functions"],
+    "quotes": ["error", "single", "avoid-escape"],
+    "semi": "error",
+    "semi-spacing": ["error", { "before": false, "after": true }],
+    "keyword-spacing": "error",
+    "space-before-blocks": ["error", "always"],
+    "space-before-function-paren": ["error", { "anonymous": "never", "named": "never" }],
+    "space-in-parens": ["error", "never"],
+    "space-infix-ops": "error",
+    "space-unary-ops": "error",
+    "spaced-comment": ["error", "always", { "markers": [","] }],
+    "wrap-regex": "warn",
+
+    // ECMAScript 6 //
+    //--------------//
+    "no-var": "off"
+  },
+  "parserOptions": {
+    "sourceType": "module"
+  }
+}

multi-nodejs-test/expected.txt

@@ -0,0 +1 @@
+Author: Yehuda

multi-nodejs-test/run-handlebars.js

@@ -0,0 +1,13 @@
+// This test should run with node 0.10 as long as Handlebars has been compiled before
+var Handlebars = require('../');
+var fs = require('fs');
+
+console.log('Testing build Handlebars with Node version ' + process.version);
+var template = fs.readFileSync(require.resolve('./template.txt.hbs'), 'utf-8');
+var compiledOutput = Handlebars.compile(template)({author: 'Yehuda'}).trim();
+var expectedOutput = fs.readFileSync(require.resolve('./expected.txt'), 'utf-8').trim();
+
+if (compiledOutput !== expectedOutput) {
+    throw new Error('Compiled output (' + compiledOutput + ') did not match expected output (' + expectedOutput + ')');
+}
+console.log('Success');

multi-nodejs-test/run-tests.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+cd "$( dirname "$( readlink -f "$0" )" )"
+[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+
+# This script tests with precompiler and the built distribution with multiple NodeJS version.
+# The rest of the travis-build will only work with newer NodeJS versions, because the build
+# tools don't support older versions.
+# However, the built distribution should work with older NodeJS versions as well.
+# This test is simple by design. It merely ensures, that calling Handlebars does not fail with old versions.
+# It does (almost) not test for correctness, because that is already done in the mocha-tests.
+# And it does not use any NodeJS based testing framwork to make this part independent of the Node version.
+
+# A list of NodeJS versions is expected as cli-args
+echo "Handlebars should be able to run in various versions of NodeJS"
+for i in "$@" ; do
+    nvm install "$i"
+    nvm exec "$i" node ./run-handlebars.js >/dev/null || exit 1
+    nvm exec "$i" node ../bin/handlebars template.txt.hbs >/dev/null || exit 1
+    echo Success
+done

multi-nodejs-test/template.txt.hbs

@@ -0,0 +1 @@
+Author: {{author}} 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "4.0.13-0",
+  "version": "4.1.2-0",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
   "homepage": "http://www.handlebarsjs.com/",
   "keywords": [
@@ -21,7 +21,7 @@
     "node": ">=0.4.7"
   },
   "dependencies": {
-    "async": "^2.5.0",
+    "neo-async": "^2.6.0",
     "optimist": "^0.6.1",
     "source-map": "^0.6.1"
   },
@@ -33,10 +33,12 @@
     "babel-loader": "^5.0.0",
     "babel-runtime": "^5.1.10",
     "benchmark": "~1.0",
+    "dtslint": "^0.5.5",
     "dustjs-linkedin": "^2.0.2",
     "eco": "~1.1.0-rc-3",
     "grunt": "^1.0.3",
     "grunt-babel": "^5.0.0",
+    "grunt-bg-shell": "^2.3.3",
     "grunt-cli": "^1",
     "grunt-contrib-clean": "^1",
     "grunt-contrib-concat": "^1",
@@ -46,7 +48,7 @@
     "grunt-contrib-uglify": "^1",
     "grunt-contrib-watch": "^1.1.0",
     "grunt-eslint": "^20.1.0",
-    "grunt-saucelabs": "8.x",
+    "grunt-saucelabs": "9.x",
     "grunt-webpack": "^1.0.8",
     "istanbul": "^0.3.0",
     "jison": "~0.3.0",
@@ -54,16 +56,22 @@
     "mock-stdin": "^0.3.0",
     "mustache": "^2.1.3",
     "semver": "^5.0.1",
+    "typescript": "^3.4.3",
     "underscore": "^1.5.1",
     "webpack": "^1.12.6",
     "webpack-dev-server": "^1.12.1"
   },
   "main": "lib/index.js",
-  "types": "lib/handlebars.d.ts",
+  "types": "types/index.d.ts",
+  "browser": {
+    ".": "./dist/handlebars.min.js",
+    "./runtime": "./dist/handlebars.runtime.min.js"
+  },
   "bin": {
     "handlebars": "bin/handlebars"
   },
   "scripts": {
+    "checkTypes": "dtslint types",
     "test": "grunt"
   },
   "jspm": {
@@ -83,6 +91,7 @@
     "lib",
     "print-script",
     "release-notes.md",
-    "runtime.js"
+    "runtime.js",
+    "types/*.d.ts"
   ]
 }

