v4.2.2

components/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "4.3.4",
+  "version": "4.2.2",
   "main": "handlebars.js",
   "license": "MIT",
   "dependencies": {}

components/handlebars.js.nuspec

@@ -2,7 +2,7 @@
 <package>
 	<metadata>
 		<id>handlebars.js</id>
-		<version>4.3.4</version>
+		<version>4.2.2</version>
 		<authors>handlebars.js Authors</authors>
 		<licenseUrl>https://github.com/wycats/handlebars.js/blob/master/LICENSE</licenseUrl>
 		<projectUrl>https://github.com/wycats/handlebars.js/</projectUrl>

components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "4.3.4",
+  "version": "4.2.2",
   "license": "MIT",
   "jspm": {
     "main": "handlebars",

lib/handlebars/base.js

@@ -4,9 +4,8 @@ import {registerDefaultHelpers} from './helpers';
 import {registerDefaultDecorators} from './decorators';
 import logger from './logger';
 
-export const VERSION = '4.3.4';
-export const COMPILER_REVISION = 8;
-export const LAST_COMPATIBLE_COMPILER_REVISION = 7;
+export const VERSION = '4.2.2';
+export const COMPILER_REVISION = 7;
 
 export const REVISION_CHANGES = {
   1: '<= 1.0.rc.2', // 1.0.rc.2 is actually rev2 but doesn't report it
@@ -15,8 +14,7 @@ export const REVISION_CHANGES = {
   4: '== 1.x.x',
   5: '== 2.0.0-alpha.x',
   6: '>= 2.0.0-beta.1',
-  7: '>= 4.0.0 <4.3.0',
-  8: '>= 4.3.0'
+  7: '>= 4.0.0'
 };
 
 const objectType = '[object Object]';

lib/handlebars/compiler/javascript-compiler.js

@@ -13,19 +13,13 @@ JavaScriptCompiler.prototype = {
   // PUBLIC API: You can override these methods in a subclass to provide
   // alternative compiled forms for name lookup and buffering semantics
   nameLookup: function(parent, name/* , type*/) {
-    const isEnumerable = [ this.aliasable('container.propertyIsEnumerable'), '.call(', parent, ',"constructor")'];
-
     if (name === 'constructor') {
-      return ['(', isEnumerable, '?', _actualLookup(), ' : undefined)'];
+      return ['(', parent, '.propertyIsEnumerable(\'constructor\') ? ', parent, '.constructor : undefined', ')'];
     }
-    return _actualLookup();
-
-    function _actualLookup() {
-      if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
-        return [parent, '.', name];
-      } else {
-        return [parent, '[', JSON.stringify(name), ']'];
-      }
+    if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
+      return [parent, '.', name];
+    } else {
+      return [parent, '[', JSON.stringify(name), ']'];
     }
   },
   depthedLookup: function(name) {
@@ -220,6 +214,7 @@ JavaScriptCompiler.prototype = {
     let aliasCount = 0;
     for (let alias in this.aliases) { // eslint-disable-line guard-for-in
       let node = this.aliases[alias];
+
       if (this.aliases.hasOwnProperty(alias) && node.children && node.referenceCount > 1) {
         varDeclarations += ', alias' + (++aliasCount) + '=' + alias;
         node.children[0] = 'alias' + aliasCount;
@@ -316,7 +311,7 @@ JavaScriptCompiler.prototype = {
   // replace it on the stack with the result of properly
   // invoking blockHelperMissing.
   blockValue: function(name) {
-    let blockHelperMissing = this.aliasable('container.hooks.blockHelperMissing'),
+    let blockHelperMissing = this.aliasable('helpers.blockHelperMissing'),
         params = [this.contextName(0)];
     this.setupHelperArgs(name, 0, params);
 
@@ -334,7 +329,7 @@ JavaScriptCompiler.prototype = {
   // On stack, after, if lastHelper: value
   ambiguousBlockValue: function() {
     // We're being a bit cheeky and reusing the options value from the prior exec
-    let blockHelperMissing = this.aliasable('container.hooks.blockHelperMissing'),
+    let blockHelperMissing = this.aliasable('helpers.blockHelperMissing'),
         params = [this.contextName(0)];
     this.setupHelperArgs('', 0, params, true);
 
@@ -344,9 +339,9 @@ JavaScriptCompiler.prototype = {
     params.splice(1, 0, current);
 
     this.pushSource([
-      'if (!', this.lastHelper, ') { ',
-      current, ' = ', this.source.functionCall(blockHelperMissing, 'call', params),
-      '}']);
+        'if (!', this.lastHelper, ') { ',
+          current, ' = ', this.source.functionCall(blockHelperMissing, 'call', params),
+        '}']);
   },
 
