6 Commits

Author	SHA1	Message	Date
Nils Knappmeier	8742bde701	fix test case for browsers that do not support __defineGetter__	2019-09-27 00:09:04 +02:00
Nils Knappmeier	213c0bbe3c	Use Object.prototype.propertyIsEnumerable to check for constructors ... - context.propertyIsEnumerable can be replaced via __definedGetter__ - This is a fix specific to counter a known RCE exploit. Other fixes will follow. closes #1563	2019-09-26 23:55:24 +02:00
Nils Knappmeier	2078c727c6	Disallow calling "helperMissing" and "blockHelperMissing" directly ... closes #1558	2019-09-24 07:31:19 +02:00
Nils Knappmeier	cd38583216	fix: prevent RCE through the "lookup"-helper ... - The "lookup" helper could also be used to run a remote code execution by manipulating the template. The same check as for regular path queries now also is done in the "lookup"-helper	2019-04-11 23:08:57 +02:00
Nils Knappmeier	7840ab66a5	test: make security testcase internet explorer compatible ... Internet Explorer does not support the 'class Testclass {}' notation, and tests are not compiled using babel. closes #1497	2019-03-15 23:01:49 +01:00
Nils Knappmeier	42841c41a4	fix: disallow access to the constructor in templates to prevent RCE ... This commit fixes a Remote Code Execution (RCE) reported by npm-security. Access to non-enumerable "constructor"-properties is now prohibited by the compiled template-code, because this the first step on the way to creating and execution arbitrary JavaScript code. The vulnerability affects systems where an attacker is allowed to inject templates into the Handlebars setup. Further details of the attack may be disclosed by npm-security. Closes #1267 Closes #1495	2019-02-07 10:19:53 +01:00