v4.0.14

- The "lookup" helper could also be used to run a remote code execution
  by manipulating the template. The same check as for regular
  path queries now also is done in the "lookup"-helper

.gitignore

@@ -10,5 +10,6 @@ node_modules
 *.sublime-workspace
 npm-debug.log
 sauce_connect.log*
-.idea
-yarn-error.log
+/.idea/
+/*.iml
+/yarn-error-log

CONTRIBUTING.md

@@ -81,9 +81,7 @@ npm link handlebars
 npm test
 ```
 
-## Releasing the latest version
-
-*When releasing a previous version of Handlebars, please look into the CONTRIBUNG.md in the corresponding branch.*
+## Releasing
 
 Handlebars utilizes the [release yeoman generator][generator-release] to perform most release tasks.
 
@@ -99,15 +97,7 @@ gem build handlebars-source.gemspec
 gem push handlebars-source-*.gem
 ```
 
-After the release, you should check that all places have really been updated. Especially verify that the `latest`-tags
-in those places still point to the latest version
-
-* [The npm-package](https://www.npmjs.com/package/handlebars) (check latest-tag)
-* [The bower package](https://github.com/components/handlebars.js) (check the package.json)
-* [The AWS S3 Bucket](http://builds.handlebarsjs.com.s3.amazonaws.com/) (check latest-tag)
-* [RubyGems](https://rubygems.org/gems/handlebars-source)
-
-When everything is OK, the handlebars site needs to be updated to point to the new version numbers. The jsfiddle link should be updated to point to the most recent distribution for all instances in our documentation.
+After this point the handlebars site needs to be updated to point to the new version numbers. The jsfiddle link should be updated to point to the most recent distribution for all instances in our documentation.
 
 [generator-release]: https://github.com/walmartlabs/generator-release
 [pull-request]: https://github.com/wycats/handlebars.js/pull/new/master

Gruntfile.js

@@ -166,8 +166,8 @@ module.exports = function(grunt) {
           browsers: [
             {browserName: 'chrome'},
             {browserName: 'firefox', platform: 'Linux'},
-            {browserName: 'safari', version: 9, platform: 'OS X 10.11'},
-            {browserName: 'safari', version: 8, platform: 'OS X 10.10'},
+            // {browserName: 'safari', version: 9, platform: 'OS X 10.11'},
+            // {browserName: 'safari', version: 8, platform: 'OS X 10.10'},
             {browserName: 'internet explorer', version: 11, platform: 'Windows 8.1'},
             {browserName: 'internet explorer', version: 10, platform: 'Windows 8'}
           ]

appveyor.yml

@@ -1,8 +1,7 @@
 # Test against these versions of Node.js
 environment:
   matrix:
-    - nodejs_version: "4"
-    - nodejs_version: "5"
+    - nodejs_version: "10"
 
 platform:
   - x64

components/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "4.0.12",
+  "version": "4.0.14",
   "main": "handlebars.js",
   "license": "MIT",
   "dependencies": {}

components/handlebars.js.nuspec

@@ -2,7 +2,7 @@
 <package>
 	<metadata>
 		<id>handlebars.js</id>
-		<version>4.0.12</version>
+		<version>4.0.14</version>
 		<authors>handlebars.js Authors</authors>
 		<licenseUrl>https://github.com/wycats/handlebars.js/blob/master/LICENSE</licenseUrl>
 		<projectUrl>https://github.com/wycats/handlebars.js/</projectUrl>

components/package.json

@@ -1,6 +1,5 @@
 {
-  "name": "handlebars",
-  "version": "4.0.12",
+  "version": "4.0.11",
   "license": "MIT",
   "jspm": {
     "main": "handlebars",

