secure-handlebars
Advanced tools
To automatically apply context-sensitive XSS output filtering for Handlebars
Automatically applying context-sensitive XSS output filtering to prevent XSS!
The original Handlebars is overriden to perform the following major steps:
<h1>{{title}}</h1> is rewritten into <h1>{{{yd title}}}</h1>^). The pre-processed template is compatible with the original (runtime) Handlebars.^ The default context-insensitive HTML escaping by Handlebars is disabled with the raw {{{expression}}} to avoid redundant escaping.
Analyze the HTML contexts of Handlebars templates on client-side
<!-- Disable the original handlebars -->
<!--script src="dist/handlebars.min.js"></script-->
<script src="dist/secure-handlebars.min.js"></script>
<script>
// given data stores a handlebars template as string
var html = '<html><title>{{title}}</title></html>',
data = {title: 'Hello'};
// analyze the HTML contexts, and return a handlebars template with context-sensitive helpers added
var template = Handlebars.compile(html);
// html is '<html><title>Hello</title></html>'
var html = template(data);
// inserts the html to the DOM
// ...
</script>
We highly recommend using the express-secure-handlebars npm for a streamlined experience of template pre-processing, compilating, context-sensitive output escaping, and data binding.
Here's deeper dive into using the standalone template pre-processor to insert context-dependent helper markups.
Install the secure-handlebars npm globally, so it can be used in any project.
npm install secure-handlebars -g
Given a handlebars template file named sample.hbs like so:
<!doctype html>
<html><title>{{title}}</title></html>
Pre-process the template:
handlebarspp sample.hbs > sample.shbs
The pre-processed template file sample.shbs that is fully-compatible with the original (runtime) Handlebars:
<!doctype html>
<html><title>{{{yd title}}}</title></html>
You may then come up with some statistics such as counting the number of dangerous/unhandled contexts (such as <script>{{script}}</script>) that deserve more intensive inspections and perhaps workarounds. And in case you would like to work on these pre-processed templates for further Handlebars (pre-)compilations without using the express-secure-handlebars npm, be reminded to register the secure-handlebars-helpers to apply context-sensitive output filtering accordingly.
npm test
This software is free to use under the BSD license. See the LICENSE file for license text and copyright information.
FAQs
To automatically apply context-sensitive XSS output filtering for Handlebars
The npm package secure-handlebars receives a total of 20 weekly downloads. As such, secure-handlebars popularity was classified as not popular.
We found that secure-handlebars demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.
Security News
PyPI now supports digital attestations, enhancing security and trust by allowing package maintainers to verify the authenticity of Python packages.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.