v3.0.8

- hopefully fixing hanging saucelabs build

.gitignore

@@ -10,3 +10,4 @@ node_modules
 *.sublime-workspace
 npm-debug.log
 sauce_connect.log*
+/.idea/

.travis.yml

@@ -13,11 +13,13 @@ env:
   - secure: Nm4AgSfsgNB21kgKrF9Tl7qVZU8YYREhouQunFracTcZZh2NZ2XH5aHuSiXCj88B13Cr/jGbJKsZ4T3QS3wWYtz6lkyVOx3H3iI+TMtqhD9RM3a7A4O+4vVN8IioB2YjhEu0OKjwgX5gp+0uF+pLEi7Hpj6fupD3AbbL5uYcKg8=
 matrix:
   include:
-  - node_js: '0.10'
+  - node_js: '10'
     env:
     - PUBLISH=true
     - secure: pLTzghtVll9yGKJI0AaB0uI8GypfWxLTaIB0ZL8//yN3nAEIKMhf/RRilYTsn/rKj2NUa7vt2edYILi3lttOUlCBOwTc9amiRms1W8Lwr/3IdWPeBLvLuH1zNJRm2lBAwU4LBSqaOwhGaxOQr6KHTnWudhNhgOucxpZfvfI/dFw=
     - secure: yERYCf7AwL11D9uMtacly/THGV8BlzsMmrt+iQVvGA3GaY6QMmfYqf6P6cCH98sH5etd1Y+1e6YrPeMjqI6lyRllT7FptoyOdHulazQe86VQN4sc0EpqMlH088kB7gGjTut9Z+X9ViooT5XEh9WA5jXEI9pXhQJNoIHkWPuwGuY=
+  - node_js: '8'
+  - node_js: '6'
 cache:
   directories:
   - node_modules

CONTRIBUTING.md

@@ -87,6 +87,14 @@ npm test
 
 Handlebars utilizes the [release yeoman generator][generator-release] to perform most release tasks.
 
