Handlebars escaping the starting delimiter

[cburatto]

Before filing issues, please check the following points first:

• [x] Please don't open issues for security issues. Instead, file a report at https://www.npmjs.com/advisories/report?package=handlebars
• [x] Have a look at https://github.com/handlebars-lang/handlebars.js/blob/master/CONTRIBUTING.md
• [x] Read the FAQ at https://github.com/handlebars-lang/handlebars.js/blob/master/FAQ.md
• [x] Use the jsfiddle-template at https://jsfiddle.net/4nbwjaqz/4/ to reproduce problems or bugs

This will probably help you to get a solution faster. For bugs, it would be great to have a PR with a failing test-case.

---

Using Node.js Handlebars 4.7.7

When using a template string from a Windows UNC path, where single slashes are escaped ( \\ ) before a placeholder ( \\{{placeholder}} ), handlebars seems to "escape" the starting delimiter and treat it as regular {{.

In order to make it work, you need to "double-escape" the slashes ( \\\\ )

JSFIDDLE:

https://jsfiddle.net/qesz5g7w/2/

The code:

let base = '\\\\my.server.com\\myshare\\myfolder\\{{order}}\\myfolder\\myfolder\\myfolder';

let template = Handlebars.compile(base);

document.getElementById('output').innerHTML = template({ order: 'ABCD' });

// result:  \\my.server.com\myshare\myfolder{{order}}\myfolder\myfolder\myfolder

let baseEscaped = '\\\\my.server.com\\myshare\\myfolder\\\\{{order}}\\myfolder\\myfolder\\myfolder';

let templateEscaped = Handlebars.compile(baseEscaped);

document.getElementById('outputEscaped').innerHTML = templateEscaped({ order: 'ABCD' });

// result:  \\my.server.com\myshare\myfolder\ABCD\myfolder\myfolder\myfolder

[jaylinski]

As far as I know, this is a feature. See https://handlebarsjs.com/guide/expressions.html#escaping-handlebars-expressions.

Example: https://handlebarsjs.com/playground.html#format=1&currentExample=%7B%22template%22%3A%22%5C%5C%7B%7Bescaped%7D%7D%5Cn%7B%7Bescaped%7D%7D%22%2C%22partials%22%3A%5B%5D%2C%22input%22%3A%22%7B%5Cn%20%20escaped%3A%20%5C%22foo%5C%22%2C%5Cn%7D%5Cn%22%2C%22output%22%3A%22%7B%7Bescaped%7D%7D%5Cnfoo%22%2C%22preparationScript%22%3A%22%22%2C%22handlebarsVersion%22%3A%224.7.7%22%7D

[cburatto]

Thanks for the super-quick response!

Makes total sense.