Fix vulns in dev deps with npm audit fix

node_modules/handlebars/lib/handlebars.js

@@ -2,7 +2,7 @@ import runtime from './handlebars.runtime';
 
 // Compiler imports
 import AST from './handlebars/compiler/ast';
-import { parser as Parser, parse } from './handlebars/compiler/base';
+import { parser as Parser, parse, parseWithoutProcessing } from './handlebars/compiler/base';
 import { Compiler, compile, precompile } from './handlebars/compiler/compiler';
 import JavaScriptCompiler from './handlebars/compiler/javascript-compiler';
 import Visitor from './handlebars/compiler/visitor';
@@ -25,6 +25,7 @@ function create() {
   hb.JavaScriptCompiler = JavaScriptCompiler;
   hb.Parser = Parser;
   hb.parse = parse;
+  hb.parseWithoutProcessing = parseWithoutProcessing;
 
   return hb;
 }

node_modules/handlebars/lib/handlebars/base.js

@@ -4,8 +4,9 @@ import {registerDefaultHelpers} from './helpers';
 import {registerDefaultDecorators} from './decorators';
 import logger from './logger';
 
-export const VERSION = '4.2.0';
-export const COMPILER_REVISION = 7;
+export const VERSION = '4.5.1';
+export const COMPILER_REVISION = 8;
+export const LAST_COMPATIBLE_COMPILER_REVISION = 7;
 
 export const REVISION_CHANGES = {
   1: '<= 1.0.rc.2', // 1.0.rc.2 is actually rev2 but doesn't report it
@@ -14,7 +15,8 @@ export const REVISION_CHANGES = {
   4: '== 1.x.x',
   5: '== 2.0.0-alpha.x',
   6: '>= 2.0.0-beta.1',
-  7: '>= 4.0.0'
+  7: '>= 4.0.0 <4.3.0',
+  8: '>= 4.3.0'
 };
 
 const objectType = '[object Object]';

node_modules/handlebars/lib/handlebars/compiler/base.js

@@ -8,7 +8,7 @@ export { parser };
 let yy = {};
 extend(yy, Helpers);
 
-export function parse(input, options) {
+export function parseWithoutProcessing(input, options) {
   // Just return if an already-compiled AST was passed in.
   if (input.type === 'Program') { return input; }
 
@@ -19,6 +19,14 @@ export function parse(input, options) {
     return new yy.SourceLocation(options && options.srcName, locInfo);
   };
 
-  let strip = new WhitespaceControl(options);
-  return strip.accept(parser.parse(input));
+  let ast = parser.parse(input);
+
+  return ast;
+}
+
+export function parse(input, options) {
+  let ast = parseWithoutProcessing(input, options);
+  let strip = new WhitespaceControl(options);
+
+  return strip.accept(ast);
 }

node_modules/handlebars/lib/handlebars/compiler/javascript-compiler.js

@@ -13,13 +13,19 @@ JavaScriptCompiler.prototype = {
   // PUBLIC API: You can override these methods in a subclass to provide
   // alternative compiled forms for name lookup and buffering semantics
   nameLookup: function(parent, name/* , type*/) {
+    const isEnumerable = [ this.aliasable('container.propertyIsEnumerable'), '.call(', parent, ',"constructor")'];
+
     if (name === 'constructor') {
-      return ['(', parent, '.propertyIsEnumerable(\'constructor\') ? ', parent, '.constructor : undefined', ')'];
+      return ['(', isEnumerable, '?', _actualLookup(), ' : undefined)'];
     }
-    if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
-      return [parent, '.', name];
-    } else {
-      return [parent, '[', JSON.stringify(name), ']'];
+    return _actualLookup();
+
+    function _actualLookup() {
+      if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
+        return [parent, '.', name];
+      } else {
+        return [parent, '[', JSON.stringify(name), ']'];
+      }
     }
   },
   depthedLookup: function(name) {
@@ -214,7 +220,6 @@ JavaScriptCompiler.prototype = {
     let aliasCount = 0;
     for (let alias in this.aliases) { // eslint-disable-line guard-for-in
       let node = this.aliases[alias];
-
       if (this.aliases.hasOwnProperty(alias) && node.children && node.referenceCount > 1) {
         varDeclarations += ', alias' + (++aliasCount) + '=' + alias;
         node.children[0] = 'alias' + aliasCount;
@@ -311,7 +316,7 @@ JavaScriptCompiler.prototype = {
   // replace it on the stack with the result of properly
   // invoking blockHelperMissing.
   blockValue: function(name) {
-    let blockHelperMissing = this.aliasable('helpers.blockHelperMissing'),
+    let blockHelperMissing = this.aliasable('container.hooks.blockHelperMissing'),
         params = [this.contextName(0)];
     this.setupHelperArgs(name, 0, params);
 
