This is a pull request to fix the issue I created over here: #965

To summarize over here why I'm making these changes:

• strdup expects a C-style null-terminated string, but sometimes we're using nodejs strings to pass in strings that contain nulls in the middle, thus failing to copy everything at best, and causing crashes from reading invalid memory locations at worst.
• Thus I changed to using malloc, memcpy and memset to prevent these issues.

To explain my changes a little bit:

• I make the malloc'ed string one byte longer so I can add a terminating null character, since it looks like these templates are used in a number of different places, and for things like a repo path, where we do want things to end in a null character.
• I used memset instead of the more standard array-style access because most of the usages of these templates are const char *.
• The funky casts are because some places have void * instead of const char *, so to get the pointer arithmetic right, I had to specify the char *.

C code isn't what I normally write, so let me apologize in advance if these changes aren't quite what they should be 😄

I'm happy to make any modifications necessary.

The limited testing I've done seems to show that everything is working perfectly well with these changes.