release-notes.md

@@ -2,65 +2,87 @@
 
 ## Development
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...master)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.1.2-0...master)
 
-## v4.0.12 - September 4th, 2018
-New features:
-
-- none
-
-Various dependency updates
-
-- [#1464](https://github.com/wycats/handlebars.js/pull/1464) - Bump versions of grunt-plugins to 1.x
-- [#1398](https://github.com/wycats/handlebars.js/pull/1398) - Chore: updated various dev dependencies
-- upgrade uglify-js - d3d3942
-- Update grunt-eslint to 20.1.0 - 7729aa9
-- Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1 (73d5637)
-
-Bugfixes:
-
-- [components/handlebars.js#24](https://github.com/components/handlebars.js#24) Add package.json to components shim
-- Updated `source-map`-package should work better with `rollup`[#1463](https://github.com/wycats/handlebars.js/issues/1463)
-
-Removed obsolete code:
-
-- unnecessary check - 0ddff8b
-- Use `files` field - 69c6ca5
-- Update jsfiddle to 4.0.11 - 8947dd0
+## v4.1.2-0 - August 25th, 2019
+[#1540](https://github.com/wycats/handlebars.js/pull/1540) - added browser to package.json, resolves #1102 ([@ouijan](https://api.github.com/users/ouijan))
 
 Compatibility notes:
-- No compatibility issues are to be expected
+- We are not sure if imports via webpack are still working, which is why this release is a pre-release
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...v4.0.12)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.1.2...v4.1.2-0)
 
-## v4.0.12 - September 4th, 2018
-New features:
+## v4.1.2 - April 13th, 2019
+Chore/Test:
+- [#1515](https://github.com/wycats/handlebars.js/pull/1515) - Port over linting and test for typings ([@zimmi88](https://api.github.com/users/zimmi88))
+- chore: add missing typescript dependency, add package-lock.json - 594f1e3
+- test: remove safari from saucelabs - 871accc
 
-- none
-
-Various dependency updates
-
-- [#1464](https://github.com/wycats/handlebars.js/pull/1464) - Bump versions of grunt-plugins to 1.x
-- [#1398](https://github.com/wycats/handlebars.js/pull/1398) - Chore: updated various dev dependencies
-- upgrade uglify-js - d3d3942
-- Update grunt-eslint to 20.1.0 - 7729aa9
-- Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1 (73d5637)
-
-Bugfixes:
-
-- [components/handlebars.js#24](https://github.com/components/handlebars.js#24) Add package.json to components shim
-- Updated `source-map`-package should work better with `rollup`[#1463](https://github.com/wycats/handlebars.js/issues/1463)
-
-Removed obsolete code:
-
-- unnecessary check - 0ddff8b
-- Use `files` field - 69c6ca5
-- Update jsfiddle to 4.0.11 - 8947dd0
+Bugfixes: 
+- fix: prevent RCE through the "lookup"-helper - cd38583
 
