@@ -154,10 +154,10 @@ echo $template(['my_var' => null], $runtimeOptions); // Not equal
154154 (e.g. ` {{#helper as |a b|}} ` produces ` 2 ` ).
155155
156156* ` scope ` (` mixed ` ): The current evaluation context (equivalent to ` this ` in a Handlebars.js helper).
157- Can be reassigned inside a helper to change the context passed to ` fn() ` .
158157
159- * ` data ` (` array ` ): The current ` @data ` frame. Contains ` @ ` -prefixed private variables such as
160- ` root ` , ` index ` , ` key ` , ` first ` , ` last ` , and ` _parent ` . Can be read or modified inside a helper.
158+ * ` data ` (` array ` ): The current ` @data ` frame. ` root ` is always present and refers to the top-level
159+ context. ` index ` , ` key ` , ` first ` , and ` last ` are set by ` {{#each}} ` blocks. Can be read or modified
160+ inside a helper.
161161
162162### HelperOptions Methods
163163
@@ -177,7 +177,7 @@ echo $template(['my_var' => null], $runtimeOptions); // Not equal
177177 remainder of the render. The closure must be produced by ` Handlebars::compile ` .
178178
179179> [ !NOTE]
180- > ` isset($options->fn) ` and ` isset($options->inverse) ` return true if the helper was called as a block,
180+ > ` isset($options->fn) ` and ` isset($options->inverse) ` return ` true ` if the helper was called as a block,
181181> and ` false ` for inline helper calls.
182182
183183## Hooks
@@ -220,7 +220,15 @@ When a helper is executed in a `{{{ }}}` expression, the original return value w
220220
221221Helpers may return a ` DevTheorem\Handlebars\SafeString ` instance to prevent escaping the return value.
222222When constructing the string that will be marked as safe, any external content should be properly escaped
223- using the ` Handlebars::escapeExpression() ` method to avoid potential security concerns.
223+ using the ` Handlebars::escapeExpression() ` method to prevent XSS vulnerabilities.
224+
225+ ## Data Frames
226+
227+ Block helpers that inject ` @ ` -prefixed variables should create a child data frame using
228+ ` Handlebars::createFrame($options->data) ` , add their variables to it, and pass it to ` fn() ` or ` inverse() `
229+ via the ` data ` key (e.g. ` $options->fn($context, ['data' => $frame]) ` ). This mirrors ` Handlebars.createFrame() `
230+ in Handlebars.js, isolating the helper's variables to avoid corrupting the state of any parents
231+ (while still inheriting parent variables such as ` @root ` ).
224232
225233## Missing Features
226234
0 commit comments