Commits
Commits on Oct 29, 2022
-
Make library compatible with workers
Pulled from 4.x branch, see #1894.
Copy the full SHA 6186128View commit details -
Prettier v2 has the following breaking changes: * enforces spaces between `function` and params * enforces trailing commas by default
Copy the full SHA e534a91View commit details -
This is needed in order to use `globalThis`, see #1894. It also made it possible to remove some old polyfills and fallbacks.
Copy the full SHA f6ff3bfView commit details
Commits on May 25, 2022
-
Copy the full SHA b14ff4aView commit details
Commits on Dec 3, 2021
-
Don't rely on Node.js
global
objectIf `global` is used and handlebars is compiled for browser usage without a Node.js `global` polyfill, handlebars fails with a `global is undefined` error. Fixes #1593
Copy the full SHA 2954e7eView commit details
Commits on Feb 15, 2021
-
# Conflicts: # components/bower.json # components/handlebars.js.nuspec # components/package.json # integration-testing/multi-nodejs-test/test.sh # package-lock.json # package.json
Copy the full SHA 6790c08View commit details -
[FEAT] Extract the Handlebars parser (#1713)
Extracts the parser to `@handlebars/parser`, where it can be shared between different implementations. This means that e.g. Glimmer/Ember will be able to iterate on new features without forcing Handlebars to adopt them immediately, and vice versa. All implementors will be able to absorb changes as it makes sense for them.
Chris Garrett committedFeb 15, 2021 Copy the full SHA 19bdaceView commit details
Commits on Apr 15, 2020
-
docs: Fix simple typo, mulitple -> multiple
There is a small typo in lib/handlebars/compiler/whitespace-control.js. Should read `multiple` rather than `mulitple`.
Copy the full SHA b1034a6View commit details
Commits on Jan 13, 2020
-
# Conflicts: # components/bower.json # components/handlebars.js.nuspec # components/package.json # package.json
Copy the full SHA edfe6b8View commit details -
Copy the full SHA 586e672View commit details -
fix: don't wrap helpers that are not functions
- helpers should always be a function, but in #1639 one seems to be undefined. This was not a problem before 4.6 because helpers weren't wrapped then. Now, we must take care only to wrap helpers (when adding the "lookupProperty" function to the options), if they are really functions.
Copy the full SHA 9d5aa36View commit details
Commits on Jan 12, 2020
-
Copy the full SHA 14ba3d0View commit details -
fix: fix log output in case of illegal property access
- fix link url to handlebarsjs.com
Copy the full SHA f152dfcView commit details -
Copy the full SHA 3c1e252View commit details
Commits on Jan 10, 2020
-
Copy the full SHA 0d5c807View commit details -
fix: use "logger" instead of console.error
... to be graceful with older browser without "console"
Copy the full SHA 575d877View commit details -
feat: default options for controlling proto access
This commmit adds the runtime options - `allowProtoPropertiesByDefault` (boolean, default: false) and - `allowProtoMethodsByDefault` (boolean, default: false)` which can be used to allow access to prototype properties and functions in general. Specific properties and methods can still be disabled from access via `allowedProtoProperties` and `allowedProtoMethods` by setting the corresponding values to false. The methods `constructor`, `__defineGetter__`, `__defineSetter__`, `__lookupGetter__` and the property `__proto__` will be disabled, even if the allow...ByDefault-options are set to true. In order to allow access to those properties and methods, they have to be explicitly set to true in the 'allowedProto...'-options. A warning is logged when the a proto-access it attempted and denied by default (i.e. if no option is set by the user to make the access decision explicit)
Copy the full SHA 7af1c12View commit details
Commits on Jan 8, 2020
-
# Conflicts: # components/bower.json # components/handlebars.js.nuspec # components/package.json # package.json
Copy the full SHA 0c8230cView commit details -
Copy the full SHA 91a1b5dView commit details -
feat: access control to prototype properties via whitelist
Disallow access to prototype properties and methods by default. Access to properties is always checked via `Object.prototype.hasOwnProperty.call(parent, propertyName)`. New runtime options: - **allowedProtoMethods**: a string-to-boolean map of property-names that are allowed if they are methods of the parent object. - **allowedProtoProperties**: a string-to-boolean map of property-names that are allowed if they are properties but not methods of the parent object. ```js const template = handlebars.compile('{{aString.trim}}') const result = template({ aString: ' abc ' }) // result is empty, because trim is defined at String prototype ``` ```js const template = handlebars.compile('{{aString.trim}}') const result = template({ aString: ' abc ' }, { allowedProtoMethods: { trim: true } }) // result = 'abc' ``` Implementation details: The method now "container.lookupProperty" handles the prototype-checks and the white-lists. It is used in - JavaScriptCompiler#nameLookup - The "lookup"-helper (passed to all helpers as "options.lookupProperty") - The "lookup" function at the container, which is used for recursive lookups in "compat" mode Compatibility: - **Old precompiled templates work with new runtimes**: The "options.lookupPropery"-function is passed to the helper by a wrapper, not by the compiled templated. - **New templates work with old runtimes**: The template contains a function that is used as fallback if the "lookupProperty"-function cannot be found at the container. However, the runtime-options "allowedProtoProperties" and "allowedProtoMethods" only work with the newest runtime. BREAKING CHANGE: - access to prototype properties is forbidden completely by default
Copy the full SHA d03b6ecView commit details