+Before starting the release, make sure that the `yo`, `generator-release` and `grunt` are installed globally.
+The last release was successfully performed with `yo@2.0.5`, `generator-release@2.6.1` and `grunt@1.0.3` and `node@10.11.0`.
+If the latest versions of the tools don't work you may want to revert to those versions.
+
+```bash
+npm install -g yo generator-release grunt
+```
+
 A full release may be completed with the following:
 
 ```

Gruntfile.js

@@ -161,9 +161,9 @@ module.exports = function(grunt) {
           concurrency: 2,
           browsers: [
             {browserName: 'chrome'},
-            {browserName: 'firefox'},
-            {browserName: 'safari', version: 7, platform: 'OS X 10.9'},
-            {browserName: 'safari', version: 6, platform: 'OS X 10.8'},
+            {browserName: 'firefox', platform: 'Linux'},
+            {browserName: 'safari', version: 9, platform: 'OS X 10.11'},
+            {browserName: 'safari', version: 8, platform: 'OS X 10.10'},
             {browserName: 'internet explorer', version: 11, platform: 'Windows 8.1'},
             {browserName: 'internet explorer', version: 10, platform: 'Windows 8'},
             {browserName: 'internet explorer', version: 9, platform: 'Windows 7'}
@@ -225,7 +225,9 @@ module.exports = function(grunt) {
   grunt.task.loadTasks('tasks');
 
   grunt.registerTask('bench', ['metrics']);
-  grunt.registerTask('sauce', process.env.SAUCE_USERNAME ? ['tests', 'connect', 'saucelabs-mocha'] : []);
+  // remove this comment when saucelabs is working again
+  grunt.registerTask('sauce', process.env.SAUCE_USERNAME ? ['tests' /*, 'connect' , 'saucelabs-mocha' */ ] : []);
+
 
   grunt.registerTask('travis', process.env.PUBLISH ? ['default', 'sauce', 'metrics', 'publish:latest'] : ['default']);
 

README.markdown

@@ -1,4 +1,5 @@
 [![Travis Build Status](https://img.shields.io/travis/wycats/handlebars.js/master.svg)](https://travis-ci.org/wycats/handlebars.js)
+[![Appveyor Build Status](https://ci.appveyor.com/api/projects/status/github/wycats/handlebars.js?branch=master&svg=true)](https://ci.appveyor.com/project/wycats/handlebars-js)
 [![Selenium Test Status](https://saucelabs.com/buildstatus/handlebars)](https://saucelabs.com/u/handlebars)
 
 Handlebars.js

appveyor.yml

@@ -0,0 +1,37 @@
+# Test against these versions of Node.js
+environment:
+  matrix:
+    - nodejs_version: "10"
+
+platform:
+  - x64
+
+# Install scripts (runs after repo cloning)
+install:
+  # Get the latest stable version of Node.js
+  - ps: Install-Product node $env:nodejs_version $env:platform
+  # Clone submodules (mustache spec)
+  - cmd: git submodule update --init --recursive
+  # Install modules
+  - cmd: npm install
+  - cmd: npm install -g grunt-cli
+
+
+# Post-install test scripts
+test_script:
+  # Output useful info for debugging
+  - cmd: node --version
+  - cmd: npm --version
+  # Run tests
+  - cmd: grunt --stack travis
+
+# Don't actually build
+build: off
+
+on_failure:
+  - cmd: 7z a coverage.zip coverage
+  - cmd: appveyor PushArtifact coverage.zip
+
+
+# Set build version format here instead of in the admin panel
+version: "{build}"

components/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "3.0.4",
+  "version": "3.0.8",
   "main": "handlebars.js",
   "dependencies": {}
 }

components/handlebars.js.nuspec

@@ -2,7 +2,7 @@
 <package>
 	<metadata>
 		<id>handlebars.js</id>
-		<version>3.0.4</version>
+		<version>3.0.8</version>
 		<authors>handlebars.js Authors</authors>
 		<licenseUrl>https://github.com/wycats/handlebars.js/blob/master/LICENSE</licenseUrl>
 		<projectUrl>https://github.com/wycats/handlebars.js/</projectUrl>

components/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "handlebars",
+  "version": "3.0.8",
+  "license": "MIT",
+  "jspm": {
+    "main": "handlebars",
+    "shim": {
+      "handlebars": {
+        "exports": "Handlebars"
+      }
+    },
+    "files": [
+      "handlebars.js",
+      "handlebars.runtime.js"
+    ],
+    "buildConfig": {
+      "minify": true
+    }
+  }
+}

lib/handlebars/base.js

@@ -212,7 +212,13 @@ function registerDefaultHelpers(instance) {
   });
 
   instance.registerHelper('lookup', function(obj, field) {
-    return obj && obj[field];
+    if (!obj) {
+      return obj;
+    }
+    if (Utils.dangerousPropertyRegex.test(String(field)) && !Object.prototype.hasOwnProperty.call(obj, field)) {
+      return undefined;
+    }
+    return obj[field];
   });
 }
 

lib/handlebars/compiler/javascript-compiler.js

@@ -1,6 +1,6 @@
 import { COMPILER_REVISION, REVISION_CHANGES } from '../base';
 import Exception from '../exception';
-import {isArray} from '../utils';
+import {isArray, dangerousPropertyRegex} from '../utils';
