2 Commits

Author	SHA1	Message	Date
Nils Knappmeier	7840ab66a5	test: make security testcase internet explorer compatible ... Internet Explorer does not support the 'class Testclass {}' notation, and tests are not compiled using babel. closes #1497	2019-03-15 23:01:49 +01:00
Nils Knappmeier	42841c41a4	fix: disallow access to the constructor in templates to prevent RCE ... This commit fixes a Remote Code Execution (RCE) reported by npm-security. Access to non-enumerable "constructor"-properties is now prohibited by the compiled template-code, because this the first step on the way to creating and execution arbitrary JavaScript code. The vulnerability affects systems where an attacker is allowed to inject templates into the Handlebars setup. Further details of the attack may be disclosed by npm-security. Closes #1267 Closes #1495	2019-02-07 10:19:53 +01:00