feat: configure escaping on handlebars templates (#6678)

Co-authored-by: Amr Bashir <amr.bashir2015@gmail.com>
2026-02-06 13:57:16 +00:00 · 2023-05-02 05:59:59 -07:00 · 2023-05-02 05:59:59 -07:00 · 6d6b6e653e
commit 6d6b6e653e
parent 40f137c214
18 changed files with 291 additions and 121 deletions
--- a/.changes/handlebars-escape.md
+++ b/.changes/handlebars-escape.md
@ -0,0 +1,7 @@
+---
+"tauri-bundler": patch
+"cli.rs": patch
+"cli.js": patch
+---
+
+Use escaping on Handlebars templates.
--- a/tooling/bundler/src/bundle/linux/appimage.rs
+++ b/tooling/bundler/src/bundle/linux/appimage.rs
@ -81,6 +81,7 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {

  // initialize shell script template.
  let mut handlebars = Handlebars::new();
+  handlebars.register_escape_fn(|s| s.into());
  handlebars
    .register_template_string("appimage", include_str!("templates/appimage"))
    .expect("Failed to register template for handlebars");
--- a/tooling/bundler/src/bundle/windows/msi/wix.rs
+++ b/tooling/bundler/src/bundle/windows/msi/wix.rs
@ -692,6 +692,7 @@ pub fn build_wix_app_installer(

    // Create the Powershell script to install the task
    let mut skip_uac_task_installer = Handlebars::new();
+    skip_uac_task_installer.register_escape_fn(|s| s.into());
    let xml = include_str!("../templates/install-task.ps1");
    skip_uac_task_installer
      .register_template_string("install-task.ps1", xml)
@ -703,6 +704,7 @@ pub fn build_wix_app_installer(

    // Create the Powershell script to uninstall the task
    let mut skip_uac_task_uninstaller = Handlebars::new();
+    skip_uac_task_uninstaller.register_escape_fn(|s| s.into());
    let xml = include_str!("../templates/uninstall-task.ps1");
    skip_uac_task_uninstaller
      .register_template_string("uninstall-task.ps1", xml)
--- a/tooling/bundler/src/bundle/windows/nsis.rs
+++ b/tooling/bundler/src/bundle/windows/nsis.rs
@ -344,6 +344,21 @@ fn build_nsis_app_installer(
  }

  let mut handlebars = Handlebars::new();
+  handlebars.register_escape_fn(|s| {
+    let mut output = String::new();
+    for c in s.chars() {
+      match c {
+        '\"' => output.push_str("$\\\""),
+        '$' => output.push_str("$$"),
+        '`' => output.push_str("$\\`"),
+        '\n' => output.push_str("$\\n"),
+        '\t' => output.push_str("$\\t"),
+        '\r' => output.push_str("$\\r"),
+        _ => output.push(c),
+      }
+    }
+    output
+  });
  handlebars
    .register_template_string("installer.nsi", include_str!("./templates/installer.nsi"))
    .map_err(|e| e.to_string())
--- a/tooling/bundler/src/bundle/windows/templates/install-task.ps1
+++ b/tooling/bundler/src/bundle/windows/templates/install-task.ps1
@ -25,4 +25,4 @@ if ($ChangeDir -ne "") {
    # Change directories to the install path
    Set-Location -Path $ChangeDir
 }
-SCHTASKS.EXE /CREATE /XML update.xml /TN "Update {{{product_name}}} - Skip UAC" /F
+SCHTASKS.EXE /CREATE /XML update.xml /TN "Update {{product_name}} - Skip UAC" /F
--- a/tooling/bundler/src/bundle/windows/templates/installer.nsi
+++ b/tooling/bundler/src/bundle/windows/templates/installer.nsi
@ -6,26 +6,26 @@ Var ReinstallPageCheck
 !include x64.nsh
 !include WordFunc.nsh