lib/handlebars.d.ts

@@ -1,356 +0,0 @@
-/* These definitions were imported from https://github.com/DefinitelyTyped/DefinitelyTyped
- * and includes previous contributions from the DefinitelyTyped community by:
- *   - Albert Willemsen <https://github.com/AlbertWillemsen-Centric>
- *   - Boris Yankov <https://github.com/borisyankov>
- *   - Jessica Franco <https://github.com/Kovensky>
- *   - Masahiro Wakame <https://github.com/vvakame>
- *   - Raanan Weber <https://github.com/RaananW>
- *   - Sergei Dorogin <https://github.com/evil-shrike>
- *   - webbiesdk <https://github.com/webbiesdk>
- * For full history prior to their migration to handlebars.js, please see:
- * https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/handlebars
- */
-
-declare namespace Handlebars {
-  export interface TemplateDelegate<T = any> {
-      (context: T, options?: RuntimeOptions): string;
-  }
-
-  export type Template<T = any> = TemplateDelegate<T>|string;
-
-  export interface RuntimeOptions {
-      partial?: boolean;
-      depths?: any[];
-      helpers?: { [name: string]: Function };
-      partials?: { [name: string]: HandlebarsTemplateDelegate };
-      decorators?: { [name: string]: Function };
-      data?: any;
-      blockParams?: any[];
-  }
-
-  export interface HelperOptions {
-      fn: TemplateDelegate;
-      inverse: TemplateDelegate;
-      hash: any;
-      data?: any;
-  }
-
-  export interface HelperDelegate {
-      (context?: any, arg1?: any, arg2?: any, arg3?: any, arg4?: any, arg5?: any, options?: HelperOptions): any;
-  }
-  export interface HelperDeclareSpec {
-      [key: string]: HelperDelegate;
-  }
-
-  export interface ParseOptions {
-      srcName?: string,
-      ignoreStandalone?: boolean
-  }
-
-  export function registerHelper(name: string, fn: HelperDelegate): void;
-  export function registerHelper(name: HelperDeclareSpec): void;
-  export function unregisterHelper(name: string): void;
-
-  export function registerPartial(name: string, fn: Template): void;
-  export function registerPartial(spec: { [name: string]: HandlebarsTemplateDelegate }): void;
-  export function unregisterPartial(name: string): void;
-
-  // TODO: replace Function with actual signature
-  export function registerDecorator(name: string, fn: Function): void;
-  export function unregisterDecorator(name: string): void;
-
-  export function K(): void;
-  export function createFrame(object: any): any;
-  export function blockParams(obj: any[], ids: any[]): any[];
-  export function Exception(message: string): void;
-  export function log(level: number, obj: any): void;
-  export function parse(input: string, options?: ParseOptions): hbs.AST.Program;
-  export function compile<T = any>(input: any, options?: CompileOptions): HandlebarsTemplateDelegate<T>;
-  export function precompile(input: any, options?: PrecompileOptions): TemplateSpecification;
-  export function template<T = any>(precompilation: TemplateSpecification): HandlebarsTemplateDelegate<T>;
-
-  export function create(): typeof Handlebars;
-
-  export const escapeExpression: typeof Utils.escapeExpression;
-  //export const Utils: typeof hbs.Utils;
-  export const logger: Logger;
-  export const templates: HandlebarsTemplates;
-  export const helpers: { [name: string]: HelperDelegate };
-  export const partials: { [name: string]: any };
-  // TODO: replace Function with actual signature
-  export const decorators: { [name: string]: Function };
-
-  export function noConflict(): typeof Handlebars;
-
-  export class SafeString {
-      constructor(str: string);
-      toString(): string;
-      toHTML(): string;
-  }
-
-  export namespace Utils {
-      export function escapeExpression(str: string): string;
-      export function createFrame(object: any): any;
-      export function blockParams(obj: any[], ids: any[]): any[];
-      export function isEmpty(obj: any) : boolean;
-      export function extend(obj: any, ...source: any[]): any;
-      export function toString(obj: any): string;
-      export function isArray(obj: any): boolean;
-      export function isFunction(obj: any): boolean;
-  }
-
-  export namespace AST {
-      export const helpers: hbs.AST.helpers;
-  }
-
-  interface ICompiler {
-      accept(node: hbs.AST.Node): void;
-      Program(program: hbs.AST.Program): void;
-      BlockStatement(block: hbs.AST.BlockStatement): void;
-      PartialStatement(partial: hbs.AST.PartialStatement): void;
-      PartialBlockStatement(partial: hbs.AST.PartialBlockStatement): void;
-      DecoratorBlock(decorator: hbs.AST.DecoratorBlock): void;
-      Decorator(decorator: hbs.AST.Decorator): void;
-      MustacheStatement(mustache: hbs.AST.MustacheStatement): void;
-      ContentStatement(content: hbs.AST.ContentStatement): void;
-      CommentStatement(comment?: hbs.AST.CommentStatement): void;
-      SubExpression(sexpr: hbs.AST.SubExpression): void;
-      PathExpression(path: hbs.AST.PathExpression): void;
-      StringLiteral(str: hbs.AST.StringLiteral): void;
-      NumberLiteral(num: hbs.AST.NumberLiteral): void;
-      BooleanLiteral(bool: hbs.AST.BooleanLiteral): void;
-      UndefinedLiteral(): void;
-      NullLiteral(): void;
-      Hash(hash: hbs.AST.Hash): void;
-  }
-
-  export class Visitor implements ICompiler {
-      accept(node: hbs.AST.Node): void;
-      acceptKey(node: hbs.AST.Node, name: string): void;
-      acceptArray(arr: hbs.AST.Expression[]): void;
-      Program(program: hbs.AST.Program): void;
-      BlockStatement(block: hbs.AST.BlockStatement): void;
-      PartialStatement(partial: hbs.AST.PartialStatement): void;
