Use Object.prototype.propertyIsEnumerable to check for constructors

- context.propertyIsEnumerable can be replaced
  via __definedGetter__
- This is a fix specific to counter a known RCE exploit.
  Other fixes will follow.

closes #1563

spec/security.js

@@ -33,7 +33,7 @@ describe('security issues', function() {
         });
     });
 
-    describe('GH-xxxx: Prevent explicit call of helperMissing-helpers', function() {
+    describe('GH-1558: Prevent explicit call of helperMissing-helpers', function() {
         if (!Handlebars.compile) {
             return;
         }
@@ -88,4 +88,14 @@ describe('security issues', function() {
             });
         });
     });
+
+    describe('GH-1563', function() {
+        it('should not allow to access constructor after overriding via __defineGetter__', function() {
+            shouldCompileTo('{{__defineGetter__ "undefined" valueOf }}' +
+                '{{#with __lookupGetter__ }}' +
+                '{{__defineGetter__ "propertyIsEnumerable" (this.bind (this.bind 1)) }}' +
+                '{{constructor.name}}' +
+                '{{/with}}', {}, '');
+        });
+    });
 });