 import CodeGen from './code-gen';
 
 function Literal(value) {
@@ -13,10 +13,18 @@ JavaScriptCompiler.prototype = {
   // PUBLIC API: You can override these methods in a subclass to provide
   // alternative compiled forms for name lookup and buffering semantics
   nameLookup: function(parent, name /* , type*/) {
-    if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
-      return [parent, '.', name];
-    } else {
-      return [parent, "['", name, "']"];
+    if (dangerousPropertyRegex.test(name)) {
+      const isOwnProperty = [ this.aliasable('Object.prototype.hasOwnProperty'), '.call(', parent, ',', JSON.stringify(name), ')'];
+      return ['(', isOwnProperty, '?', _actualLookup(), ' : undefined)'];
+    }
+    return _actualLookup();
+
+    function _actualLookup() {
+      if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
+        return [parent, '.', name];
+      } else {
+        return [parent, '[', JSON.stringify(name), ']'];
+      }
     }
   },
   depthedLookup: function(name) {

lib/handlebars/exception.js

@@ -19,13 +19,28 @@ function Exception(message, node) {
     this[errorProps[idx]] = tmp[errorProps[idx]];
   }
 
+  /* istanbul ignore else */
   if (Error.captureStackTrace) {
     Error.captureStackTrace(this, Exception);
   }
 
-  if (loc) {
-    this.lineNumber = line;
-    this.column = column;
+  try {
+    if (loc) {
+      this.lineNumber = line;
+
+      // Work around issue under safari where we can't directly set the column value
+      /* istanbul ignore next */
+      if (Object.defineProperty) {
+        Object.defineProperty(this, 'column', {
+          value: column,
+          enumerable: true
+        });
+      } else {
+        this.column = column;
+      }
+    }
+  } catch (nop) {
+    /* Ignore if the browser is very particular */
   }
 }
 

lib/handlebars/utils.js

@@ -4,12 +4,13 @@ const escape = {
   '>': '>',
   '"': '"',
   "'": ''',
-  '`': '`',
-  '=': '='
+  '`': '`'
+  // The "equals-sign" is intentionally excluded from this list
+  // due to semantic-versioning issues (see #1489)
 };
 
-const badChars = /[&<>"'`=]/g,
-      possible = /[&<>"'`=]/;
+const badChars = /[&<>"'`]/g,
+      possible = /[&<>"'`]/;
 
 function escapeChar(chr) {
   return escape[chr];
@@ -100,3 +101,5 @@ export function blockParams(params, ids) {
 export function appendContextPath(contextPath, id) {
   return (contextPath ? contextPath + '.' : '') + id;
 }
+
+export const dangerousPropertyRegex = /^(constructor|__defineGetter__|__defineSetter__|__lookupGetter__|__proto__)$/;

package.json

@@ -1,7 +1,7 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "3.0.4",
+  "version": "3.0.8",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
   "homepage": "http://www.handlebarsjs.com/",
   "keywords": [
@@ -10,6 +10,9 @@
     "template",
     "html"
   ],
+  "publishConfig": {
+    "tag": "legacy"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/wycats/handlebars.js.git"
@@ -29,7 +32,7 @@
   },
   "devDependencies": {
     "async": "^0.9.0",
-    "aws-sdk": "~1.5.0",
+    "aws-sdk": "^2.1.49",
     "babel-loader": "^5.0.0",
     "babel-runtime": "^5.1.10",
     "benchmark": "~1.0",
@@ -46,12 +49,12 @@
     "grunt-contrib-uglify": "0.x",
     "grunt-contrib-watch": "0.x",
     "grunt-eslint": "^11.0.0",
-    "grunt-saucelabs": "8.x",
+    "grunt-saucelabs": "9.x",
     "grunt-webpack": "^1.0.8",
     "istanbul": "^0.3.0",
     "jison": "~0.3.0",
     "keen.io": "0.0.3",
-    "mocha": "~1.20.0",
+    "mocha": "~1.21.5",
     "mustache": "0.x",
     "semver": "^4.0.0",
     "underscore": "^1.5.1",

release-notes.md

@@ -2,7 +2,101 @@
 
 ## Development
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.4...master)
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.8...master)
+
+## v3.0.8 - February 23rd, 2020
+Bugfixes:
+- backport some (but not all) of the security fixes from 4.x - 156061e
+
+Compatibility notes:
+- The properties `__proto__`, `__defineGetter__`, `__defineSetter__` and `__lookupGetter__` 
+  have been added to the list of "dangerous properties". If a property
+  by that name is found and not an own-property of its parent, it will silently evaluate to undefined.
+  This is done in both the compiled template and the "lookup"-helper. This will prevent
+  Remote-Code-Execution exploits that have been published in npm advisories [1324](https://www.npmjs.com/advisories/1324)
+  and [1316](https://www.npmjs.com/advisories/1316).
+- The check for dangerous properties has been changed from "propertyIsEnumerable" to "hasOwnProperty", as it is now done 
+  in Handlebars 4.6.0 and later.
+
+Security issues resolved:
+- [npm advisory 1324](https://www.npmjs.com/advisories/1324)