-      PartialBlockStatement(partial: hbs.AST.PartialBlockStatement): void;
-      DecoratorBlock(decorator: hbs.AST.DecoratorBlock): void;
-      Decorator(decorator: hbs.AST.Decorator): void;
-      MustacheStatement(mustache: hbs.AST.MustacheStatement): void;
-      ContentStatement(content: hbs.AST.ContentStatement): void;
-      CommentStatement(comment?: hbs.AST.CommentStatement): void;
-      SubExpression(sexpr: hbs.AST.SubExpression): void;
-      PathExpression(path: hbs.AST.PathExpression): void;
-      StringLiteral(str: hbs.AST.StringLiteral): void;
-      NumberLiteral(num: hbs.AST.NumberLiteral): void;
-      BooleanLiteral(bool: hbs.AST.BooleanLiteral): void;
-      UndefinedLiteral(): void;
-      NullLiteral(): void;
-      Hash(hash: hbs.AST.Hash): void;
-  }
-}
-
-/**
-* Implement this interface on your MVW/MVVM/MVC views such as Backbone.View
-**/
-interface HandlebarsTemplatable {
-  template: HandlebarsTemplateDelegate;
-}
-
-// NOTE: for backward compatibility of this typing
-type HandlebarsTemplateDelegate<T = any> = Handlebars.TemplateDelegate<T>;
-
-interface HandlebarsTemplates {
-  [index: string]: HandlebarsTemplateDelegate;
-}
-
-interface TemplateSpecification {
-
-}
-
-// for backward compatibility of this typing
-type RuntimeOptions = Handlebars.RuntimeOptions;
-
-interface CompileOptions {
-  data?: boolean;
-  compat?: boolean;
-  knownHelpers?: {
-      helperMissing?: boolean;
-      blockHelperMissing?: boolean;
-      each?: boolean;
-      if?: boolean;
-      unless?: boolean;
-      with?: boolean;
-      log?: boolean;
-      lookup?: boolean;
-  };
-  knownHelpersOnly?: boolean;
-  noEscape?: boolean;
-  strict?: boolean;
-  assumeObjects?: boolean;
-  preventIndent?: boolean;
-  ignoreStandalone?: boolean;
-  explicitPartialContext?: boolean;
-}
-
-interface PrecompileOptions extends CompileOptions {
-  srcName?: string;
-  destName?: string;
-}
-
-declare namespace hbs {
-  // for backward compatibility of this typing
-  type SafeString = Handlebars.SafeString;
-
-  type Utils = typeof Handlebars.Utils;
-}
-
-interface Logger {
-  DEBUG: number;
-  INFO: number;
-  WARN: number;
-  ERROR: number;
-  level: number;
-
-  methodMap: { [level: number]: string };
-
-  log(level: number, obj: string): void;
-}
-
-declare namespace hbs {
-  namespace AST {
-      interface Node {
-          type: string;
-          loc: SourceLocation;
-      }
-
-      interface SourceLocation {
-          source: string;
-          start: Position;
-          end: Position;
-      }
-
-      interface Position {
-          line: number;
-          column: number;
-      }
-
-      interface Program extends Node {
-          body: Statement[];
-          blockParams: string[];
-      }
-
-      interface Statement extends Node {}
-
-      interface MustacheStatement extends Statement {
-          path: PathExpression | Literal;
-          params: Expression[];
-          hash: Hash;
-          escaped: boolean;
-          strip: StripFlags;
-      }
-
-      interface Decorator extends MustacheStatement { }
-
-      interface BlockStatement extends Statement {
-          path: PathExpression;
-          params: Expression[];
-          hash: Hash;
-          program: Program;
-          inverse: Program;
-          openStrip: StripFlags;
-          inverseStrip: StripFlags;
-          closeStrip: StripFlags;
-      }
-
-      interface DecoratorBlock extends BlockStatement { }
-
-      interface PartialStatement extends Statement {
-          name: PathExpression | SubExpression;
-          params: Expression[];
-          hash: Hash;
-          indent: string;
-          strip: StripFlags;
-      }
-
-      interface PartialBlockStatement extends Statement {
-          name: PathExpression | SubExpression;
-          params: Expression[];
-          hash: Hash;
-          program: Program;
-          openStrip: StripFlags;
-          closeStrip: StripFlags;
-      }
-
-      interface ContentStatement extends Statement {
-          value: string;
-          original: StripFlags;
-      }
-
-      interface CommentStatement extends Statement {
-          value: string;
-          strip: StripFlags;
-      }
-
-      interface Expression extends Node {}
-
-      interface SubExpression extends Expression {
-          path: PathExpression;
-          params: Expression[];
-          hash: Hash;
-      }
-
-      interface PathExpression extends Expression {
-          data: boolean;
-          depth: number;
-          parts: string[];
-          original: string;
-      }
-
-      interface Literal extends Expression {}
-      interface StringLiteral extends Literal {
-          value: string;
-          original: string;
-      }
-
-      interface BooleanLiteral extends Literal {
-          value: boolean;
-          original: boolean;
-      }
-
-      interface NumberLiteral extends Literal {
-          value: number;
-          original: number;
-      }
-
-      interface UndefinedLiteral extends Literal {}
-
-      interface NullLiteral extends Literal {}
-
-      interface Hash extends Node {
-          pairs: HashPair[];
-      }
-
-      interface HashPair extends Node {
-          key: string;
-          value: Expression;
-      }
-
-      interface StripFlags {
-          open: boolean;
-          close: boolean;
-      }
-
-      interface helpers {
-          helperExpression(node: Node): boolean;
-          scopeId(path: PathExpression): boolean;
-          simpleId(path: PathExpression): boolean;
-      }
-  }
-}
-
-declare module "handlebars" {
-  export = Handlebars;
-}
-
-declare module "handlebars/runtime" {
-  export = Handlebars;
-}