   // [appendContent]
@@ -627,32 +622,18 @@ JavaScriptCompiler.prototype = {
   // If the helper is not found, `helperMissing` is called.
   invokeHelper: function(paramSize, name, isSimple) {
     let nonHelper = this.popStack(),
-        helper = this.setupHelper(paramSize, name);
+        helper = this.setupHelper(paramSize, name),
+        simple = isSimple ? [helper.name, ' || '] : '';
 
-    let possibleFunctionCalls = [];
-
-    if (isSimple) { // direct call to helper
-      possibleFunctionCalls.push(helper.name);
-    }
-    // call a function from the input object
-    possibleFunctionCalls.push(nonHelper);
+    let lookup = ['('].concat(simple, nonHelper);
     if (!this.options.strict) {
-      possibleFunctionCalls.push(this.aliasable('container.hooks.helperMissing'));
+      lookup.push(' || ', this.aliasable('helpers.helperMissing'));
     }
+    lookup.push(')');
 
-    let functionLookupCode = ['(', this.itemsSeparatedBy(possibleFunctionCalls, '||'), ')'];
-    let functionCall = this.source.functionCall(functionLookupCode, 'call', helper.callParams);
-    this.push(functionCall);
+    this.push(this.source.functionCall(lookup, 'call', helper.callParams));
   },
 
-  itemsSeparatedBy: function(items, separator) {
-    let result = [];
-    result.push(items[0]);
-    for (let i = 1; i < items.length; i++) {
-      result.push(separator, items[i]);
-    }
-    return result;
-  },
   // [invokeKnownHelper]
   //
   // On stack, before: hash, inverse, program, params..., ...
@@ -691,16 +672,16 @@ JavaScriptCompiler.prototype = {
     if (!this.options.strict) {
       lookup[0] = '(helper = ';
       lookup.push(
-          ' != null ? helper : ',
-          this.aliasable('container.hooks.helperMissing')
+        ' != null ? helper : ',
+        this.aliasable('helpers.helperMissing')
       );
     }
 
     this.push([
-      '(', lookup,
-      (helper.paramsInit ? ['),(', helper.paramsInit] : []), '),',
-      '(typeof helper === ', this.aliasable('"function"'), ' ? ',
-      this.source.functionCall('helper', 'call', helper.callParams), ' : helper))'
+        '(', lookup,
+        (helper.paramsInit ? ['),(', helper.paramsInit] : []), '),',
+        '(typeof helper === ', this.aliasable('"function"'), ' ? ',
+        this.source.functionCall('helper', 'call', helper.callParams), ' : helper))'
     ]);
   },
 

lib/handlebars/helpers.js

@@ -15,12 +15,3 @@ export function registerDefaultHelpers(instance) {
   registerLookup(instance);
   registerWith(instance);
 }
-
-export function moveHelperToHooks(instance, helperName, keepHelper) {
-  if (instance.helpers[helperName]) {
-    instance.hooks[helperName] = instance.helpers[helperName];
-    if (!keepHelper) {
-      delete instance.helpers[helperName];
-    }
-  }
-}

lib/handlebars/runtime.js

@@ -1,30 +1,26 @@
 import * as Utils from './utils';
 import Exception from './exception';
-import {COMPILER_REVISION, createFrame, LAST_COMPATIBLE_COMPILER_REVISION, REVISION_CHANGES} from './base';
-import {moveHelperToHooks} from './helpers';
+import { COMPILER_REVISION, REVISION_CHANGES, createFrame } from './base';
 
 export function checkRevision(compilerInfo) {
   const compilerRevision = compilerInfo && compilerInfo[0] || 1,
         currentRevision = COMPILER_REVISION;
 
