diff --git a/Gruntfile.js b/Gruntfile.js index deacdc43..07ff4c24 100644 --- a/Gruntfile.js +++ b/Gruntfile.js @@ -119,19 +119,19 @@ module.exports = function(grunt) { concurrency: 4, browsers: [ { browserName: 'chrome' }, - { browserName: 'firefox', platform: 'Linux' }, + { browserName: 'firefox', platform: 'Linux' } // {browserName: 'safari', version: 9, platform: 'OS X 10.11'}, // {browserName: 'safari', version: 8, platform: 'OS X 10.10'}, - { - browserName: 'internet explorer', - version: 11, - platform: 'Windows 8.1' - }, - { - browserName: 'internet explorer', - version: 10, - platform: 'Windows 8' - } + // { + // browserName: 'internet explorer', + // version: 11, + // platform: 'Windows 8.1' + // }, + // { + // browserName: 'internet explorer', + // version: 10, + // platform: 'Windows 8' + // } ] } }, diff --git a/integration-testing/multi-nodejs-test/test.sh b/integration-testing/multi-nodejs-test/test.sh index 26fe64ee..ac027f1a 100755 --- a/integration-testing/multi-nodejs-test/test.sh +++ b/integration-testing/multi-nodejs-test/test.sh @@ -12,18 +12,20 @@ cd "$( dirname "$( readlink -f "$0" )" )" || exit 1 # However, the built distribution should work with older NodeJS versions as well. # This test is simple by design. It merely ensures, that calling Handlebars does not fail with old versions. # It does (almost) not test for correctness, because that is already done in the mocha-tests. -# And it does not use any NodeJS based testing framwork to make this part independent of the Node version. +# And it does not use any NodeJS based testing framework to make this part independent of the Node version. unset npm_config_prefix echo "Handlebars should be able to run in various versions of NodeJS" -for i in 10 11 12 13 ; do +for node_version_to_test in 10 11 12 13 14 15; do + rm target node_modules package-lock.json -rf mkdir target - nvm install "$i" - nvm exec "$i" npm install - nvm exec "$i" npm run test - nvm exec "$i" npm run test-precompile + + nvm install "$node_version_to_test" + nvm exec "$node_version_to_test" npm install + nvm exec "$node_version_to_test" npm run test + nvm exec "$node_version_to_test" npm run test-precompile echo Success done diff --git a/lib/handlebars/base.js b/lib/handlebars/base.js index de4f18d4..a84243f5 100644 --- a/lib/handlebars/base.js +++ b/lib/handlebars/base.js @@ -5,7 +5,7 @@ import { registerDefaultDecorators } from './decorators'; import logger from './logger'; import { resetLoggedProperties } from './internal/proto-access'; -export const VERSION = '4.7.6'; +export const VERSION = '4.7.7'; export const COMPILER_REVISION = 8; export const LAST_COMPATIBLE_COMPILER_REVISION = 7; diff --git a/lib/handlebars/compiler/javascript-compiler.js b/lib/handlebars/compiler/javascript-compiler.js index 47c498e1..f614d0fc 100644 --- a/lib/handlebars/compiler/javascript-compiler.js +++ b/lib/handlebars/compiler/javascript-compiler.js @@ -16,7 +16,12 @@ JavaScriptCompiler.prototype = { return this.internalNameLookup(parent, name); }, depthedLookup: function(name) { - return [this.aliasable('container.lookup'), '(depths, "', name, '")']; + return [ + this.aliasable('container.lookup'), + '(depths, ', + JSON.stringify(name), + ')' + ]; }, compilerInfo: function() { diff --git a/lib/handlebars/runtime.js b/lib/handlebars/runtime.js index eb31bfa5..999f2cb8 100644 --- a/lib/handlebars/runtime.js +++ b/lib/handlebars/runtime.js @@ -121,7 +121,7 @@ export function template(templateSpec, env) { loc: loc }); } - return obj[name]; + return container.lookupProperty(obj, name); }, lookupProperty: function(parent, propertyName) { let result = parent[propertyName]; diff --git a/release-notes.md b/release-notes.md index fa945d3a..cabef32b 100644 --- a/release-notes.md +++ b/release-notes.md @@ -2,7 +2,26 @@ ## Development -[Commits](https://github.com/wycats/handlebars.js/compare/v4.7.6...master) +[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.7...master) + +## v4.7.7 - February 15th, 2021 + +- fix weird error in integration tests - eb860c0 +- fix: check prototype property access in strict-mode (#1736) - b6d3de7 +- fix: escape property names in compat mode (#1736) - f058970 +- refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8 +- chore: start testing on Node.js 12 and 13 - 3789a30 + +(POSSIBLY) BREAKING CHANGES: + +- the changes from version [4.6.0](https://github.com/handlebars-lang/handlebars.js/blob/master/release-notes.md#v460---january-8th-2020) now also apply + in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods + can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties + from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build. + +That is why we only bump the patch version despite mentioning breaking changes. + +[Commits](https://github.com/wycats/handlebars.js/compare/v4.7.6...v4.7.7) ## v4.7.6 - April 3rd, 2020 diff --git a/spec/security.js b/spec/security.js index 25aabeb7..00eb1318 100644 --- a/spec/security.js +++ b/spec/security.js @@ -298,6 +298,10 @@ describe('security issues', function() { checkProtoPropertyAccess({ compat: true }); }); + describe('in strict-mode', function() { + checkProtoPropertyAccess({ strict: true }); + }); + function checkProtoPropertyAccess(compileOptions) { it('should be prohibited by default and log a warning', function() { var spy = sinon.spy(console, 'error'); @@ -396,6 +400,28 @@ describe('security issues', function() { }); }); }); + + describe('escapes template variables', function() { + it('in compat mode', function() { + expectTemplate("{{'a\\b'}}") + .withCompileOptions({ compat: true }) + .withInput({ 'a\\b': 'c' }) + .toCompileTo('c'); + }); + + it('in default mode', function() { + expectTemplate("{{'a\\b'}}") + .withCompileOptions() + .withInput({ 'a\\b': 'c' }) + .toCompileTo('c'); + }); + it('in default mode', function() { + expectTemplate("{{'a\\b'}}") + .withCompileOptions({ strict: true }) + .withInput({ 'a\\b': 'c' }) + .toCompileTo('c'); + }); + }); }); function wrapToAdjustContainer(precompiledTemplateFunction) {