lib/handlebars/base.js

@@ -4,7 +4,7 @@ import {registerDefaultHelpers} from './helpers';
 import {registerDefaultDecorators} from './decorators';
 import logger from './logger';
 
-export const VERSION = '4.0.12';
+export const VERSION = '4.0.14';
 export const COMPILER_REVISION = 7;
 
 export const REVISION_CHANGES = {

lib/handlebars/helpers/lookup.js

@@ -1,5 +1,11 @@
 export default function(instance) {
   instance.registerHelper('lookup', function(obj, field) {
-    return obj && obj[field];
+    if (!obj) {
+      return obj;
+    }
+    if (field === 'constructor' && !obj.propertyIsEnumerable(field)) {
+      return undefined;
+    }
+    return obj[field];
   });
 }

package.json

@@ -1,7 +1,7 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "4.0.13-0",
+  "version": "4.0.14",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
   "homepage": "http://www.handlebarsjs.com/",
   "keywords": [
@@ -10,6 +10,9 @@
     "template",
     "html"
   ],
+  "publishConfig": {
+    "tag": "4.0-patch"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/wycats/handlebars.js.git"
@@ -59,7 +62,6 @@
     "webpack-dev-server": "^1.12.1"
   },
   "main": "lib/index.js",
-  "types": "lib/handlebars.d.ts",
   "bin": {
     "handlebars": "bin/handlebars"
   },