-!define MANUFACTURER "{{{manufacturer}}}"
-!define PRODUCTNAME "{{{product_name}}}"
-!define VERSION "{{{version}}}"
-!define INSTALLMODE "{{{install_mode}}}"
-!define LICENSE "{{{license}}}"
-!define INSTALLERICON "{{{installer_icon}}}"
-!define SIDEBARIMAGE "{{{sidebar_image}}}"
-!define HEADERIMAGE "{{{header_image}}}"
-!define MAINBINARYNAME "{{{main_binary_name}}}"
-!define MAINBINARYSRCPATH "{{{main_binary_path}}}"
-!define BUNDLEID "{{{bundle_id}}}"
-!define OUTFILE "{{{out_file}}}"
-!define ARCH "{{{arch}}}"
-!define PLUGINSPATH "{{{additional_plugins_path}}}"
-!define ALLOWDOWNGRADES "{{{allow_downgrades}}}"
-!define DISPLAYLANGUAGESELECTOR "{{{display_language_selector}}}"
-!define INSTALLWEBVIEW2MODE "{{{install_webview2_mode}}}"
-!define WEBVIEW2INSTALLERARGS "{{{webview2_installer_args}}}"
-!define WEBVIEW2BOOTSTRAPPERPATH "{{{webview2_bootstrapper_path}}}"
-!define WEBVIEW2INSTALLERPATH "{{{webview2_installer_path}}}"
+!define MANUFACTURER "{{manufacturer}}"
+!define PRODUCTNAME "{{product_name}}"
+!define VERSION "{{version}}"
+!define INSTALLMODE "{{install_mode}}"
+!define LICENSE "{{license}}"
+!define INSTALLERICON "{{installer_icon}}"
+!define SIDEBARIMAGE "{{sidebar_image}}"
+!define HEADERIMAGE "{{header_image}}"
+!define MAINBINARYNAME "{{main_binary_name}}"
+!define MAINBINARYSRCPATH "{{main_binary_path}}"
+!define BUNDLEID "{{bundle_id}}"
+!define OUTFILE "{{out_file}}"
+!define ARCH "{{arch}}"
+!define PLUGINSPATH "{{additional_plugins_path}}"
+!define ALLOWDOWNGRADES "{{allow_downgrades}}"
+!define DISPLAYLANGUAGESELECTOR "{{display_language_selector}}"
+!define INSTALLWEBVIEW2MODE "{{install_webview2_mode}}"
+!define WEBVIEW2INSTALLERARGS "{{webview2_installer_args}}"
+!define WEBVIEW2BOOTSTRAPPERPATH "{{webview2_bootstrapper_path}}"
+!define WEBVIEW2INSTALLERPATH "{{webview2_installer_path}}"
 !define UNINSTKEY "Software\Microsoft\Windows\CurrentVersion\Uninstall\${PRODUCTNAME}"
 !define MANUPRODUCTKEY "Software\${MANUFACTURER}\${PRODUCTNAME}"

--- a/tooling/bundler/src/bundle/windows/templates/main.wxs
+++ b/tooling/bundler/src/bundle/windows/templates/main.wxs
@ -11,11 +11,11 @@
 <Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
    <Product
            Id="*"
-            Name="{{{product_name}}}"
-            UpgradeCode="{{{upgrade_code}}}"
+            Name="{{product_name}}"
+            UpgradeCode="{{upgrade_code}}"
            Language="!(loc.TauriLanguage)"
-            Manufacturer="{{{manufacturer}}}"
-            Version="{{{version}}}">
+            Manufacturer="{{manufacturer}}"
+            Version="{{version}}">

        <Package Id="*"
                 Keywords="Installer"
@ -42,23 +42,23 @@
        <Media Id="1" Cabinet="app.cab" EmbedCab="yes" />

        {{#if banner_path}}
-        <WixVariable Id="WixUIBannerBmp" Value="{{{banner_path}}}" />
+        <WixVariable Id="WixUIBannerBmp" Value="{{banner_path}}" />
        {{/if}}
        {{#if dialog_image_path}}
-        <WixVariable Id="WixUIDialogBmp" Value="{{{dialog_image_path}}}" />
+        <WixVariable Id="WixUIDialogBmp" Value="{{dialog_image_path}}" />
        {{/if}}
        {{#if license}}
-        <WixVariable Id="WixUILicenseRtf" Value="{{{license}}}" />
+        <WixVariable Id="WixUILicenseRtf" Value="{{license}}" />
        {{/if}}

-        <Icon Id="ProductIcon" SourceFile="{{{icon_path}}}"/>
+        <Icon Id="ProductIcon" SourceFile="{{icon_path}}"/>
        <Property Id="ARPPRODUCTICON" Value="ProductIcon" />
        <Property Id="ARPNOREPAIR" Value="yes" Secure="yes" />      <!-- Remove repair -->
        <SetProperty Id="ARPNOMODIFY" Value="1" After="InstallValidate" Sequence="execute"/>

        <!-- initialize with previous InstallDir -->
        <Property Id="INSTALLDIR">
-            <RegistrySearch Id="PrevInstallDirReg" Root="HKCU" Key="Software\\{{{manufacturer}}}\\{{{product_name}}}" Name="InstallDir" Type="raw"/>
+            <RegistrySearch Id="PrevInstallDirReg" Root="HKCU" Key="Software\\{{manufacturer}}\\{{product_name}}" Name="InstallDir" Type="raw"/>
        </Property>

