fix: STRF-10175 Allow only strings passed to partial and block helpers (

#226)
bigcommerce · Oct 27, 2022 · 3e2d147 · 3e2d147
1 parent 6dd11cb
commit 3e2d147
Show file tree

Hide file tree

Showing 5 changed files with 64 additions and 11 deletions.
diff --git a/helpers/block.js b/helpers/block.js
@@ -1,7 +1,15 @@
 'use strict';
 
+const utils = require('./3p/utils');
+const common = require('./lib/common.js');
+
 const factory = globals => {
     return function(name) {
+        name = common.unwrapIfSafeString(globals.handlebars, name);
+        if (!utils.isString(name)) {
+            globals.getLogger().info("Non-string passed to block helper");
+            return '';
+        }
         const options = arguments[arguments.length - 1];
 
         /* Look for partial by name. */

diff --git a/helpers/partial.js b/helpers/partial.js
@@ -1,7 +1,15 @@
 'use strict';
 
+const utils = require('./3p/utils');
+const common = require('./lib/common.js');
+
 const factory = globals => {
     return function(name) {
+        name = common.unwrapIfSafeString(globals.handlebars, name);
+        if (!utils.isString(name)) {
+            globals.getLogger().info("Non-string passed to partial helper");
+            return '';
+        }
         const options = arguments[arguments.length - 1];
         globals.handlebars.registerPartial(name, options.fn);
     };

diff --git a/index.js b/index.js
@@ -65,6 +65,7 @@ class HandlebarsRenderer {
             getThemeSettings: this.getThemeSettings.bind(this),
             getTranslator: this.getTranslator.bind(this),
             getContent: this.getContent.bind(this),
+            getLogger: this.getLogger.bind(this),
             storage: {}, // global storage used by helpers to keep state
             resourceHints: []
         };
@@ -168,6 +169,15 @@ class HandlebarsRenderer {
         return this._contentRegions;
     };
 
+    /**
+     * Get logger provided to the library
+     *
+     * @param {Object} logger
+     */
+    getLogger() {
+        return this.logger;
+    }
+
     /**
      * Add templates to the active set of partials. The templates can either be raw
      * template strings, or the result coming from the preProcessor function.

diff --git a/spec/helpers/block.js b/spec/helpers/block.js
@@ -4,7 +4,7 @@ const lab = exports.lab = Lab.script();
 const describe = lab.experiment;
 const expect = Code.expect;
 const it = lab.it;
-const render = require('../spec-helpers').render;
+const { render } = require('../spec-helpers');
 
 describe('partial and block helpers', function () {
     it('should insert partial into the corresponding block', function (done) {
@@ -46,4 +46,32 @@ describe('partial and block helpers', function () {
             done();
         });
     });
+
+    it('should successfully render template', function (done) {
+        const templateContent = "some-content";
+        const templates = {
+            "layout/base": templateContent,
+            template: `{{#JSONparse '{"layout/base":{}}'}}{{#partial this}}{{/partial}}{{/JSONparse}}{{>layout/base}}`,
+        };
+        render('template', {}, {}, {}, templates).then(result => {
+            expect(result).to.be.equal(templateContent);
+            done();
+        });
+    });
+
+    it('should successfully render template with context', function (done) {
+        const templateContent = "Hello, world!";
+        const templates = {
+            template: `{{#partial "base"}}Hello, world!{{/partial}}{{#partial notPartials}}{{/partial}}{{> base}}`,
+        };
+        const context  = {
+            notPartials: {
+                "base": {}
+            }
+        }
+        render('template', context, {}, {}, templates).then(result => {
+            expect(result).to.be.equal(templateContent);
+            done();
+        });
+    });
 });
diff --git a/spec/helpers/getObject.js b/spec/helpers/getObject.js
@@ -33,16 +33,15 @@ describe('getObject helper', function () {
         ], done);
     });
 
-    // uncomment when 3rd-party version is replaced
-    // it('does not access prototype props', function (done) {
-    //     context.obj.__proto__ = {x: 'yz'};
-    //     runTestCases([
-    //         {
-    //             input: `{{#with (getObject "x" obj)}}{{x}}{{/with}}`,
-    //             output: ``,
-    //         },
-    //     ], done);
-    // });
+    it('does not access prototype props', function (done) {
+        context.obj.__proto__ = {x: 'yz'};
+        runTestCases([
+            {
+                input: `{{#with (getObject "x" obj)}}{{x}}{{/with}}`,
+                output: ``,
+            },
+        ], done);
+    });
 
     it('accepts SafeString paths', (done) => {
         runTestCases([