[deleted] about express HOT 3 CLOSED

This is not a problem with express or hbs. The problem is passing user-controlled input to res.render.
The express documentation says:

The locals object is used by view engines to render a response. The object keys may be particularly sensitive and should not contain user-controlled input, as it may affect the operation of the view engine or provide a path to cross-site scripting. Consult the documentation for the used view engine for additional considerations.

from express.

For further reference, please review OWASP C5: Validate All Inputs.

I'm currently thinking that since hbs knows it's own schema, it could mitigate this issue by disallowing its core underlying design schema from the view model being passed in.

@Shruti-Ramenahalli have you considered submitting a pull request to the hbs repo with a suggested design fix?

from express.

If you believe there is a security issue please see our reporting guidelines.

from express.