        <!-- launch app checkbox -->
@ -93,27 +93,27 @@
        <Directory Id="TARGETDIR" Name="SourceDir">
            <Directory Id="DesktopFolder" Name="Desktop">
                <Component Id="ApplicationShortcutDesktop" Guid="*">
-                    <Shortcut Id="ApplicationDesktopShortcut" Name="{{{product_name}}}" Description="Runs {{{product_name}}}" Target="[!Path]" WorkingDirectory="INSTALLDIR" />
+                    <Shortcut Id="ApplicationDesktopShortcut" Name="{{product_name}}" Description="Runs {{product_name}}" Target="[!Path]" WorkingDirectory="INSTALLDIR" />
                    <RemoveFolder Id="DesktopFolder" On="uninstall" />
-                    <RegistryValue Root="HKCU" Key="Software\\{{{manufacturer}}}\\{{{product_name}}}" Name="Desktop Shortcut" Type="integer" Value="1" KeyPath="yes" />
+                    <RegistryValue Root="HKCU" Key="Software\\{{manufacturer}}\\{{product_name}}" Name="Desktop Shortcut" Type="integer" Value="1" KeyPath="yes" />
                </Component>
            </Directory>
            <Directory Id="$(var.PlatformProgramFilesFolder)" Name="PFiles">
-                <Directory Id="INSTALLDIR" Name="{{{product_name}}}"/>
+                <Directory Id="INSTALLDIR" Name="{{product_name}}"/>
            </Directory>
            <Directory Id="ProgramMenuFolder">
-                <Directory Id="ApplicationProgramsFolder" Name="{{{product_name}}}"/>
+                <Directory Id="ApplicationProgramsFolder" Name="{{product_name}}"/>
            </Directory>
        </Directory>

        <DirectoryRef Id="INSTALLDIR">
            <Component Id="RegistryEntries" Guid="*">
-                <RegistryKey Root="HKCU" Key="Software\\{{{manufacturer}}}\\{{{product_name}}}">
+                <RegistryKey Root="HKCU" Key="Software\\{{manufacturer}}\\{{product_name}}">
                    <RegistryValue Name="InstallDir" Type="string" Value="[INSTALLDIR]" KeyPath="yes" />
                </RegistryKey>
            </Component>
-            <Component Id="Path" Guid="{{{path_component_guid}}}" Win64="$(var.Win64)">
-                <File Id="Path" Source="{{{app_exe_source}}}" KeyPath="yes" Checksum="yes"/>
+            <Component Id="Path" Guid="{{path_component_guid}}" Win64="$(var.Win64)">
+                <File Id="Path" Source="{{app_exe_source}}" KeyPath="yes" Checksum="yes"/>
            </Component>
            {{#each binaries as |bin| ~}}
            <Component Id="{{ bin.id }}" Guid="{{bin.guid}}" Win64="$(var.Win64)">
@ -131,12 +131,12 @@
                <File Id="UpdateTaskUninstaller" Source="uninstall-task.ps1" KeyPath="yes" Checksum="yes"/>
            </Component>
            {{/if}}
-            {{{resources}}}
+            {{resources}}
            <Component Id="CMP_UninstallShortcut" Guid="*">

                <Shortcut Id="UninstallShortcut"
-						  Name="Uninstall {{{product_name}}}"
-						  Description="Uninstalls {{{product_name}}}"
+						  Name="Uninstall {{product_name}}"
+						  Description="Uninstalls {{product_name}}"
 						  Target="[System64Folder]msiexec.exe"
 						  Arguments="/x [ProductCode]" />

@ -144,7 +144,7 @@
 							  On="uninstall" />

 				<RegistryValue Root="HKCU"
-							   Key="Software\\{{{manufacturer}}}\\{{{product_name}}}"
+							   Key="Software\\{{manufacturer}}\\{{product_name}}"
 							   Name="Uninstaller Shortcut"
 							   Type="integer"
 							   Value="1"
@ -155,15 +155,15 @@
        <DirectoryRef Id="ApplicationProgramsFolder">
            <Component Id="ApplicationShortcut" Guid="*">
                <Shortcut Id="ApplicationStartMenuShortcut"
-                    Name="{{{product_name}}}"
-                    Description="Runs {{{product_name}}}"
+                    Name="{{product_name}}"
+                    Description="Runs {{product_name}}"
                    Target="[!Path]"
                    Icon="ProductIcon"
                    WorkingDirectory="INSTALLDIR">
-                    <ShortcutProperty Key="System.AppUserModel.ID" Value="{{{bundle_id}}}"/>
+                    <ShortcutProperty Key="System.AppUserModel.ID" Value="{{bundle_id}}"/>
                </Shortcut>
                <RemoveFolder Id="ApplicationProgramsFolder" On="uninstall"/>
-                <RegistryValue Root="HKCU" Key="Software\\{{{manufacturer}}}\\{{{product_name}}}" Name="Start Menu Shortcut" Type="integer" Value="1" KeyPath="yes"/>
+                <RegistryValue Root="HKCU" Key="Software\\{{manufacturer}}\\{{product_name}}" Name="Start Menu Shortcut" Type="integer" Value="1" KeyPath="yes"/>
           </Component>
        </DirectoryRef>