+- [npm advisory 1316](https://www.npmjs.com/advisories/1316)
+- [npm advisory 1325](https://www.npmjs.com/advisories/1325)
+- [npm advisory 1164](https://www.npmjs.com/advisories/1164)
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.7...v3.0.8)
+
+## v3.0.7 - June 30th, 2019
+Security fixes:
+
+- [#1532](https://github.com/wycats/handlebars.js/pull/1532) - Backport security fixes to 3.x branch ([@mattolson](https://api.github.com/users/mattolson))
+
+Housekeeping
+
+- disable saucelabs-tests since the tunnel is not working - 95f33b1
+- update grunt-saucelabs and aws dependency - 09aaa56
+- fix package.json of components/handlebars.js repo - 7cf753b
+- Fix Travis by updating git tag retrieval - 7c3944015d30a4348ae66ec1736b752cd864d5c1
+- Use istanbul/lib/cli.js instead of node_modules/.bin/istanbul - 7820b207e123babd0bda0b4871790f2ea6b36b01
+
+Tests:
+
+- test: run appveyor tests in Node 10 - 420ac171a01b8777ebce0a777221754fcc72a5a8
+- Fix build on Windows - 47adcda48530ab1504b8019fe17eaedd4f4c943f
+
+
+Compatibility notes:
+
+Access to class constructors (i.e. `({}).constructor`) is now prohibited to prevent
+Remote Code Execution. This means that following construct will no work anymore:
+
+```
+class SomeClass {
+}
+
+SomeClass.staticProperty = 'static'
+
+var template = Handlebars.compile('{{constructor.staticProperty}}');
+document.getElementById('output').innerHTML = template(new SomeClass());
+// expected: 'static', but now this is empty.
+```
+
+This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #1495. We will **not** increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).
+
+
+
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.6...v3.0.7)
+
+## v3.0.6 - January 2nd, 2019
+Chore:
+- prevent tagging 3.x versions as "latest" in npm - df403ed, [#1486](https://github.com/wycats/handlebars.js/issues/1486)
+- ignore idea config - af919d2
+- fix travis build - 9283205
+- update components/handlebars package.json on release - 9679fe6
+- add active NodeJS versions to travis - d207ad0
+
+Fix: 
+- No longer escape "=" in HTML content - 6e9dbac, [#1489](https://github.com/wycats/handlebars.js/issues/1489)
+- gracefully handle read-only "column"-property of the Error class (required in Safari 9+) - 725986d
+
+
+Compatibility notes:
+- Compatibility to 3.0.5 is broken due to reverting to *not* escaping "=" in HTML,
+  but compatibility to 3.0.3 is restored.
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.5...v3.0.6)
+
+## v3.0.5 - December 15th, 2018
+- chore: use node 10.x in travis-build - 4ed0a62
+
+Compatibility notes:
+- no breaking changes
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.4...v3.0.5)
 
 ## v3.0.4 - December 15th, 2018
 - Further relax uglify dependency - 4cd5305

spec/env/browser.js

@@ -4,7 +4,13 @@ var fs = require('fs'),
     vm = require('vm');
 
 global.Handlebars = 'no-conflict';
-vm.runInThisContext(fs.readFileSync(__dirname + '/../../dist/handlebars.js'), 'dist/handlebars.js');
+
+var filename = 'dist/handlebars.js';
+if (global.minimizedTest) {
+  filename = 'dist/handlebars.min.js';
+}
+var distHandlebars = fs.readFileSync(require.resolve(`../../${filename}`), 'utf-8');
+vm.runInThisContext(distHandlebars, filename);
 
 global.CompilerContext = {
   browser: true,

spec/env/common.js

@@ -1,3 +1,21 @@
+var global = (function() { return this; }());
+
+var AssertError;
+if (Error.captureStackTrace) {
+  AssertError = function AssertError(message, caller) {
+    Error.prototype.constructor.call(this, message);
+    this.message = message;
+
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, caller || AssertError);
+    }
+  };
+
+  AssertError.prototype = new Error();
+} else {
+  AssertError = Error;
+}
+
 global.shouldCompileTo = function(string, hashOrArray, expected, message) {
   shouldCompileToWithPartials(string, hashOrArray, false, expected, message);
 };

spec/env/runner.js

@@ -11,7 +11,7 @@ var files = [ testDir + '/basic.js' ];
 
 var files = fs.readdirSync(testDir)
       .filter(function(name) { return (/.*\.js$/).test(name); })
-      .map(function(name) { return testDir + '/' + name; });
+      .map(function(name) { return testDir + path.sep + name; });
 
 run('./node', function() {
   run('./browser', function() {
@@ -27,6 +27,7 @@ run('./node', function() {
 function run(env, callback) {
   var mocha = new Mocha();
   mocha.ui('bdd');
+  mocha.reporter('dot');
   mocha.files = files.slice();
   if (grep) {
     mocha.grep(grep);

spec/security.js

@@ -0,0 +1,49 @@
+describe('security issues', function() {
+    describe('GH-1495: Prevent Remote Code Execution via constructor', function() {
+        it('should not allow constructors to be accessed', function() {