-  if (compilerRevision >= LAST_COMPATIBLE_COMPILER_REVISION && compilerRevision <= COMPILER_REVISION) {
-    return;
-  }
-
-  if (compilerRevision < LAST_COMPATIBLE_COMPILER_REVISION) {
-    const runtimeVersions = REVISION_CHANGES[currentRevision],
-          compilerVersions = REVISION_CHANGES[compilerRevision];
-    throw new Exception('Template was precompiled with an older version of Handlebars than the current runtime. ' +
-          'Please update your precompiler to a newer version (' + runtimeVersions + ') or downgrade your runtime to an older version (' + compilerVersions + ').');
-  } else {
-    // Use the embedded version info since the runtime doesn't know about this revision yet
-    throw new Exception('Template was precompiled with a newer version of Handlebars than the current runtime. ' +
-          'Please update your runtime to a newer version (' + compilerInfo[1] + ').');
+  if (compilerRevision !== currentRevision) {
+    if (compilerRevision < currentRevision) {
+      const runtimeVersions = REVISION_CHANGES[currentRevision],
+            compilerVersions = REVISION_CHANGES[compilerRevision];
+      throw new Exception('Template was precompiled with an older version of Handlebars than the current runtime. ' +
+            'Please update your precompiler to a newer version (' + runtimeVersions + ') or downgrade your runtime to an older version (' + compilerVersions + ').');
+    } else {
+      // Use the embedded version info since the runtime doesn't know about this revision yet
+      throw new Exception('Template was precompiled with a newer version of Handlebars than the current runtime. ' +
+            'Please update your runtime to a newer version (' + compilerInfo[1] + ').');
+    }
   }
 }
 
 export function template(templateSpec, env) {
-
   /* istanbul ignore next */
   if (!env) {
     throw new Exception('No environment passed to template');
@@ -39,9 +35,6 @@ export function template(templateSpec, env) {
   // for external users to override these as pseudo-supported APIs.
   env.VM.checkRevision(templateSpec.compiler);
 
-  // backwards compatibility for precompiled templates with compiler-version 7 (<4.3.0)
-  const templateWasPrecompiledWithCompilerV7 = templateSpec.compiler && templateSpec.compiler[0] === 7;
-
   function invokePartialWrapper(partial, context, options) {
     if (options.hash) {
       context = Utils.extend({}, context, options.hash);
@@ -49,15 +42,13 @@ export function template(templateSpec, env) {
         options.ids[0] = true;
       }
     }
+
     partial = env.VM.resolvePartial.call(this, partial, context, options);
-
-    let optionsWithHooks = Utils.extend({}, options, {hooks: this.hooks});
-
-    let result = env.VM.invokePartial.call(this, partial, context, optionsWithHooks);
+    let result = env.VM.invokePartial.call(this, partial, context, options);
 
     if (result == null && env.compile) {
       options.partials[options.name] = env.compile(partial, templateSpec.compilerOptions, env);
-      result = options.partials[options.name](context, optionsWithHooks);
+      result = options.partials[options.name](context, options);
     }
     if (result != null) {
       if (options.indent) {
@@ -124,6 +115,15 @@ export function template(templateSpec, env) {
       }
       return value;
     },
+    merge: function(param, common) {
+      let obj = param || common;
+
+      if (param && common && (param !== common)) {
+        obj = Utils.extend({}, common, param);
+      }
+
+      return obj;
+    },
     // An empty object to use as replacement for null-contexts
     nullContext: Object.seal({}),
 
@@ -158,28 +158,19 @@ export function template(templateSpec, env) {
 
   ret._setup = function(options) {
     if (!options.partial) {
-      container.helpers = Utils.extend({}, env.helpers, options.helpers);
+      container.helpers = container.merge(options.helpers, env.helpers);
 
       if (templateSpec.usePartial) {
-        container.partials = Utils.extend({}, env.partials, options.partials);
+        container.partials = container.merge(options.partials, env.partials);
       }
       if (templateSpec.usePartial || templateSpec.useDecorators) {
-        container.decorators = Utils.extend({}, env.decorators, options.decorators);
+        container.decorators = container.merge(options.decorators, env.decorators);
       }
-
-      container.hooks = {};
-
-      let keepHelperInHelpers = options.allowCallsToHelperMissing || templateWasPrecompiledWithCompilerV7;
-      moveHelperToHooks(container, 'helperMissing', keepHelperInHelpers);
-      moveHelperToHooks(container, 'blockHelperMissing', keepHelperInHelpers);
-
     } else {
       container.helpers = options.helpers;
       container.partials = options.partials;
       container.decorators = options.decorators;
-      container.hooks = options.hooks;
     }
-
   };
 
   ret._child = function(i, data, blockParams, depths) {

lib/handlebars/utils.js

@@ -1,4 +1,3 @@
-
 const escape = {
   '&': '&',
   '<': '&lt;',

package.json

@@ -1,7 +1,7 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "4.3.4",
+  "version": "4.2.2",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
   "homepage": "http://www.handlebarsjs.com/",
   "keywords": [

release-notes.md

@@ -2,75 +2,13 @@
 
 ## Development
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.4...master)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.2.2...master)
 