@ -247,7 +247,7 @@
        </Property>

        {{#if download_bootstrapper}}
-        <CustomAction Id='DownloadAndInvokeBootstrapper' Directory="INSTALLDIR" Execute="deferred" ExeCommand='powershell.exe -NoProfile -windowstyle hidden try [\{] [\[]Net.ServicePointManager[\]]::SecurityProtocol = [\[]Net.SecurityProtocolType[\]]::Tls12 [\}] catch [\{][\}]; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ({{{webview_installer_args}}} &apos;/install&apos;) -Wait' Return='check'/>
+        <CustomAction Id='DownloadAndInvokeBootstrapper' Directory="INSTALLDIR" Execute="deferred" ExeCommand='powershell.exe -NoProfile -windowstyle hidden try [\{] [\[]Net.ServicePointManager[\]]::SecurityProtocol = [\[]Net.SecurityProtocolType[\]]::Tls12 [\}] catch [\{][\}]; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ({{webview_installer_args}} &apos;/install&apos;) -Wait' Return='check'/>
        <InstallExecuteSequence>
            <Custom Action='DownloadAndInvokeBootstrapper' Before='InstallFinalize'>
                <![CDATA[NOT(REMOVE OR WVRTINSTALLED)]]>
@ -257,8 +257,8 @@

        <!-- Embedded webview bootstrapper mode -->
        {{#if webview2_bootstrapper_path}}
-        <Binary Id="MicrosoftEdgeWebview2Setup.exe" SourceFile="{{{webview2_bootstrapper_path}}}"/>
-        <CustomAction Id='InvokeBootstrapper' BinaryKey='MicrosoftEdgeWebview2Setup.exe' Execute="deferred" ExeCommand='{{{webview_installer_args}}} /install' Return='check' />
+        <Binary Id="MicrosoftEdgeWebview2Setup.exe" SourceFile="{{webview2_bootstrapper_path}}"/>
+        <CustomAction Id='InvokeBootstrapper' BinaryKey='MicrosoftEdgeWebview2Setup.exe' Execute="deferred" ExeCommand='{{webview_installer_args}} /install' Return='check' />
        <InstallExecuteSequence>
            <Custom Action='InvokeBootstrapper' Before='InstallFinalize'>
                <![CDATA[NOT(REMOVE OR WVRTINSTALLED)]]>
@ -268,8 +268,8 @@

        <!-- Embedded offline installer -->
        {{#if webview2_installer_path}}
-        <Binary Id="MicrosoftEdgeWebView2RuntimeInstaller.exe" SourceFile="{{{webview2_installer_path}}}"/>
-        <CustomAction Id='InvokeStandalone' BinaryKey='MicrosoftEdgeWebView2RuntimeInstaller.exe' Execute="deferred" ExeCommand='{{{webview_installer_args}}} /install' Return='check' />
+        <Binary Id="MicrosoftEdgeWebView2RuntimeInstaller.exe" SourceFile="{{webview2_installer_path}}"/>
+        <CustomAction Id='InvokeStandalone' BinaryKey='MicrosoftEdgeWebView2RuntimeInstaller.exe' Execute="deferred" ExeCommand='{{webview_installer_args}} /install' Return='check' />
        <InstallExecuteSequence>
            <Custom Action='InvokeStandalone' Before='InstallFinalize'>
                <![CDATA[NOT(REMOVE OR WVRTINSTALLED)]]>
--- a/tooling/bundler/src/bundle/windows/templates/uninstall-task.ps1
+++ b/tooling/bundler/src/bundle/windows/templates/uninstall-task.ps1
@ -20,4 +20,4 @@ if ((Test-Admin) -eq $false) {
    exit
 }