 Compatibility notes:
-- No compatibility issues are to be expected
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...v4.0.12)
+Access to the constructor of a class thought `{{lookup obj "constructor" }}` is now prohibited. This closes 
+a leak that only half closed in versions 4.0.13 and 4.1.0, but it is a slight incompatibility.
+
+This kind of access is not the intended use of Handlebars and leads to the vulnerability described
+in #1495. We will **not** increase the major version, because such use is not intended or documented, 
+and because of the potential impact of the issue (we fear that most people won't use a new major version
+and the issue may not be resolved on many systems). 
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.1.1...v4.1.2)
+
+## v4.1.1 - March 16th, 2019
+Bugfixes:
+- fix: add "runtime.d.ts" to allow "require('handlebars/runtime')" in TypeScript - 5cedd62
+
+Refactorings:
+- replace "async" with "neo-async" - 048f2ce
+- use "substring"-function instead of "substr" - 445ae12
+
+Compatibility notes:
+- This is a bugfix release. There are no breaking change and no new features.
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.1.0...v4.1.1)
+
+## v4.1.0 - February 7th, 2019
+New Features
+
+- import TypeScript typings - 27ac1ee
+
+Security fixes:
+
+- disallow access to the constructor in templates to prevent RCE - 42841c4, #1495
+
+Housekeeping
+
+- chore: fix components/handlebars package.json and auto-update on release - bacd473
+- chore: Use node 10 to build handlebars - 78dd89c
+- chore/doc: Add more release docs - 6b87c21
+
+Compatibility notes:
+
+Access to class constructors (i.e. `({}).constructor`) is now prohibited to prevent
+Remote Code Execution. This means that following construct will no work anymore:
+
+```
+class SomeClass {
+}
+
+SomeClass.staticProperty = 'static'
+
+var template = Handlebars.compile('{{constructor.staticProperty}}');
+document.getElementById('output').innerHTML = template(new SomeClass());
+// expected: 'static', but now this is empty.
+```
+
+This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #1495. We will **not** increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).
+
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...v4.1.0)
 
 ## v4.0.12 - September 4th, 2018
 New features:

runtime.d.ts

@@ -0,0 +1,5 @@
+import Handlebars = require('handlebars')
+
+declare module "handlebars/runtime" {
+   
+}

spec/security.js

@@ -1,22 +1,35 @@
 describe('security issues', function() {
+    describe('GH-1495: Prevent Remote Code Execution via constructor', function() {
+        it('should not allow constructors to be accessed', function() {
+            shouldCompileTo('{{constructor.name}}', {}, '');
+            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {}, '');
+        });
 
-    it('should not allow constructors to be accessed', function() {
-        shouldCompileTo('{{#with this as |obj|}}{{obj.constructor.name}}{{/with}}', {}, '');
-    });
+        it('should allow the "constructor" property to be accessed if it is enumerable', function() {
+            shouldCompileTo('{{constructor.name}}', {'constructor': {
+                'name': 'here we go'
+            }}, 'here we go');
+            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {'constructor': {
+                'name': 'here we go'
+            }}, 'here we go');
+        });
 
-    it('should allow the "constructor" property to be accessed if it is enumerable', function() {
-        shouldCompileTo('{{constructor.name}}', {'constructor': {
-            'name': 'here we go'
-        }}, 'here we go');
-    });
-
-    it('should allow prototype properties that are not constructors', function() {
-        class TestClass {
-            get abc() {
-                return 'xyz';
+        it('should allow prototype properties that are not constructors', function() {
+            function TestClass() {
             }
-        }
-        shouldCompileTo('{{#with this as |obj|}}{{obj.abc}}{{/with}}',
-            new TestClass(), 'xyz');
+
+            Object.defineProperty(TestClass.prototype, 'abc', {
+                get: function() {
+                    return 'xyz';
+                }
+
+            });
+
+            shouldCompileTo('{{#with this as |obj|}}{{obj.abc}}{{/with}}',
+                new TestClass(), 'xyz');
+            shouldCompileTo('{{#with this as |obj|}}{{lookup obj "abc"}}{{/with}}',
+                new TestClass(), 'xyz');
+
+        });
     });
 });

src/handlebars.l

@@ -4,7 +4,7 @@
 %{
 
 function strip(start, end) {
-  return yytext = yytext.substr(start, yyleng-end);
+  return yytext = yytext.substring(start, yyleng - end + start);
 }
 
 %}
@@ -59,7 +59,7 @@ ID    [^\s!"#%-,\.\/;->@\[-\^`\{-~]+/{LOOKAHEAD}
                                   if (this.conditionStack[this.conditionStack.length-1] === 'raw') {
                                     return 'CONTENT';
                                   } else {
-                                    yytext = yytext.substr(5, yyleng-9);
+                                    strip(5, 9);
                                     return 'END_RAW_BLOCK';
                                   }
                                  }

tasks/metrics.js

@@ -1,5 +1,5 @@
 var _ = require('underscore'),
-    async = require('async'),
+    async = require('neo-async'),
     metrics = require('../bench');
 
 module.exports = function(grunt) {

tasks/publish.js

@@ -1,5 +1,5 @@
 var _ = require('underscore'),
-    async = require('async'),
+    async = require('neo-async'),
     AWS = require('aws-sdk'),
     git = require('./util/git'),
     semver = require('semver');
@@ -66,7 +66,7 @@ module.exports = function(grunt) {
     var s3 = new AWS.S3(),
         bucket = process.env.S3_BUCKET_NAME;
 
