From f2af5ab0947eb0b7813a9e5081cdb42506fe2940 Mon Sep 17 00:00:00 2001
From: sayrer <sayrer@gmail.com>
Date: Sat, 18 Dec 2021 12:57:45 -0930
Subject: [PATCH 1/5] Harden node.indent against prototype pollution.

---
 lib/compiler.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/compiler.js b/lib/compiler.js
index 92774d6..e26e607 100644
--- a/lib/compiler.js
+++ b/lib/compiler.js
@@ -322,7 +322,7 @@
     var prefix = "<" + (context.prefix || "");
     var sym = prefix + node.n + serialNo++;
     context.partials[sym] = {name: node.n, partials: {}};
-    context.code += 't.b(t.rp("' +  esc(sym) + '",c,p,"' + (node.indent || '') + '"));';
+    context.code += 't.b(t.rp("' +  esc(sym) + '",c,p,"' + ((node.hasOwnProperty("indent") && node.indent) || '') + '"));';
     return sym;
   }
 

From 8a611a4575f145623451f5b30501291ca087ebc3 Mon Sep 17 00:00:00 2001
From: sayrer <sayrer@gmail.com>
Date: Sat, 18 Dec 2021 13:07:38 -0930
Subject: [PATCH 2/5] Harden context.prefix against prototype pollution.

---
 lib/compiler.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/compiler.js b/lib/compiler.js
index e26e607..d00dc51 100644
--- a/lib/compiler.js
+++ b/lib/compiler.js
@@ -319,7 +319,7 @@
   }
 
   function createPartial(node, context) {
-    var prefix = "<" + (context.prefix || "");
+    var prefix = "<" + ((context.hasOwnProperty("prefix") && context.prefix) || "");
     var sym = prefix + node.n + serialNo++;
     context.partials[sym] = {name: node.n, partials: {}};
     context.code += 't.b(t.rp("' +  esc(sym) + '",c,p,"' + ((node.hasOwnProperty("indent") && node.indent) || '') + '"));';

From d2132a55ded2a988f1280f6d2cf5f89478d43b4b Mon Sep 17 00:00:00 2001
From: sayrer <sayrer@gmail.com>
Date: Sat, 18 Dec 2021 13:21:12 -0930
Subject: [PATCH 3/5] Fix correctly.

---
 lib/compiler.js | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/compiler.js b/lib/compiler.js
index d00dc51..646fbdc 100644
--- a/lib/compiler.js
+++ b/lib/compiler.js
@@ -319,10 +319,11 @@
   }
 
   function createPartial(node, context) {
-    var prefix = "<" + ((context.hasOwnProperty("prefix") && context.prefix) || "");
-    var sym = prefix + node.n + serialNo++;
+    var prefix = context.hasOwnProperty('prefix') ? context.prefix : '');
+    var sym = "<" + (prefix || '') + node.n + serialNo++;
     context.partials[sym] = {name: node.n, partials: {}};
-    context.code += 't.b(t.rp("' +  esc(sym) + '",c,p,"' + ((node.hasOwnProperty("indent") && node.indent) || '') + '"));';
+    var indent = node.hasOwnProperty('indent') ? node.indent : '';
+    context.code += 't.b(t.rp("' +  esc(sym) + '",c,p,"' + (indent || '') + '"));';
     return sym;
   }
 
@@ -395,7 +396,7 @@
 
   Hogan.parse = function(tokens, text, options) {
     options = options || {};
-    return buildTree(tokens, '', [], options.sectionTags || []);
+    return buildTree(tokens, '', [], (options.hasOwnProperty("sectionTags") && options.sectionTags || []);
   }
 
   Hogan.cache = {};

From 96eb96d908310f82592e02ceafbb5c14226db9c7 Mon Sep 17 00:00:00 2001
From: sayrer <sayrer@gmail.com>
Date: Sat, 18 Dec 2021 13:36:40 -0930
Subject: [PATCH 4/5] Fix typos.

---
 lib/compiler.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/compiler.js b/lib/compiler.js
index 646fbdc..5097248 100644
--- a/lib/compiler.js
+++ b/lib/compiler.js
@@ -319,8 +319,8 @@
   }
 
   function createPartial(node, context) {
-    var prefix = context.hasOwnProperty('prefix') ? context.prefix : '');
-    var sym = "<" + (prefix || '') + node.n + serialNo++;
+    var prefix = context.hasOwnProperty('prefix') ? context.prefix : '';
+    var sym = "<" + prefix + node.n + serialNo++;
     context.partials[sym] = {name: node.n, partials: {}};
     var indent = node.hasOwnProperty('indent') ? node.indent : '';
     context.code += 't.b(t.rp("' +  esc(sym) + '",c,p,"' + (indent || '') + '"));';
@@ -396,7 +396,8 @@
 
   Hogan.parse = function(tokens, text, options) {
     options = options || {};
-    return buildTree(tokens, '', [], (options.hasOwnProperty("sectionTags") && options.sectionTags || []);
+    var sectionTags = options.hasOwnProperty("sectionTags") ? options.sectionTags : [];
+    return buildTree(tokens, '', [], (sectionTags || []));
   }
 
   Hogan.cache = {};

From 304f2323928f3801cb0e9aa8d3ee986ec37762e3 Mon Sep 17 00:00:00 2001
From: sayrer <sayrer@gmail.com>
Date: Sat, 18 Dec 2021 13:37:38 -0930
Subject: [PATCH 5/5] Correct prefix behavior.

---
 lib/compiler.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/compiler.js b/lib/compiler.js
index 5097248..f8a2099 100644
--- a/lib/compiler.js
+++ b/lib/compiler.js
@@ -320,7 +320,7 @@
 
   function createPartial(node, context) {
     var prefix = context.hasOwnProperty('prefix') ? context.prefix : '';
-    var sym = "<" + prefix + node.n + serialNo++;
+    var sym = "<" + (prefix || '') + node.n + serialNo++;
     context.partials[sym] = {name: node.n, partials: {}};
     var indent = node.hasOwnProperty('indent') ? node.indent : '';
     context.code += 't.b(t.rp("' +  esc(sym) + '",c,p,"' + (indent || '') + '"));';