-SCHTASKS.EXE /DELETE /TN 'Update {{{product_name}}} - Skip UAC' /F
+SCHTASKS.EXE /DELETE /TN 'Update {{product_name}} - Skip UAC' /F
--- a/tooling/bundler/src/bundle/windows/templates/update-task.xml
+++ b/tooling/bundler/src/bundle/windows/templates/update-task.xml
@ -6,7 +6,7 @@
 -->
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
-    <URI>\Update {{{product_name}}} - Skip UAC</URI>
+    <URI>\Update {{product_name}} - Skip UAC</URI>
  </RegistrationInfo>
  <Triggers />
  <Principals>
@ -37,7 +37,7 @@
  <Actions Context="Author">
    <Exec>
      <Command>cmd.exe</Command>
-      <Arguments>/c "%SYSTEMROOT%\System32\msiexec.exe /i %TEMP%\\{{{product_name}}}.msi {{{msiexec_args}}} /promptrestart"</Arguments>
+      <Arguments>/c "%SYSTEMROOT%\System32\msiexec.exe /i %TEMP%\\{{product_name}}.msi {{msiexec_args}} /promptrestart"</Arguments>
    </Exec>
  </Actions>
 </Task>
--- a/tooling/cli/Cargo.lock
+++ b/tooling/cli/Cargo.lock
@ -82,6 +82,15 @@ dependencies = [
 "memchr",
 ]

+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "ansi_term"
 version = "0.12.1"
@ -111,7 +120,7 @@ checksum = "76464446b8bc32758d7e88ee1a804d9914cd9b1cb264c029899680b0be29826f"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -379,6 +388,19 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"

+[[package]]
+name = "chrono"
+version = "0.4.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e3c5919066adf22df73762e50cffcde3a758f2a848b113b586d1f86728b673b"
+dependencies = [
+ "iana-time-zone",
+ "num-integer",
+ "num-traits",
+ "serde",
+ "winapi",
+]
+
 [[package]]
 name = "chunked_transfer"
 version = "1.4.0"
@ -444,7 +466,7 @@ dependencies = [
 "proc-macro-error",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -456,6 +478,16 @@ dependencies = [
 "os_str_bytes",
 ]

+[[package]]
+name = "codespan-reporting"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3538270d33cc669650c4b093848450d380def10c331d38c768e34cac80576e6e"
+dependencies = [
+ "termcolor",
+ "unicode-width",
+]
+
 [[package]]
 name = "color_quant"
 version = "1.1.0"
@ -629,7 +661,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "smallvec",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -639,7 +671,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dfae75de57f2b2e85e8768c3ea840fd159c8f33e2b6522c7835b7abac81be16e"
 dependencies = [
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -649,7 +681,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f877be4f7c9f246b183111634f75baa039715e3f46ce860677d3b19a69fb229c"
 dependencies = [
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -672,10 +704,54 @@ dependencies = [
 ]

 [[package]]
-name = "darling"
-version = "0.13.4"
+name = "cxx"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a01d95850c592940db9b8194bc39f4bc0e89dee5c4265e4b1807c34a9aba453c"
+checksum = "f61f1b6389c3fe1c316bf8a4dccc90a38208354b330925bce1f74a6c4756eb93"
+dependencies = [
+ "cc",
+ "cxxbridge-flags",
+ "cxxbridge-macro",
+ "link-cplusplus",
+]
+
+[[package]]
+name = "cxx-build"
+version = "1.0.94"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12cee708e8962df2aeb38f594aae5d827c022b6460ac71a7a3e2c3c2aae5a07b"
+dependencies = [
+ "cc",
+ "codespan-reporting",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "scratch",
+ "syn 2.0.14",
+]
+
+[[package]]
+name = "cxxbridge-flags"
+version = "1.0.94"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7944172ae7e4068c533afbb984114a56c46e9ccddda550499caa222902c7f7bb"
+
+[[package]]
+name = "cxxbridge-macro"
+version = "1.0.94"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2345488264226bf682893e25de0769f3360aac9957980ec49361b083ddaa5bc5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.14",
+]
+
+[[package]]
+name = "darling"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b750cb3417fd1b327431a470f388520309479ab0bf5e323505daf0290cd3850"
 dependencies = [
 "darling_core",
 "darling_macro",
@ -683,27 +759,27 @@ dependencies = [