release-notes.md

@@ -2,7 +2,65 @@
 
 ## Development
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...master)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.14...master)
+
+## v4.0.14 - April 13th, 2019
+Chore/Test:
+- test: remove safari from saucelabs - 871accc
+
+Bugfixes: 
+- fix: prevent RCE through the "lookup"-helper - cd38583
+
+Compatibility notes:
+
+Access to the constructor of a class thought `{{lookup obj "constructor" }}` is now prohibited. This closes 
+a leak that only half closed in versions 4.0.13 and 4.1.0, but it is a slight incompatibility.
+
+This kind of access is not the intended use of Handlebars and leads to the vulnerability described
+in #1495. We will **not** increase the major version, because such use is not intended or documented, 
+and because of the potential impact of the issue (we fear that most people won't use a new major version
+and the issue may not be resolved on many systems). 
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.13...v4.0.14)
+
+## v4.0.13 - February 7th, 2019
+New Features
+
+- none
+
+Security fixes:
+
+- disallow access to the constructor in templates to prevent RCE - 42841c4, #1495
+
+Housekeeping
+
+- chore: fix components/handlebars package.json and auto-update on release - bacd473
+- chore: Use node 10 to build handlebars - 78dd89c
+
+Compatibility notes:
+
+Access to class constructors (i.e. `({}).constructor`) is now prohibited to prevent
+Remote Code Execution. This means that following construct will no work anymore:
+
+```
+class SomeClass {
+}
+
+SomeClass.staticProperty = 'static'
+
+var template = Handlebars.compile('{{constructor.staticProperty}}');
+document.getElementById('output').innerHTML = template(new SomeClass());
+// expected: 'static', but now this is empty.
+```
+
+This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #1495. We will **not** increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).
+
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...v4.1.0)
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...v4.0.13)
 
 ## v4.0.12 - September 4th, 2018
 New features:

spec/security.js

@@ -1,22 +1,35 @@
 describe('security issues', function() {
+    describe('GH-1495: Prevent Remote Code Execution via constructor', function() {
+        it('should not allow constructors to be accessed', function() {
+            shouldCompileTo('{{constructor.name}}', {}, '');
+            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {}, '');
+        });
 
-    it('should not allow constructors to be accessed', function() {
-        shouldCompileTo('{{#with this as |obj|}}{{obj.constructor.name}}{{/with}}', {}, '');
-    });
+        it('should allow the "constructor" property to be accessed if it is enumerable', function() {
+            shouldCompileTo('{{constructor.name}}', {'constructor': {
+                'name': 'here we go'
+            }}, 'here we go');
+            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {'constructor': {
+                'name': 'here we go'
+            }}, 'here we go');
+        });
 
-    it('should allow the "constructor" property to be accessed if it is enumerable', function() {
-        shouldCompileTo('{{constructor.name}}', {'constructor': {
-            'name': 'here we go'
-        }}, 'here we go');
-    });
-
-    it('should allow prototype properties that are not constructors', function() {
-        class TestClass {
-            get abc() {
-                return 'xyz';
+        it('should allow prototype properties that are not constructors', function() {
+            function TestClass() {
             }
-        }
-        shouldCompileTo('{{#with this as |obj|}}{{obj.abc}}{{/with}}',
-            new TestClass(), 'xyz');
+
+            Object.defineProperty(TestClass.prototype, 'abc', {
+                get: function() {
+                    return 'xyz';
+                }
+
+            });
+
+            shouldCompileTo('{{#with this as |obj|}}{{obj.abc}}{{/with}}',
+                new TestClass(), 'xyz');
+            shouldCompileTo('{{#with this as |obj|}}{{lookup obj "abc"}}{{/with}}',
+                new TestClass(), 'xyz');
+
+        });
     });
 });

tasks/version.js

@@ -20,7 +20,6 @@ module.exports = function(grunt) {
     async.each([
         ['lib/handlebars/base.js', (/const VERSION = ['"](.*)['"];/), 'const VERSION = \'' + version + '\';'],
         ['components/bower.json', (/"version":.*/), '"version": "' + version + '",'],
-        ['components/package.json', /"version":.*/, '"version": "' + version + '",'],
         ['components/handlebars.js.nuspec', (/<version>.*<\/version>/), '<version>' + version + '</version>']
       ],
       function(args, callback) {