@@ -329,7 +334,7 @@ JavaScriptCompiler.prototype = {
   // On stack, after, if lastHelper: value
   ambiguousBlockValue: function() {
     // We're being a bit cheeky and reusing the options value from the prior exec
-    let blockHelperMissing = this.aliasable('helpers.blockHelperMissing'),
+    let blockHelperMissing = this.aliasable('container.hooks.blockHelperMissing'),
         params = [this.contextName(0)];
     this.setupHelperArgs('', 0, params, true);
 
@@ -339,9 +344,9 @@ JavaScriptCompiler.prototype = {
     params.splice(1, 0, current);
 
     this.pushSource([
-        'if (!', this.lastHelper, ') { ',
-          current, ' = ', this.source.functionCall(blockHelperMissing, 'call', params),
-        '}']);
+      'if (!', this.lastHelper, ') { ',
+      current, ' = ', this.source.functionCall(blockHelperMissing, 'call', params),
+      '}']);
   },
 
   // [appendContent]
@@ -538,7 +543,7 @@ JavaScriptCompiler.prototype = {
     if (this.hash) {
       this.hashes.push(this.hash);
     }
-    this.hash = {values: [], types: [], contexts: [], ids: []};
+    this.hash = {values: {}, types: [], contexts: [], ids: []};
   },
   popHash: function() {
     let hash = this.hash;
@@ -622,18 +627,32 @@ JavaScriptCompiler.prototype = {
   // If the helper is not found, `helperMissing` is called.
   invokeHelper: function(paramSize, name, isSimple) {
     let nonHelper = this.popStack(),
-        helper = this.setupHelper(paramSize, name),
-        simple = isSimple ? [helper.name, ' || '] : '';
+        helper = this.setupHelper(paramSize, name);
 
-    let lookup = ['('].concat(simple, nonHelper);
-    if (!this.options.strict) {
-      lookup.push(' || ', this.aliasable('helpers.helperMissing'));
+    let possibleFunctionCalls = [];
+
+    if (isSimple) { // direct call to helper
+      possibleFunctionCalls.push(helper.name);
+    }
+    // call a function from the input object
+    possibleFunctionCalls.push(nonHelper);
+    if (!this.options.strict) {
+      possibleFunctionCalls.push(this.aliasable('container.hooks.helperMissing'));
     }
-    lookup.push(')');
 
-    this.push(this.source.functionCall(lookup, 'call', helper.callParams));
+    let functionLookupCode = ['(', this.itemsSeparatedBy(possibleFunctionCalls, '||'), ')'];
+    let functionCall = this.source.functionCall(functionLookupCode, 'call', helper.callParams);
+    this.push(functionCall);
   },
 
+  itemsSeparatedBy: function(items, separator) {
+    let result = [];
+    result.push(items[0]);
+    for (let i = 1; i < items.length; i++) {
+      result.push(separator, items[i]);
+    }
+    return result;
+  },
   // [invokeKnownHelper]
   //
   // On stack, before: hash, inverse, program, params..., ...
@@ -672,16 +691,16 @@ JavaScriptCompiler.prototype = {
     if (!this.options.strict) {
       lookup[0] = '(helper = ';
       lookup.push(
-        ' != null ? helper : ',
-        this.aliasable('helpers.helperMissing')
+          ' != null ? helper : ',
+          this.aliasable('container.hooks.helperMissing')
       );
     }
 