-## v4.3.4 - September 28th, 2019
-- fix: harden "propertyIsEnumerable"-check - ff4d827
-
-Compatibility notes:
-- No incompatibilities are known.
-
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.3...v4.3.4)
-
-## v4.3.3 - September 27th, 2019
- - fix test case for browsers that do not support __defineGetter__ - 8742bde
+## v4.2.2 - October 2nd, 2019
+- [#1562](https://github.com/wycats/handlebars.js/issues/1562) - Error message for syntax error missing location in 4.2.1+
 
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.2...v4.3.3)
-
-## v4.3.2 - September 26th, 2019
-- Use Object.prototype.propertyIsEnumerable to check for constructors - 213c0bb, #1563
-
-Compatibility notes:
-- There are no breaking changes
-
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.1...v4.3.2)
-
-## v4.3.1 - September 25th, 2019
-Fixes:
-
-- do not break on precompiled templates from Handlebars >=4.0.0 <4.3.0 - 1266838, #1561
-- Ensure allowCallsToHelperMissing runtime option is optional in typings - 93444c5, 64ecb9e, #1560
-
-
-
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.0...v4.3.1)
-
-## v4.3.0 - September 24th, 2019
-Fixes:
-
-- Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
-- Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
-
-Features:
-
-- Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`.
-
-Breaking changes:
-
-Compatibility notes:
-- Compiler revision increased - 06b7224
-  - This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0
-    The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers
-    to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest
-    that you always recompile your templates with the latest compiler in your build pipelines.
-
-- Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
-  - Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was 
-    never intended and was part of the exploits that have been revealed early in 2019 
-    (see https://github.com/wycats/handlebars.js/issues/1495). *It is also part of a new exploit that 
-    is not captured by the earlier fix.* In order to harden Handlebars against such exploits, calling thos helpers 
-    is now not possible anymore. *Overriding* those helpers is still possible.
-  - If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the
-    calls will again be possible
-
-Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump.
-
-We consider it more important to resolve a major security issue than to maintain 100% compatibility.
-
-    
-
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.2.1...v4.3.0)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.2.1...v4.2.2)
 
 ## v4.2.1 - September 20th, 2019
 Bugfixes: 

spec/expected/empty.amd.js

@@ -1,6 +1,6 @@
 define(['handlebars.runtime'], function(Handlebars) {
   Handlebars = Handlebars["default"];  var template = Handlebars.template, templates = Handlebars.templates = Handlebars.templates || {};
-return templates['empty'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+return templates['empty'] = template({"compiler":[7,">= 4.0.0"],"main":function(container,depth0,helpers,partials,data) {
     return "";
 },"useData":true});
 });

spec/regressions.js

@@ -291,36 +291,4 @@ describe('Regressions', function() {
     };
     shouldCompileToWithPartials(string, [{}, {}, partials], true, 'template  block  partial  block  template');
   });
-
-  describe('GH-1561: 4.3.x should still work with precompiled templates from 4.0.0 <= x < 4.3.0', function() {
-
-    it('should compile and execute templates', function() {
-      var newHandlebarsInstance = Handlebars.create();
-
-      registerTemplate(newHandlebarsInstance);
-      newHandlebarsInstance.registerHelper('loud', function(value) {
-        return value.toUpperCase();
-      });
-      var result = newHandlebarsInstance.templates['test.hbs']({name: 'yehuda'});
-      equals(result.trim(), 'YEHUDA');
-    });
-
-    it('should call "helperMissing" if a helper is missing', function() {
-      var newHandlebarsInstance = Handlebars.create();
-
-      shouldThrow(function() {
-        registerTemplate(newHandlebarsInstance);
-        newHandlebarsInstance.templates['test.hbs']({});
-      }, Handlebars.Exception, 'Missing helper: "loud"');
-    });
-
-    // This is a only slightly modified precompiled templated from compiled with 4.2.1
-    function registerTemplate(Handlebars) {
-      var template = Handlebars.template, templates = Handlebars.templates = Handlebars.templates || {};
-      templates['test.hbs'] = template({'compiler': [7, '>= 4.0.0'], 'main': function(container, depth0, helpers, partials, data) {
-          return container.escapeExpression((helpers.loud || (depth0 && depth0.loud) || helpers.helperMissing).call(depth0 != null ? depth0 : (container.nullContext || {}), (depth0 != null ? depth0.name : depth0), {'name': 'loud', 'hash': {}, 'data': data}))
-              + '\n\n';
-        }, 'useData': true});
-    }
-  });
 });

spec/runtime.js

@@ -21,7 +21,7 @@ describe('runtime', function() {
       shouldThrow(function() {
         Handlebars.template({
           main: {},
-          compiler: [Handlebars.LAST_COMPATIBLE_COMPILER_REVISION - 1]
+          compiler: [Handlebars.COMPILER_REVISION - 1]
         });
       }, Error, /Template was precompiled with an older version of Handlebars than the current runtime/);
       shouldThrow(function() {

