fix: Replaced hbs with express-handlebars (#1659)

Addresses https://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs/

package.json

@@ -57,7 +57,7 @@
     "dotenv": "^8.2.0",
     "eventsource": "^1.0.7",
     "express": "^4.17.1",
-    "hbs": "^4.2.0",
+    "express-handlebars": "^6.0.3",
     "ioredis": "^4.27.8",
     "js-yaml": "^3.14.1",
     "lru-cache": "^6.0.0",

src/apps/default.ts

@@ -19,7 +19,7 @@ export function defaultApp(
       pkg = {};
     }
 
-    res.render("probot.hbs", pkg);
+    res.render("probot.handlebars", pkg);
   });
   router.get("/", (req, res, next) => res.redirect("/probot"));
 }

src/apps/setup.ts

@@ -47,7 +47,7 @@ export const setupAppFactory = (
       const manifest = setup.getManifest(pkg, baseUrl);
       const createAppUrl = setup.createAppUrl;
       // Pass the manifest to be POST'd
-      res.render("setup.hbs", { pkg, createAppUrl, manifest });
+      res.render("setup.handlebars", { pkg, createAppUrl, manifest });
     });
 
     route.get("/probot/setup", async (req: Request, res: Response) => {
@@ -71,7 +71,7 @@ export const setupAppFactory = (
     route.get("/probot/import", async (_req, res) => {
       const { WEBHOOK_PROXY_URL, GHE_HOST } = process.env;
       const GH_HOST = `https://${GHE_HOST ?? "github.com"}`;
-      res.render("import.hbs", { WEBHOOK_PROXY_URL, GH_HOST });
+      res.render("import.handlebars", { WEBHOOK_PROXY_URL, GH_HOST });
     });
 
     route.post("/probot/import", bodyParser.json(), async (req, res) => {
@@ -90,7 +90,7 @@ export const setupAppFactory = (
     });
 
     route.get("/probot/success", async (req, res) => {
-      res.render("success.hbs");
+      res.render("success.handlebars");
     });
 
     route.get("/", (req, res, next) => res.redirect("/probot"));

src/server/server.ts

@@ -11,6 +11,7 @@ import { createWebhookProxy } from "../helpers/webhook-proxy";
 import { VERSION } from "../version";
 import { ApplicationFunction, ServerOptions } from "../types";
 import { Probot } from "../";
+import { engine } from "express-handlebars";
 
 type State = {
   httpServer?: HttpServer;
@@ -55,7 +56,13 @@ export class Server {
       })
     );
 
-    this.expressApp.set("view engine", "hbs");
+    this.expressApp.engine(
+      "handlebars",
+      engine({
+        defaultLayout: false,
+      })
+    );
+    this.expressApp.set("view engine", "handlebars");
     this.expressApp.set("views", join(__dirname, "..", "..", "views"));
     this.expressApp.get("/ping", (req, res) => res.end("PONG"));
   }

test/apps/setup.test.ts

@@ -114,7 +114,7 @@ describe("Setup app", () => {
   });
 
   describe("GET /probot/import", () => {
-    it("renders import.hbs", async () => {
+    it("renders import.handlebars", async () => {
       await request(server.expressApp).get("/probot/import").expect(200);
     });
   });