     this.push([
-        '(', lookup,
-        (helper.paramsInit ? ['),(', helper.paramsInit] : []), '),',
-        '(typeof helper === ', this.aliasable('"function"'), ' ? ',
-        this.source.functionCall('helper', 'call', helper.callParams), ' : helper))'
+      '(', lookup,
+      (helper.paramsInit ? ['),(', helper.paramsInit] : []), '),',
+      '(typeof helper === ', this.aliasable('"function"'), ' ? ',
+      this.source.functionCall('helper', 'call', helper.callParams), ' : helper))'
     ]);
   },
 
@@ -1072,6 +1091,7 @@ JavaScriptCompiler.prototype = {
 
   setupHelperArgs: function(helper, paramSize, params, useRegister) {
     let options = this.setupParams(helper, paramSize, params);
+    options.loc = JSON.stringify(this.source.currentLocation);
     options = this.objectLiteral(options);
     if (useRegister) {
       this.useRegister('options');
@@ -1131,7 +1151,7 @@ function strictLookup(requireTerminal, compiler, parts, type) {
   }
 
   if (requireTerminal) {
-    return [compiler.aliasable('container.strict'), '(', stack, ', ', compiler.quotedString(parts[i]), ')'];
+    return [compiler.aliasable('container.strict'), '(', stack, ', ', compiler.quotedString(parts[i]), ', ', JSON.stringify(compiler.source.currentLocation), ' )'];
   } else {
     return stack;
   }

node_modules/handlebars/lib/handlebars/compiler/whitespace-control.js

@@ -206,7 +206,7 @@ function omitLeft(body, i, multiple) {
     return;
   }
 
-  // We omit the last node if it's whitespace only and not preceeded by a non-content node.
+  // We omit the last node if it's whitespace only and not preceded by a non-content node.
   let original = current.value;
   current.value = current.value.replace(multiple ? (/\s+$/) : (/[ \t]+$/), '');
   current.leftStripped = current.value !== original;

node_modules/handlebars/lib/handlebars/exception.js

@@ -1,13 +1,18 @@
 
-const errorProps = ['description', 'fileName', 'lineNumber', 'message', 'name', 'number', 'stack'];
+const errorProps = ['description', 'fileName', 'lineNumber', 'endLineNumber', 'message', 'name', 'number', 'stack'];
 
 function Exception(message, node) {
   let loc = node && node.loc,
       line,
-      column;
+      endLineNumber,
+      column,
+      endColumn;
+
   if (loc) {
     line = loc.start.line;
+    endLineNumber = loc.end.line;
     column = loc.start.column;
+    endColumn = loc.end.column;
 
     message += ' - ' + line + ':' + column;
   }
@@ -27,6 +32,7 @@ function Exception(message, node) {
   try {
     if (loc) {
       this.lineNumber = line;
+      this.endLineNumber = endLineNumber;
 
       // Work around issue under safari where we can't directly set the column value
       /* istanbul ignore next */
@@ -35,8 +41,13 @@ function Exception(message, node) {
           value: column,
           enumerable: true
         });
+        Object.defineProperty(this, 'endColumn', {
+          value: endColumn,
+          enumerable: true
+        });
       } else {
         this.column = column;
+        this.endColumn = endColumn;
       }
     }
   } catch (nop) {

node_modules/handlebars/lib/handlebars/helpers.js

@@ -15,3 +15,12 @@ export function registerDefaultHelpers(instance) {
   registerLookup(instance);
   registerWith(instance);
 }
+
+export function moveHelperToHooks(instance, helperName, keepHelper) {
+  if (instance.helpers[helperName]) {
+    instance.hooks[helperName] = instance.helpers[helperName];
+    if (!keepHelper) {
+      delete instance.helpers[helperName];
+    }
+  }
+}