-    async.forEach(_.keys(files), function(file, callback) {
+    async.each(_.keys(files), function(file, callback) {
         var params = {Bucket: bucket, Key: file, Body: grunt.file.read(files[file])};
         s3.putObject(params, function(err) {
           if (err) {

tasks/version.js

@@ -1,4 +1,4 @@
-var async = require('async'),
+var async = require('neo-async'),
     git = require('./util/git'),
     semver = require('semver');
 

types/index.d.ts

@@ -8,8 +8,9 @@
  *   - Sergei Dorogin <https://github.com/evil-shrike>
  *   - webbiesdk <https://github.com/webbiesdk>
  * For full history prior to their migration to handlebars.js, please see:
- * https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/handlebars
+ * https://github.com/DefinitelyTyped/DefinitelyTyped/commits/1ce60bdc07f10e0b076778c6c953271c072bc894/types/handlebars/index.d.ts
  */
+// TypeScript Version: 2.3
 
 declare namespace Handlebars {
   export interface TemplateDelegate<T = any> {

types/test.ts

@@ -0,0 +1,91 @@
+/* These test cases were imported from https://github.com/DefinitelyTyped/DefinitelyTyped
+ * and includes previous contributions from the DefinitelyTyped community.
+ * For full history prior to their migration to handlebars.js, please see:
+ * https://github.com/DefinitelyTyped/DefinitelyTyped/commits/1ce60bdc07f10e0b076778c6c953271c072bc894/types/handlebars/handlebars-tests.ts
+ */
+
+import * as Handlebars from 'handlebars';
+
+const context = {
+  author: { firstName: 'Alan', lastName: 'Johnson' },
+  body: 'I Love Handlebars',
+  comments: [{
+    author: { firstName: 'Yehuda', lastName: 'Katz' },
+    body: 'Me too!'
+  }]
+};
+Handlebars.registerHelper('fullName', (person: typeof context.author) => {
+  return person.firstName + ' ' + person.lastName;
+});
+
+Handlebars.registerHelper('agree_button', function(this: any) {
+  return new Handlebars.SafeString(
+    '<button>I agree. I ' + this.emotion + ' ' + this.name + '</button>'
+  );
+});
+
+const source1 = '<p>Hello, my name is {{name}}. I am from {{hometown}}. I have ' +
+                '{{kids.length}} kids:</p>' +
+                '<ul>{{#kids}}<li>{{name}} is {{age}}</li>{{/kids}}</ul>';
+const template1 = Handlebars.compile(source1);
+template1({ name: "Alan", hometown: "Somewhere, TX", kids: [{name: "Jimmy", age: 12}, {name: "Sally", age: 4}]});
+
+Handlebars.registerHelper('link_to', (context: typeof post) => {
+  return '<a href="' + context.url + '">' + context.body + '</a>';
+});
+const post = { url: "/hello-world", body: "Hello World!" };
+const context2 = { posts: [post] };
+const source2 = '<ul>{{#posts}}<li>{{{link_to this}}}</li>{{/posts}}</ul>';
+const template2: HandlebarsTemplateDelegate<{ posts: { url: string, body: string }[] }> = Handlebars.compile(source2);
+template2(context2);
+
+Handlebars.registerHelper('link_to', (title: string, context: typeof post) => {
+  return '<a href="/posts' + context.url + '">' + title + '!</a>';
+});
+const context3 = { posts: [{url: '/hello-world', body: 'Hello World!'}] };
+const source3 = '<ul>{{#posts}}<li>{{{link_to "Post" this}}}</li>{{/posts}}</ul>';
+const template3 = Handlebars.compile<typeof context3>(source3);
+template3(context3);
+
+const source4 = '<ul>{{#people}}<li>{{#link}}{{name}}{{/link}}</li>{{/people}}</ul>';
+Handlebars.registerHelper('link', function(this: any, context: any) {
+  return '<a href="/people/' + this.id + '">' + context.fn(this) + '</a>';
+});
+const template4 = Handlebars.compile<{ people: { name: string, id: number }[] }>(source4);
+const data2 = { 'people': [
+    { 'name': 'Alan', 'id': 1 },
+    { 'name': 'Yehuda', 'id': 2 }
+]};
+template4(data2);
+
+const source5 = '<ul>{{#people}}<li>{{> link}}</li>{{/people}}</ul>';
+Handlebars.registerPartial('link', '<a href="/people/{{id}}">{{name}}</a>');
+const template5 = Handlebars.compile(source5);
+const data3 = { 'people': [
+    { 'name': 'Alan', 'id': 1 },
+    { 'name': 'Yehuda', 'id': 2 }
+]};
+template5(data3);
+
+const source6 = '{{#list nav}}<a href="{{url}}">{{title}}</a>{{/list}}';
+const template6 = Handlebars.compile(source6);
+Handlebars.registerHelper('list', (context, options: Handlebars.HelperOptions) => {
+  let ret = "<ul>";
+  for(let i=0, j=context.length; i<j; i++) {
+    ret = ret + "<li>" + options.fn(context[i]) + "</li>";
+  }
+  return ret + "</ul>";
+});
+template6([{url:"", title:""}])
+
+
+const escapedExpression = Handlebars.Utils.escapeExpression('<script>alert(\'xss\');</script>');
+
+Handlebars.helpers !== undefined;
+
+const parsedTmpl = Handlebars.parse('<p>Hello, my name is {{name}}.</p>', {
+  srcName: "/foo/bar/baz.hbs",
+  ignoreStandalone: true
+});
+
+const parsedTmplWithoutOptions = Handlebars.parse('<p>Hello, my name is {{name}}.</p>');