 [[package]]
 name = "darling_core"
-version = "0.13.4"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "859d65a907b6852c9361e3185c862aae7fafd2887876799fa55f5f99dc40d610"
+checksum = "109c1ca6e6b7f82cc233a97004ea8ed7ca123a9af07a8230878fcfda9b158bf0"
 dependencies = [
 "fnv",
 "ident_case",
 "proc-macro2",
 "quote",
 "strsim 0.10.0",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
 name = "darling_macro"
-version = "0.13.4"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c972679f83bdf9c42bd905396b6c3588a843a17f0f16dfcfa3e2c5d57441835"
+checksum = "a4aab4dbc9f7611d8b55048a3a16d2d010c2c8334e46304b40ac1cc14bf3b48e"
 dependencies = [
 "darling_core",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -716,7 +792,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "rustc_version",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -1226,7 +1302,7 @@ dependencies = [
 "markup5ever",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -1299,6 +1375,30 @@ dependencies = [
 "want",
 ]

+[[package]]
+name = "iana-time-zone"
+version = "0.1.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0722cd7114b7de04316e7ea5456a0bbb20e4adb46fd27a3697adb812cff0f37c"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "windows 0.48.0",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0703ae284fc167426161c2e3f1da3ea71d94b21bedbcc9494e92b28e334e3dca"
+dependencies = [
+ "cxx",
+ "cxx-build",
+]
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@ -1380,6 +1480,7 @@ checksum = "10a35a97730320ffe8e2d410b5d3b69279b98d2c14bdb8b70ea89ecf7888d41e"
 dependencies = [
 "autocfg",
 "hashbrown",
+ "serde",
 ]

 [[package]]
@ -1516,9 +1617,9 @@ dependencies = [

 [[package]]
 name = "json-patch"
-version = "0.3.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e712e62827c382a77b87f590532febb1f8b2fdbc3eefa1ee37fe7281687075ef"
+checksum = "1f54898088ccb91df1b492cc80029a6fdf1c48ca0db7c6822a8babad69c94658"
 dependencies = [
 "serde",
 "serde_json",
@ -1655,6 +1756,15 @@ dependencies = [
 "safemem",
 ]

+[[package]]
+name = "link-cplusplus"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecd207c9c713c34f95a097a5b029ac2ce6010530c7b49d7fea24d977dede04f5"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.3.1"
@ -1831,7 +1941,7 @@ dependencies = [
 "napi-derive-backend",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -1846,7 +1956,7 @@ dependencies = [
 "quote",
 "regex",
 "semver",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -2091,7 +2201,7 @@ checksum = "b501e44f11665960c7e7fcf062c7d96a14ade4aa98116c004b2e37b5be7d736c"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -2229,7 +2339,7 @@ dependencies = [
 "pest_meta",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -2306,7 +2416,7 @@ dependencies = [
 "proc-macro-hack",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -2320,7 +2430,7 @@ dependencies = [
 "proc-macro-hack",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -2358,7 +2468,7 @@ checksum = "744b6f092ba29c3650faf274db506afd39944f48420f6c86b17cfe0ee1cb36bb"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -2438,7 +2548,7 @@ dependencies = [
 "proc-macro-error-attr",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 "version_check",
 ]

@ -2461,9 +2571,9 @@ checksum = "dbf0c48bc1d91375ae5c3cd81e3722dff1abcf81a30960240640d223f59fe0e5"

 [[package]]
 name = "proc-macro2"
-version = "1.0.46"
+version = "1.0.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94e2ef8dbfc347b10c094890f778ee2e36ca9bb4262e86dc99cd217e35f3470b"
+checksum = "2b63bdb0cd06f1f4dedf69b254734f9b45af66e4a031e42a7480257d9898b435"
 dependencies = [
 "unicode-ident",
 ]
@ -2479,9 +2589,9 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.20"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bcdf212e9776fbcb2d23ab029360416bb1706b1aea2d1a5ba002727cbcab804"
+checksum = "4424af4bf778aae2051a77b60283332f386554255d722233d09fbfc7e30da2fc"
 dependencies = [
 "proc-macro2",
 ]
@ -2799,7 +2909,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "serde_derive_internals",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -2808,6 +2918,12 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"

+[[package]]
+name = "scratch"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1792db035ce95be60c3f8853017b3999209281c24e2ba5bc8e59bf97a0c590c1"
+
 [[package]]
 name = "scrypt"
 version = "0.8.1"
@ -2881,9 +2997,9 @@ checksum = "a41d061efea015927ac527063765e73601444cdc344ba855bc7bd44578b25e1c"

 [[package]]
 name = "serde"
-version = "1.0.152"
+version = "1.0.160"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb7d1f0d3021d347a83e556fc4683dea2ea09d87bccdf88ff5c12545d89d5efb"
+checksum = "bb2f3770c8bce3bcda7e149193a069a0f4365bda1fa5cd88e03bca26afc1216c"
 dependencies = [
 "serde_derive",
 ]
@ -2900,13 +3016,13 @@ dependencies = [