node_modules/handlebars/lib/handlebars/helpers/each.js

@@ -49,6 +49,16 @@ export default function(instance) {
             execIteration(i, i, i === context.length - 1);
           }
         }
+      } else if (global.Symbol && context[global.Symbol.iterator]) {
+        const newContext = [];
+        const iterator = context[global.Symbol.iterator]();
+        for (let it = iterator.next(); !it.done; it = iterator.next()) {
+          newContext.push(it.value);
+        }
+        context = newContext;
+        for (let j = context.length; i < j; i++) {
+          execIteration(i, i, i === context.length - 1);
+        }
       } else {
         let priorKey;
 

node_modules/handlebars/lib/handlebars/helpers/if.js

@@ -1,7 +1,9 @@
-import {isEmpty, isFunction} from '../utils';
+import { isEmpty, isFunction } from '../utils';
+import Exception from '../exception';
 
 export default function(instance) {
   instance.registerHelper('if', function(conditional, options) {
+    if (arguments.length != 2) { throw new Exception('#if requires exactly one argument');}
     if (isFunction(conditional)) { conditional = conditional.call(this); }
 
     // Default behavior is to render the positive path if the value is truthy and not empty.
@@ -15,6 +17,7 @@ export default function(instance) {
   });
 
   instance.registerHelper('unless', function(conditional, options) {
+    if (arguments.length != 2) { throw new Exception('#unless requires exactly one argument');}
     return instance.helpers['if'].call(this, conditional, {fn: options.inverse, inverse: options.fn, hash: options.hash});
   });
 }

node_modules/handlebars/lib/handlebars/helpers/with.js

@@ -1,7 +1,9 @@
-import {appendContextPath, blockParams, createFrame, isEmpty, isFunction} from '../utils';
+import { appendContextPath, blockParams, createFrame, isEmpty, isFunction } from '../utils';
+import Exception from '../exception';
 
 export default function(instance) {
   instance.registerHelper('with', function(context, options) {
+    if (arguments.length != 2) { throw new Exception('#with requires exactly one argument');}
     if (isFunction(context)) { context = context.call(this); }
 
     let fn = options.fn;

node_modules/handlebars/lib/handlebars/runtime.js

@@ -1,26 +1,30 @@
 import * as Utils from './utils';
 import Exception from './exception';
-import { COMPILER_REVISION, REVISION_CHANGES, createFrame } from './base';
+import {COMPILER_REVISION, createFrame, LAST_COMPATIBLE_COMPILER_REVISION, REVISION_CHANGES} from './base';
+import {moveHelperToHooks} from './helpers';
 
 export function checkRevision(compilerInfo) {
   const compilerRevision = compilerInfo && compilerInfo[0] || 1,
         currentRevision = COMPILER_REVISION;
 
-  if (compilerRevision !== currentRevision) {
-    if (compilerRevision < currentRevision) {
-      const runtimeVersions = REVISION_CHANGES[currentRevision],
-            compilerVersions = REVISION_CHANGES[compilerRevision];
-      throw new Exception('Template was precompiled with an older version of Handlebars than the current runtime. ' +
-            'Please update your precompiler to a newer version (' + runtimeVersions + ') or downgrade your runtime to an older version (' + compilerVersions + ').');
-    } else {
-      // Use the embedded version info since the runtime doesn't know about this revision yet
-      throw new Exception('Template was precompiled with a newer version of Handlebars than the current runtime. ' +
-            'Please update your runtime to a newer version (' + compilerInfo[1] + ').');
-    }
+  if (compilerRevision >= LAST_COMPATIBLE_COMPILER_REVISION && compilerRevision <= COMPILER_REVISION) {
+    return;
+  }
+
+  if (compilerRevision < LAST_COMPATIBLE_COMPILER_REVISION) {
+    const runtimeVersions = REVISION_CHANGES[currentRevision],
+          compilerVersions = REVISION_CHANGES[compilerRevision];
+    throw new Exception('Template was precompiled with an older version of Handlebars than the current runtime. ' +
+          'Please update your precompiler to a newer version (' + runtimeVersions + ') or downgrade your runtime to an older version (' + compilerVersions + ').');
+  } else {
+    // Use the embedded version info since the runtime doesn't know about this revision yet
+    throw new Exception('Template was precompiled with a newer version of Handlebars than the current runtime. ' +
+          'Please update your runtime to a newer version (' + compilerInfo[1] + ').');
   }
 }
 
 export function template(templateSpec, env) {
+
   /* istanbul ignore next */
   if (!env) {
     throw new Exception('No environment passed to template');
@@ -32,9 +36,12 @@ export function template(templateSpec, env) {
   templateSpec.main.decorator = templateSpec.main_d;
 
