4.0.13-beta.0

This closes a major security leak that allows execution of arbitrary
code in a NodeJS environment by creating a special Handlebars template.

.gitignore

@@ -10,3 +10,5 @@ node_modules
 *.sublime-workspace
 npm-debug.log
 sauce_connect.log*
+.idea
+yarn-error.log

lib/handlebars/compiler/javascript-compiler.js

@@ -13,6 +13,9 @@ JavaScriptCompiler.prototype = {
   // PUBLIC API: You can override these methods in a subclass to provide
   // alternative compiled forms for name lookup and buffering semantics
   nameLookup: function(parent, name/* , type*/) {
+    if (name === 'constructor') {
+      return ['(', parent, '.propertyIsEnumerable(\'constructor\') ? ', parent, '.constructor : undefined', ')'];
+    }
     if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
       return [parent, '.', name];
     } else {

package.json

@@ -1,7 +1,7 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "4.0.12",
+  "version": "4.0.13-beta.0",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
   "homepage": "http://www.handlebarsjs.com/",
   "keywords": [

spec/security.js

@@ -0,0 +1,22 @@
+describe('security issues', function() {
+
+    it('should not allow constructors to be accessed', function() {
+        shouldCompileTo('{{#with this as |obj|}}{{obj.constructor.name}}{{/with}}', {}, '');
+    });
+
+    it('should allow the "constructor" property to be accessed if it is enumerable', function() {
+        shouldCompileTo('{{constructor.name}}', {'constructor': {
+            'name': 'here we go'
+        }}, 'here we go');
+    });
+
+    it('should allow prototype properties that are not constructors', function() {
+        class TestClass {
+            get abc() {
+                return 'xyz';
+            }
+        }
+        shouldCompileTo('{{#with this as |obj|}}{{obj.abc}}{{/with}}',
+            new TestClass(), 'xyz');
+    });
+});