 [[package]]
 name = "serde_derive"
-version = "1.0.152"
+version = "1.0.160"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af487d118eecd09402d70a5d72551860e788df87b464af30e5ea6a38c75c541e"
+checksum = "291a097c63d8497e00160b166a967a4a79c64f3facdd01cbd7502231688d77df"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.14",
 ]

 [[package]]
@ -2917,14 +3033,14 @@ checksum = "85bf8229e7920a9f636479437026331ce11aa132b4dde37d121944a44d6e5f3c"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
 name = "serde_json"
-version = "1.0.91"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877c235533714907a8c2464236f5c4b2a17262ef1bd71f38f35ea592c8da6883"
+checksum = "d721eca97ac802aa7777b701877c8004d950fc142651367300d21c1cc0194744"
 dependencies = [
 "itoa 1.0.2",
 "ryu",
@ -2945,24 +3061,30 @@ dependencies = [

 [[package]]
 name = "serde_with"
-version = "1.14.0"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "678b5a069e50bf00ecd22d0cd8ddf7c236f68581b03db652061ed5eb13a312ff"
+checksum = "331bb8c3bf9b92457ab7abecf07078c13f7d270ba490103e84e8b014490cd0b0"
 dependencies = [
+ "base64 0.13.0",
+ "chrono",
+ "hex",
+ "indexmap",
 "serde",
+ "serde_json",
 "serde_with_macros",
+ "time",
 ]

 [[package]]
 name = "serde_with_macros"
-version = "1.5.2"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e182d6ec6f05393cc0e5ed1bf81ad6db3a8feedf8ee515ecdd369809bcce8082"
+checksum = "859011bddcc11f289f07f467cc1fe01c7a941daa4d8f6c40d4d1c92eb6d9319c"
 dependencies = [
 "darling",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -2984,7 +3106,7 @@ checksum = "74064874e9f6a15f04c1f3cb627902d0e6b410abbf36668afa873c61889f1763"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -3169,7 +3291,7 @@ dependencies = [
 "proc-macro-error",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -3195,6 +3317,17 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "syn"
+version = "2.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcf316d5356ed6847742d036f8a39c3b8435cac10bd528a4bd461928a6ab34d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "sync_wrapper"
 version = "0.1.1"
@ -3346,7 +3479,7 @@ dependencies = [
 "heck 0.4.0",
 "html5ever",
 "infer",
- "json-patch 0.3.0",
+ "json-patch 1.0.0",
 "json5",
 "kuchiki",
 "memchr",
@ -3361,7 +3494,7 @@ dependencies = [
 "toml",
 "url",
 "walkdir",
- "windows",
+ "windows 0.39.0",
 ]

 [[package]]
@ -3424,22 +3557,22 @@ checksum = "8eaa81235c7058867fa8c0e7314f33dcce9c215f535d1913822a2b3f5e289f3c"

 [[package]]
 name = "thiserror"
-version = "1.0.38"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a9cd18aa97d5c45c6603caea1da6628790b37f7a34b6ca89522331c5180fed0"
+checksum = "978c9a314bd8dc99be594bc3c175faaa9794be04a5a5e153caba6915336cebac"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "1.0.38"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fb327af4685e4d03fa8cbcf1716380da910eeb2bb8be417e7f9fd3fb164f36f"
+checksum = "f9456a42c5b0d803c8cd86e73dd7cc9edd429499f37a3550d286d5e86720569f"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.14",
 ]

 [[package]]
@ -3480,6 +3613,7 @@ dependencies = [
 "itoa 1.0.2",
 "libc",
 "num_threads",
+ "serde",
 "time-macros",
 ]

@ -3530,7 +3664,7 @@ checksum = "9724f9a975fb987ef7a3cd9be0350edcbe130698af5b8f7a631e23d42d052484"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 ]

 [[package]]
@ -3894,7 +4028,7 @@ dependencies = [
 "log",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 "wasm-bindgen-shared",
 ]

@ -3928,7 +4062,7 @@ checksum = "7d94ac45fcf608c1f45ef53e748d35660f168490c10b23704c7779ab8f5c3048"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.107",
 "wasm-bindgen-backend",
 "wasm-bindgen-shared",
 ]
@ -4019,13 +4153,22 @@ dependencies = [
 "windows_x86_64_msvc 0.39.0",
 ]

+[[package]]
+name = "windows"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e686886bc078bc1b0b600cac0147aadb815089b6e4da64016cbd754b6342700f"
+dependencies = [
+ "windows-targets 0.48.0",
+]
+
 [[package]]
 name = "windows-implement"
 version = "0.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba01f98f509cb5dc05f4e5fc95e535f78260f15fea8fe1a8abdd08f774f1cee7"
 dependencies = [
- "syn",
+ "syn 1.0.107",
 "windows-tokens",
 ]

