v4.3.4

- "container" is an internal object that is most likely
  not accessible through templateing (unlike the proto of "Object", which might be.)
  In order to prevent overriding this method, we
  use "propertyIsEnumerable" from the constructor.

components/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "4.3.2",
+  "version": "4.3.4",
   "main": "handlebars.js",
   "license": "MIT",
   "dependencies": {}

components/handlebars.js.nuspec

@@ -2,7 +2,7 @@
 <package>
 	<metadata>
 		<id>handlebars.js</id>
-		<version>4.3.2</version>
+		<version>4.3.4</version>
 		<authors>handlebars.js Authors</authors>
 		<licenseUrl>https://github.com/wycats/handlebars.js/blob/master/LICENSE</licenseUrl>
 		<projectUrl>https://github.com/wycats/handlebars.js/</projectUrl>

components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "4.3.2",
+  "version": "4.3.4",
   "license": "MIT",
   "jspm": {
     "main": "handlebars",

lib/handlebars/base.js

@@ -4,7 +4,7 @@ import {registerDefaultHelpers} from './helpers';
 import {registerDefaultDecorators} from './decorators';
 import logger from './logger';
 
-export const VERSION = '4.3.2';
+export const VERSION = '4.3.4';
 export const COMPILER_REVISION = 8;
 export const LAST_COMPATIBLE_COMPILER_REVISION = 7;
 

lib/handlebars/compiler/javascript-compiler.js

@@ -13,15 +13,13 @@ JavaScriptCompiler.prototype = {
   // PUBLIC API: You can override these methods in a subclass to provide
   // alternative compiled forms for name lookup and buffering semantics
   nameLookup: function(parent, name/* , type*/) {
+    const isEnumerable = [ this.aliasable('container.propertyIsEnumerable'), '.call(', parent, ',"constructor")'];
+
     if (name === 'constructor') {
-      return ['(', _isEnumerable(), '?', _actualLookup(), ' : undefined)'];
+      return ['(', isEnumerable, '?', _actualLookup(), ' : undefined)'];
     }
     return _actualLookup();
 
-    function _isEnumerable() {
-      return `Object.prototype.propertyIsEnumerable.call(${parent},'constructor')`;
-    }
-
     function _actualLookup() {
       if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
         return [parent, '.', name];
@@ -222,7 +220,6 @@ JavaScriptCompiler.prototype = {
     let aliasCount = 0;
     for (let alias in this.aliases) { // eslint-disable-line guard-for-in
       let node = this.aliases[alias];
-
       if (this.aliases.hasOwnProperty(alias) && node.children && node.referenceCount > 1) {
         varDeclarations += ', alias' + (++aliasCount) + '=' + alias;
         node.children[0] = 'alias' + aliasCount;

package.json

@@ -1,7 +1,7 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "4.3.2",
+  "version": "4.3.4",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
   "homepage": "http://www.handlebarsjs.com/",
   "keywords": [

release-notes.md

@@ -2,7 +2,21 @@
 
 ## Development
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.2...master)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.4...master)
+
+## v4.3.4 - September 28th, 2019
+- fix: harden "propertyIsEnumerable"-check - ff4d827
+
+Compatibility notes:
+- No incompatibilities are known.
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.3...v4.3.4)
+
+## v4.3.3 - September 27th, 2019
+ - fix test case for browsers that do not support __defineGetter__ - 8742bde
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.2...v4.3.3)
 
 ## v4.3.2 - September 26th, 2019
 - Use Object.prototype.propertyIsEnumerable to check for constructors - 213c0bb, #1563

spec/security.js

@@ -91,6 +91,9 @@ describe('security issues', function() {
 
     describe('GH-1563', function() {
         it('should not allow to access constructor after overriding via __defineGetter__', function() {
+            if (({}).__defineGetter__ == null || ({}).__lookupGetter__ == null) {
+                return; // Browser does not support this exploit anyway
+            }
             shouldCompileTo('{{__defineGetter__ "undefined" valueOf }}' +
                 '{{#with __lookupGetter__ }}' +
                 '{{__defineGetter__ "propertyIsEnumerable" (this.bind (this.bind 1)) }}' +