+            shouldCompileTo('{{constructor.name}}', {}, '');
+            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {}, '');
+        });
+
+        it('should allow the "constructor" property to be accessed if it is enumerable', function() {
+            shouldCompileTo('{{constructor.name}}', {'constructor': {
+                'name': 'here we go'
+            }}, 'here we go');
+            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {'constructor': {
+                'name': 'here we go'
+            }}, 'here we go');
+        });
+
+        it('should allow prototype properties that are not constructors', function() {
+            function TestClass() {
+            }
+
+            Object.defineProperty(TestClass.prototype, 'abc', {
+                get: function() {
+                    return 'xyz';
+                }
+            });
+
+            shouldCompileTo('{{#with this}}{{this.abc}}{{/with}}',
+                new TestClass(), 'xyz');
+            shouldCompileTo('{{#with this}}{{lookup this "abc"}}{{/with}}',
+                new TestClass(), 'xyz');
+        });
+    });
+
+    describe('GH-1595', function() {
+        it('properties, that are required to be enumerable', function() {
+            shouldCompileTo('{{constructor.name}}', {}, '');
+            shouldCompileTo('{{__defineGetter__.name}}', {}, '');
+            shouldCompileTo('{{__defineSetter__.name}}', {}, '');
+            shouldCompileTo('{{__lookupGetter__.name}}', {}, '');
+            shouldCompileTo('{{__proto__.__defineGetter__.name}}', {}, '');
+
+            shouldCompileTo('{{lookup this "constructor"}}', {}, '');
+            shouldCompileTo('{{lookup this "__defineGetter__"}}', {}, '');
+            shouldCompileTo('{{lookup this "__defineSetter__"}}', {}, '');
+            shouldCompileTo('{{lookup this "__lookupGetter__"}}', {}, '');
+            shouldCompileTo('{{lookup this "__proto__"}}', {}, '');
+        });
+    });
+});

spec/utils.js

@@ -18,7 +18,9 @@ describe('utils', function() {
   describe('#escapeExpression', function() {
     it('shouhld escape html', function() {
       equals(Handlebars.Utils.escapeExpression('foo<&"\'>'), 'foo&lt;&amp;&quot;&#x27;&gt;');
-      equals(Handlebars.Utils.escapeExpression('foo='), 'foo&#x3D;');
+    });
+    it('should not escape the equals-sign in 3.x (#1489)', function() {
+      equals(Handlebars.Utils.escapeExpression('foo='), 'foo=');
     });
     it('should not escape SafeString', function() {
       var string = new Handlebars.SafeString('foo<&"\'>');

tasks/test.js

@@ -1,11 +1,20 @@
 var childProcess = require('child_process'),
-    fs = require('fs');
+    fs = require('fs'),
+    os = require('os');
 
 module.exports = function(grunt) {
   grunt.registerTask('test:bin', function() {
     var done = this.async();
 
-    childProcess.exec('./bin/handlebars -a spec/artifacts/empty.handlebars', function(err, stdout) {
+    var cmd = './bin/handlebars';
+    var args = [ '-a', 'spec/artifacts/empty.handlebars' ];
+
+    // On Windows, the executable handlebars.js file cannot be run directly
+    if (os.platform() === 'win32') {
+      args.unshift(cmd);
+      cmd = process.argv[0];
+    }
+    childProcess.execFile(cmd, args, function(err, stdout) {
       if (err) {
         throw err;
       }
@@ -32,7 +41,7 @@ module.exports = function(grunt) {
   grunt.registerTask('test:cov', function() {
     var done = this.async();
 
-    var runner = childProcess.fork('node_modules/.bin/istanbul', ['cover', '--', './spec/env/runner.js'], {stdio: 'inherit'});
+    var runner = childProcess.fork('node_modules/istanbul/lib/cli.js', ['cover', '--source-map', '--', './spec/env/runner.js'], {stdio: 'inherit'});
     runner.on('close', function(code) {
       if (code != 0) {
         grunt.fatal(code + ' tests failed');

tasks/util/git.js

@@ -86,7 +86,7 @@ module.exports = {
     });
   },
   tagName: function(callback) {
-    childProcess.exec('git describe --tags', {}, function(err, stdout) {
+    childProcess.exec('git describe --tags --always', {}, function(err, stdout) {
       if (err) {
         throw new Error('git.tagName: ' + err.message);
       }

tasks/version.js

@@ -20,6 +20,7 @@ module.exports = function(grunt) {
     async.each([
         ['lib/handlebars/base.js', /var VERSION = ['"](.*)['"];/, 'var VERSION = "' + version + '";'],
         ['components/bower.json', /"version":.*/, '"version": "' + version + '",'],
+        ['components/package.json', /"version":.*/, '"version": "' + version + '",'],
         ['components/handlebars.js.nuspec', /<version>.*<\/version>/, '<version>' + version + '</version>']
       ],
       function(args, callback) {