--- a/tooling/cli/src/init.rs
+++ b/tooling/cli/src/init.rs
@ -183,7 +183,8 @@ pub fn command(mut options: Options) -> Result<()> {
    };

    let _ = remove_dir_all(&template_target_path);
-    let handlebars = Handlebars::new();
+    let mut handlebars = Handlebars::new();
+    handlebars.register_escape_fn(|s| s.into());

    let mut data = BTreeMap::new();
    data.insert("tauri_dep", to_json(tauri_dep));
--- a/tooling/cli/src/plugin/init.rs
+++ b/tooling/cli/src/plugin/init.rs
@ -89,7 +89,8 @@ pub fn command(mut options: Options) -> Result<()> {
      };

    let _ = remove_dir_all(&template_target_path);
-    let handlebars = Handlebars::new();
+    let mut handlebars = Handlebars::new();
+    handlebars.register_escape_fn(|s| s.into());

    let mut data = BTreeMap::new();
    data.insert("plugin_name_original", to_json(&options.plugin_name));
--- a/tooling/cli/templates/app/src-tauri/Cargo.crate-manifest
+++ b/tooling/cli/templates/app/src-tauri/Cargo.crate-manifest
@ -12,12 +12,12 @@ rust-version = "1.60"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [build-dependencies]
-tauri-build = {{{  tauri_build_dep  }}}
+tauri-build = {{  tauri_build_dep  }}

 [dependencies]
 serde_json = "1.0"
 serde = { version = "1.0", features = ["derive"] }
-tauri = {{{  tauri_dep  }}}
+tauri = {{  tauri_dep  }}

 [features]
 # this feature is used for production builds or when `devPath` points to the filesystem and the built-in dev server is disabled.
--- a/tooling/cli/templates/app/src-tauri/tauri.conf.json
+++ b/tooling/cli/templates/app/src-tauri/tauri.conf.json
@ -1 +1 @@
-{{{ tauri_config }}}
+{{ tauri_config }}
--- a/tooling/cli/templates/plugin/backend/Cargo.crate-manifest
+++ b/tooling/cli/templates/plugin/backend/Cargo.crate-manifest
@ -8,4 +8,4 @@ rust-version = "1.60"
 exclude = ["/examples"]

 [dependencies]
-tauri = {{{  tauri_dep  }}}
+tauri = {{  tauri_dep  }}
--- a/tooling/cli/templates/plugin/backend/examples/vanilla/src-tauri/Cargo.crate-manifest
+++ b/tooling/cli/templates/plugin/backend/examples/vanilla/src-tauri/Cargo.crate-manifest
@ -10,11 +10,11 @@ rust-version = "1.60"
 [dependencies]
 serde_json = "1.0"
 serde = { version = "1.0", features = [ "derive" ] }
-tauri = {{{  tauri_example_dep  }}}
+tauri = {{ tauri_example_dep }}
 tauri-plugin-{{ plugin_name }} = { path = "../../../" }

 [build-dependencies]
-tauri-build = {{{  tauri_build_dep  }}}
+tauri-build = {{ tauri_build_dep  }}

 [features]
 custom-protocol = [ "tauri/custom-protocol" ]
--- a/tooling/cli/templates/plugin/with-api/Cargo.crate-manifest
+++ b/tooling/cli/templates/plugin/with-api/Cargo.crate-manifest
@ -8,6 +8,6 @@ rust-version = "1.60"
 exclude = ["/examples", "/webview-dist", "/webview-src", "node_modules"]

 [dependencies]
-tauri = {{{  tauri_dep }}}
+tauri = {{  tauri_dep }}
 serde = "1.0"
 thiserror = "1.0"
--- a/tooling/cli/templates/plugin/with-api/examples/tauri-app/src-tauri/Cargo.toml
+++ b/tooling/cli/templates/plugin/with-api/examples/tauri-app/src-tauri/Cargo.toml
@ -11,12 +11,12 @@ rust-version = "1.60"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [build-dependencies]
-tauri-build = {{{  tauri_build_dep  }}}
+tauri-build = {{ tauri_build_dep }}

 [dependencies]
 serde_json = "1.0"
 serde = { version = "1.0", features = ["derive"] }
-tauri = {{{  tauri_example_dep  }}}
+tauri = {{ tauri_example_dep }}
 tauri-plugin-{{ plugin_name }} = { path = "../../../" }

 [features]