spec/security.js

@@ -32,73 +32,4 @@ describe('security issues', function() {
 
         });
     });
-
-    describe('GH-1558: Prevent explicit call of helperMissing-helpers', function() {
-        if (!Handlebars.compile) {
-            return;
-        }
-
-        describe('without the option "allowExplicitCallOfHelperMissing"', function() {
-            it('should throw an exception when calling  "{{helperMissing}}" ', function() {
-                shouldThrow(function() {
-                    var template = Handlebars.compile('{{helperMissing}}');
-                    template({});
-                }, Error);
-            });
-            it('should throw an exception when calling  "{{#helperMissing}}{{/helperMissing}}" ', function() {
-                shouldThrow(function() {
-                    var template = Handlebars.compile('{{#helperMissing}}{{/helperMissing}}');
-                    template({});
-                }, Error);
-            });
-            it('should throw an exception when calling  "{{blockHelperMissing "abc" .}}" ', function() {
-                var functionCalls = [];
-                shouldThrow(function() {
-                    var template = Handlebars.compile('{{blockHelperMissing "abc" .}}');
-                    template({ fn: function() { functionCalls.push('called'); }});
-                }, Error);
-                equals(functionCalls.length, 0);
-            });
-            it('should throw an exception when calling  "{{#blockHelperMissing .}}{{/blockHelperMissing}}"', function() {
-                shouldThrow(function() {
-                    var template = Handlebars.compile('{{#blockHelperMissing .}}{{/blockHelperMissing}}');
-                    template({ fn: function() { return 'functionInData';}});
-                }, Error);
-            });
-        });
-
-        describe('with the option "allowCallsToHelperMissing" set to true', function() {
-            it('should not throw an exception when calling  "{{helperMissing}}" ', function() {
-                    var template = Handlebars.compile('{{helperMissing}}');
-                    template({}, {allowCallsToHelperMissing: true});
-            });
-            it('should not throw an exception when calling  "{{#helperMissing}}{{/helperMissing}}" ', function() {
-                    var template = Handlebars.compile('{{#helperMissing}}{{/helperMissing}}');
-                    template({}, {allowCallsToHelperMissing: true});
-            });
-            it('should not throw an exception when calling  "{{blockHelperMissing "abc" .}}" ', function() {
-                    var functionCalls = [];
-                    var template = Handlebars.compile('{{blockHelperMissing "abc" .}}');
-                    template({ fn: function() { functionCalls.push('called'); }}, {allowCallsToHelperMissing: true});
-                    equals(functionCalls.length, 1);
-            });
-            it('should not throw an exception when calling  "{{#blockHelperMissing .}}{{/blockHelperMissing}}"', function() {
-                    var template = Handlebars.compile('{{#blockHelperMissing true}}sdads{{/blockHelperMissing}}');
-                    template({}, {allowCallsToHelperMissing: true});
-            });
-        });
-    });
-
-    describe('GH-1563', function() {
-        it('should not allow to access constructor after overriding via __defineGetter__', function() {
-            if (({}).__defineGetter__ == null || ({}).__lookupGetter__ == null) {
-                return; // Browser does not support this exploit anyway
-            }
-            shouldCompileTo('{{__defineGetter__ "undefined" valueOf }}' +
-                '{{#with __lookupGetter__ }}' +
-                '{{__defineGetter__ "propertyIsEnumerable" (this.bind (this.bind 1)) }}' +
-                '{{constructor.name}}' +
-                '{{/with}}', {}, '');
-        });
-    });
 });

types/index.d.ts

@@ -29,7 +29,6 @@ declare namespace Handlebars {
       decorators?: { [name: string]: Function };
       data?: any;
       blockParams?: any[];
-      allowCallsToHelperMissing?: boolean;
   }
 
   export interface HelperOptions {

types/test.ts

@@ -97,7 +97,7 @@ Handlebars.VM.resolvePartial = <T>(partial: HandlebarsTemplateDelegate<T> | unde
   // transform name.
   options.name = name;
   return originalResolvePartial(partial, context, options);
-};
+}
 
 
 // #1544, allow custom helpers in knownHelpers
@@ -107,7 +107,3 @@ Handlebars.compile('test', {
     customHelper: true
   }
 });
-
-Handlebars.compile('test')({},{allowCallsToHelperMissing: true});
-
-Handlebars.compile('test')({},{});