[deleted]

[Shruti-Ramenahalli]

[deleted]

[krzysdz]

This is not a problem with express or hbs. The problem is passing user-controlled input to res.render.
The express documentation says:

The locals object is used by view engines to render a response. The object keys may be particularly sensitive and should not contain user-controlled input, as it may affect the operation of the view engine or provide a path to cross-site scripting. Consult the documentation for the used view engine for additional considerations.

[joeyguerra]

For further reference, please review OWASP C5: Validate All Inputs.

I'm currently thinking that since hbs knows it's own schema, it could mitigate this issue by disallowing its core underlying design schema from the view model being passed in.

@Shruti-Ramenahalli have you considered submitting a pull request to the hbs repo with a suggested design fix?

[wesleytodd]

If you believe there is a security issue please see our reporting guidelines.