Profiles·Public

handlebars

semver>=4.7.7postconditions8functions4last verified2026-06-24coverage score83%

Postconditions: what we check

  • compile · invalid-template-syntax
    error
    WhenTemplate string contains syntax errors (e.g., unclosed mustache, invalid expression)
    ThrowsHandlebars.Exception (extends Error, with lineNumber and column properties)
    Required handlingCaller MUST wrap compile() in try-catch when compiling user-provided or dynamic templates.
    costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1][2]
  • compile · compile-invalid-input-type
    error
    Whencompile() receives a non-string, non-AST input (e.g., null, undefined, number, Buffer). Throws synchronously before any compilation work begins. Common when template content is read from a file/database/HTTP response and the read returns null/undefined on failure.
    ThrowsHandlebars.Exception with message "You must pass a string or Handlebars AST to Handlebars.compile. You passed <input>"
    Required handlingValidate that compile() input is a string (or precompiled AST) before calling, especially when template content is loaded from external sources (filesystem, database, HTTP) that may return null/undefined when the source is missing. Alternatively wrap compile() in try-catch to prevent the exception from crashing the request handler.
    costlowin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1][2]
  • template execution (TemplateDelegate) · template-execution-partial-not-found
    error
    WhenTemplate references a partial ({{> partialName}}) that is not registered via Handlebars.registerPartial() at execution time.
    ThrowsHandlebars.Exception with message "The partial <name> could not be found"
    Required handlingCaller MUST wrap the template execution call in try-catch when using partials, especially when partial names come from dynamic data or when partial registration may be incomplete. Alternatively, register all required partials before calling any template that references them.
    costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[3][4]
  • template execution (TemplateDelegate) · template-execution-strict-undefined-variable
    warning
    WhenTemplate is compiled with strict: true option (or assumeObjects: true) and the template references a property that does not exist on the context object. Without strict mode, missing properties silently render as empty string.
    ThrowsHandlebars.Exception with message '"<varName>" not defined in <obj>'
    Required handlingCallers using strict mode MUST wrap template execution in try-catch, or validate that all template-referenced properties exist on the context object before rendering. Common pitfall: strict mode is enabled for security but error handling is not added.
    costlowin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1][4]
  • template execution (TemplateDelegate) · template-execution-prototype-access-silent-failure
    warning
    WhenTemplate accesses a prototype property (e.g., {{user.trim}}, {{arr.map}}) on an object. Since Handlebars 4.6.0, prototype access is forbidden by default and silently returns undefined rather than the property value. This is NOT an exception — it is a silent failure where data appears missing in the rendered output.
    ThrowsNo exception — silently returns undefined; template renders with empty value
    Required handlingCallers MUST either (a) use plain data objects without prototype methods in template context, (b) set allowProtoPropertiesByDefault: true or allowedProtoProperties in runtime options, or (c) restructure data to only pass own properties. Silent failure is the primary risk: rendered output appears partially blank without any error signal.
    costmediumin prodsilent failureusers seelost datavisibilitysilent
    Sources[5][6]
  • precompile · precompile-invalid-template-syntax
    error
    WhenTemplate string contains syntax errors (unclosed mustache, invalid expression, unknown helper in knownHelpersOnly mode). Identical behavior to compile() at parse/compile time.
    ThrowsHandlebars.Exception (extends Error, with lineNumber and column properties)
    Required handlingBuild scripts and CLI tools calling precompile() MUST wrap in try-catch or the entire build step will crash. precompile() is often called without error handling because it runs in a build context where errors are "assumed to be caught by the build tool" — this is incorrect; Handlebars.Exception propagates unless caught.
    costlowin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1][2]
  • precompile · precompile-invalid-input-type
    error
    Whenprecompile() receives a non-string, non-AST input (e.g., null, undefined, number, Buffer). Unlike compile() which may coerce, precompile() enforces the input type strictly.
    ThrowsHandlebars.Exception with message "You must pass a string or Handlebars AST to Handlebars.precompile. You passed <type>"
    Required handlingValidate that precompile() input is a string before calling, especially when template content is loaded from files, databases, or APIs that may return null/undefined.
    costlowin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[2]
  • template · template-version-mismatch
    error
    WhenThe precompiled template specification was generated by a different version of Handlebars than the current runtime. This happens when the handlebars version used at build time (precompile) differs from the version installed at runtime (template). Common in microservices where build and runtime environments diverge, or after upgrading handlebars without recompiling templates.
    ThrowsHandlebars.Exception: "Template was precompiled with an older/newer version of Handlebars than the current runtime. Please update your precompiler/runtime."
    Required handlingCallers MUST wrap Handlebars.template() in try-catch. Ensure precompiled templates are regenerated whenever handlebars is upgraded. Pin handlebars to exact versions in both build and runtime environments to prevent version drift.
    costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1][4]

Sources

Every postcondition cites at least one of these. Grouped by source type; numbered to match the footnotes above.

Official documentation
Source code

Research notes

Curator notes from SOURCES.md captured when the profile was written so you can verify the reasoning, not just the rules.

Sources — handlebars

Last verified: 2026-04-02

Documentation

URLFetchedSummary
https://handlebarsjs.com/api-reference/compilation.html2026-04-02API reference — compile() and precompile() documented; no explicit error docs
Package source lib/handlebars/compiler/compiler.js2026-04-02 (extracted from v4.7.9 tarball)Source shows throw new Exception(...) for syntax errors, unknown nodes
Package source lib/handlebars/runtime.js2026-04-02 (extracted from v4.7.9 tarball)Runtime throws for missing partials, missing helpers, blocked proto access

Security History

CVEDescriptionFixed Version
CVE-2019-19919Prototype pollution via compile/render>=4.3.0
CVE-2021-23369RCE via lookup helper in template execution>=4.7.7
CVE-2019-20920Prototype pollution via opt.allowedProtoProperties>=4.7.1

Source: https://security.snyk.io/package/npm/handlebars

Contract semver set to >=4.7.7 (patches all known critical CVEs).

Real-World Usage

  • yamadashy/repomix (⭐ 22k): Uses Handlebars.compile(staticTemplate) without try-catch
  • gristlabs/grist-core (⭐ 10k): Uses handlebars.Utils.escapeExpression only
  • 99 runtime-dep repos total in corpus
Need a different package?
Request a profile