3 Commits

Author	SHA1	Message	Date
Nils Knappmeier	85c8783b34	fix: prevent RCE through the "lookup"-helper ... - The "lookup" helper could also be used to run a remote code execution by manipulating the template. The same check as for regular path queries now also is done in the "lookup"-helper	2019-04-13 16:22:01 +02:00
Nils Knappmeier	5f47c4a682	test: make security testcase internet explorer compatible ... Internet Explorer does not support the 'class Testclass {}' notation, and tests are not compiled using babel. closes #1497	2019-03-15 23:06:50 +01:00
Nils Knappmeier	7372d4e9df	fix: disallow access to the constructor in templates to prevent RCE ... This commit fixes a Remote Code Execution (RCE) reported by npm-security. Access to non-enumerable "constructor"-properties is now prohibited by the compiled template-code, because this the first step on the way to creating and execution arbitrary JavaScript code. The vulnerability affects systems where an attacker is allowed to inject templates into the Handlebars setup. Further details of the attack may be disclosed by npm-security. Closes #1267 Closes #1495	2019-02-07 11:19:54 +01:00