types/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "module": "commonjs",
+    "lib": ["es6"],
+    "noImplicitAny": true,
+    "noImplicitThis": true,
+    "strictNullChecks": true,
+    "strictFunctionTypes": true,
+    "noEmit": true,
+
+    "baseUrl": ".",
+    "paths": {
+      "handlebars": ["."]
+    }
+  }
+}

types/tslint.json

@@ -0,0 +1,79 @@
+{
+  "extends": "dtslint/dtslint.json",
+  "rules": {
+    "adjacent-overload-signatures": false,
+    "array-type": false,
+    "arrow-return-shorthand": false,
+    "ban-types": false,
+    "callable-types": false,
+    "comment-format": false,
+    "dt-header": false,
+    "eofline": false,
+    "export-just-namespace": false,
+    "import-spacing": false,
+    "interface-name": false,
+    "interface-over-type-literal": false,
+    "jsdoc-format": false,
+    "max-line-length": false,
+    "member-access": false,
+    "new-parens": false,
+    "no-any-union": false,
+    "no-boolean-literal-compare": false,
+    "no-conditional-assignment": false,
+    "no-consecutive-blank-lines": false,
+    "no-construct": false,
+    "no-declare-current-package": false,
+    "no-duplicate-imports": false,
+    "no-duplicate-variable": false,
+    "no-empty-interface": false,
+    "no-for-in-array": false,
+    "no-inferrable-types": false,
+    "no-internal-module": false,
+    "no-irregular-whitespace": false,
+    "no-mergeable-namespace": false,
+    "no-misused-new": false,
+    "no-namespace": false,
+    "no-object-literal-type-assertion": false,
+    "no-padding": false,
+    "no-redundant-jsdoc": false,
+    "no-redundant-jsdoc-2": false,
+    "no-redundant-undefined": false,
+    "no-reference-import": false,
+    "no-relative-import-in-test": false,
+    "no-self-import": false,
+    "no-single-declare-module": false,
+    "no-string-throw": false,
+    "no-unnecessary-callback-wrapper": false,
+    "no-unnecessary-class": false,
+    "no-unnecessary-generics": false,
+    "no-unnecessary-qualifier": false,
+    "no-unnecessary-type-assertion": false,
+    "no-useless-files": false,
+    "no-var-keyword": false,
+    "no-var-requires": false,
+    "no-void-expression": false,
+    "no-trailing-whitespace": false,
+    "object-literal-key-quotes": false,
+    "object-literal-shorthand": false,
+    "one-line": false,
+    "one-variable-per-declaration": false,
+    "only-arrow-functions": false,
+    "prefer-conditional-expression": false,
+    "prefer-const": false,
+    "prefer-declare-function": false,
+    "prefer-for-of": false,
+    "prefer-method-signature": false,
+    "prefer-template": false,
+    "radix": false,
+    "semicolon": false,
+    "space-before-function-paren": false,
+    "space-within-parens": false,
+    "strict-export-declare-modifiers": false,
+    "trim-file": false,
+    "triple-equals": false,
+    "typedef-whitespace": false,
+    "unified-signatures": false,
+    "void-return": false,
+    "whitespace": false
+  }
+}