   // Note: Using env.VM references rather than local var references throughout this section to allow
-  // for external users to override these as psuedo-supported APIs.
+  // for external users to override these as pseudo-supported APIs.
   env.VM.checkRevision(templateSpec.compiler);
 
+  // backwards compatibility for precompiled templates with compiler-version 7 (<4.3.0)
+  const templateWasPrecompiledWithCompilerV7 = templateSpec.compiler && templateSpec.compiler[0] === 7;
+
   function invokePartialWrapper(partial, context, options) {
     if (options.hash) {
       context = Utils.extend({}, context, options.hash);
@@ -42,13 +49,15 @@ export function template(templateSpec, env) {
         options.ids[0] = true;
       }
     }
-
     partial = env.VM.resolvePartial.call(this, partial, context, options);
-    let result = env.VM.invokePartial.call(this, partial, context, options);
+
+    let optionsWithHooks = Utils.extend({}, options, {hooks: this.hooks});
+
+    let result = env.VM.invokePartial.call(this, partial, context, optionsWithHooks);
 
     if (result == null && env.compile) {
       options.partials[options.name] = env.compile(partial, templateSpec.compilerOptions, env);
-      result = options.partials[options.name](context, options);
+      result = options.partials[options.name](context, optionsWithHooks);
     }
     if (result != null) {
       if (options.indent) {
@@ -70,9 +79,9 @@ export function template(templateSpec, env) {
 
   // Just add water
   let container = {
-    strict: function(obj, name) {
-      if (!(name in obj)) {
-        throw new Exception('"' + name + '" not defined in ' + obj);
+    strict: function(obj, name, loc) {
+      if (!obj || !(name in obj)) {
+        throw new Exception('"' + name + '" not defined in ' + obj, { loc: loc });
       }
       return obj[name];
     },
@@ -115,15 +124,6 @@ export function template(templateSpec, env) {
       }
       return value;
     },
-    merge: function(param, common) {
-      let obj = param || common;
-
-      if (param && common && (param !== common)) {
-        obj = Utils.extend({}, common, param);
-      }
-
-      return obj;
-    },
     // An empty object to use as replacement for null-contexts
     nullContext: Object.seal({}),
 
@@ -158,19 +158,28 @@ export function template(templateSpec, env) {
 
   ret._setup = function(options) {
     if (!options.partial) {
-      container.helpers = container.merge(options.helpers, env.helpers);
+      container.helpers = Utils.extend({}, env.helpers, options.helpers);
 
       if (templateSpec.usePartial) {
-        container.partials = container.merge(options.partials, env.partials);
+        container.partials = Utils.extend({}, env.partials, options.partials);
       }
       if (templateSpec.usePartial || templateSpec.useDecorators) {
-        container.decorators = container.merge(options.decorators, env.decorators);
+        container.decorators = Utils.extend({}, env.decorators, options.decorators);
       }
+
+      container.hooks = {};
+
+      let keepHelperInHelpers = options.allowCallsToHelperMissing || templateWasPrecompiledWithCompilerV7;
+      moveHelperToHooks(container, 'helperMissing', keepHelperInHelpers);
+      moveHelperToHooks(container, 'blockHelperMissing', keepHelperInHelpers);
+
     } else {
       container.helpers = options.helpers;
       container.partials = options.partials;
       container.decorators = options.decorators;
+      container.hooks = options.hooks;
     }
+
   };
 
   ret._child = function(i, data, blockParams, depths) {

node_modules/handlebars/lib/handlebars/utils.js

@@ -1,3 +1,4 @@
+
 const escape = {
   '&': '&',
   '<': '&lt;',