fix(lib): Addresses GHSA-rg36-rxv9-2m9q vulnerability

lib/hbs.js

@@ -70,7 +70,13 @@ function middleware (filename, options, cb) {
         let res = template
 
         Object.keys(values).forEach(function (id) {
-          res = res.replace(id, values[id])
+          const value = values[id]
+
+          const escaped = handlebars.Utils.escapeExpression(
+            value == null ? String(value) : value
+          )
+
+          res = res.replace(id, function () { return escaped })
         })
 
         cb(null, res)

test/async_helpers.test.js

@@ -58,6 +58,21 @@ describe('express 4.x async helpers', () => {
       cb(val)
     })
 
+    hbs.registerAsyncHelper('async-payload', function (context, cb) {
+      const val = '<script>alert(document.cookie)</script>'
+
+      process.nextTick(function () {
+        cb(val)
+      })
+    })
+
+    // resolves to whatever it is given, to reach the non-string values
+    hbs.registerAsyncHelper('async-echo', function (value, context, cb) {
+      process.nextTick(function () {
+        cb(value)
+      })
+    })
+
     app.get('/', function (req, res) {
       res.render('async', {
         layout: false,
@@ -86,6 +101,18 @@ describe('express 4.x async helpers', () => {
         layout: 'layout_async',
       })
     })
+
+    app.get('/async-escape', function (req, res) {
+      res.render('async-escape', {
+        layout: false,
+      })
+    })
+
+    app.get('/async-non-string', function (req, res) {
+      res.render('async-non-string', {
+        layout: false,
+      })
+    })
   })
 
   test('index', async () => {
@@ -135,4 +162,17 @@ describe('express 4.x async helpers', () => {
     )
     await request(app).get('/layout-with-async').expect(expected)
   })
+
+  // @see https://github.com/pillarjs/hbs/security/advisories/GHSA-rg36-rxv9-2m9q
+  test('async helper output is HTML-escaped', async () => {
+    await request(app)
+      .get('/async-escape')
+      .expect('&lt;script&gt;alert(document.cookie)&lt;/script&gt;')
+  })
+
+  test('async helper non-string values keep their text output', async () => {
+    await request(app)
+      .get('/async-non-string')
+      .expect('[null][undefined][false][0]')
+  })
 })

test/views/async-escape.hbs

@@ -0,0 +1 @@
+{{async-payload}}

test/views/async-non-string.hbs

@@ -0,0 +1 @@
+[{{async-echo null}}][{{async-echo undefined}}][{{async-echo false}}][{{async-echo 0}}]