some minor refactorings

- compatible to older-babel versions with broken default exports
- otherwise "import * as Handlebars from 'handlebars'" will not work.

.eslintignore

@@ -0,0 +1,2 @@
+dist
+node_modules

.eslintrc.js

@@ -1,7 +1,8 @@
 module.exports = {
   "extends": ["eslint:recommended","plugin:compat/recommended"],
   "globals": {
-    "self": false
+    "self": false,
+    "SOURCE_MAPS": true
   },
   "env": {
     "node": true,
@@ -57,6 +58,7 @@ module.exports = {
     "no-with": "error",
     "radix": "error",
     "wrap-iife": "error",
+    "no-prototype-builtins": "error",
 
 
     // Variables //
@@ -114,4 +116,4 @@ module.exports = {
     "ecmaVersion": 6,
     "ecmaFeatures": {}
   }
-}
+};

Gruntfile.js

@@ -43,16 +43,17 @@ module.exports = function(grunt) {
         ]
       }
     },
-
+    webpack: {
+      build: require('./webpack.config')
+    },
     babel: {
       options: {
         sourceMaps: 'inline',
-        loose: ['es6.modules'],
         auxiliaryCommentBefore: 'istanbul ignore next'
       },
       amd: {
         options: {
-          modules: 'amd'
+          plugins: ['@babel/plugin-transform-modules-amd']
         },
         files: [{
           expand: true,
@@ -64,7 +65,11 @@ module.exports = function(grunt) {
 
       cjs: {
         options: {
-          modules: 'common'
+          plugins: [
+            '@babel/plugin-transform-modules-commonjs',
+            // support "import * as Handlebars" for backward-compatibility
+            'babel-plugin-add-module-exports'
+          ]
         },
         files: [{
           cwd: 'lib/',
@@ -74,72 +79,6 @@ module.exports = function(grunt) {
         }]
       }
     },
-    webpack: {
-      options: {
-        context: __dirname,
-        module: {
-          loaders: [
-            // the optional 'runtime' transformer tells babel to require the runtime instead of inlining it.
-            { test: /\.jsx?$/, exclude: /node_modules/, loader: 'babel-loader?optional=runtime&loose=es6.modules&auxiliaryCommentBefore=istanbul%20ignore%20next' }
-          ]
-        },
-        output: {
-          path: 'dist/',
-          library: 'Handlebars',
-          libraryTarget: 'umd'
-        }
-      },
-      handlebars: {
-        entry: './lib/handlebars.js',
-        output: {
-          filename: 'handlebars.js'
-        }
-      },
-      runtime: {
-        entry: './lib/handlebars.runtime.js',
-        output: {
-          filename: 'handlebars.runtime.js'
-        }
-      }
-    },
-
-    requirejs: {
-      options: {
-        optimize: 'none',
-        baseUrl: 'dist/amd/'
-      },
-      dist: {
-        options: {
-          name: 'handlebars',
-          out: 'dist/handlebars.amd.js'
-        }
-      },
-      runtime: {
-        options: {
-          name: 'handlebars.runtime',
-          out: 'dist/handlebars.runtime.amd.js'
-        }
-      }
-    },
-
-    uglify: {
-      options: {
-        mangle: true,
-        compress: true,
-        preserveComments: /(?:^!|@(?:license|preserve|cc_on))/
-      },
-      dist: {
-        files: [{
-          cwd: 'dist/',
-          expand: true,
-          src: ['handlebars*.js', '!*.min.js'],
-          dest: 'dist/',
-          rename: function(dest, src) {
-            return dest + src.replace(/\.js$/, '.min.js');
-          }
-        }]
-      }
-    },
 
     concat: {
       tests: {
@@ -221,20 +160,18 @@ module.exports = function(grunt) {
                     'node',
                     'globals']);
 
-  this.registerTask('amd', ['babel:amd', 'requirejs']);
+  this.registerTask('amd', ['babel:amd']);
   this.registerTask('node', ['babel:cjs']);
   this.registerTask('globals', ['webpack']);
   this.registerTask('tests', ['concat:tests']);
 
-  this.registerTask('release', 'Build final packages', ['eslint', 'amd', 'uglify', 'test:min', 'copy:dist', 'copy:components', 'copy:cdnjs']);
+  this.registerTask('release', 'Build final packages', ['eslint', 'amd', 'test:min', 'copy:dist', 'copy:components', 'copy:cdnjs']);
 
   // Load tasks from npm
   grunt.loadNpmTasks('grunt-contrib-clean');
   grunt.loadNpmTasks('grunt-contrib-concat');
   grunt.loadNpmTasks('grunt-contrib-connect');
   grunt.loadNpmTasks('grunt-contrib-copy');
-  grunt.loadNpmTasks('grunt-contrib-requirejs');
-  grunt.loadNpmTasks('grunt-contrib-uglify');
   grunt.loadNpmTasks('grunt-contrib-watch');
   grunt.loadNpmTasks('grunt-babel');
   grunt.loadNpmTasks('grunt-bg-shell');

babel.config.js

@@ -0,0 +1,7 @@
+module.exports = function(api) {
+  api.cache(false);
+  return {
+    presets: ['@babel/preset-env'],
+    plugins: ['@babel/plugin-transform-runtime']
+  };
+};

bench/util/benchwarmer.js

@@ -29,7 +29,7 @@ BenchWarmer.prototype = {
     });
   },
   push: function(name, fn) {
-    if (this.names.indexOf(name) == -1) {
+    if (this.names.indexOf(name) === -1) {
       this.names.push(name);
     }
 
@@ -77,7 +77,7 @@ BenchWarmer.prototype = {
 
         var errors = false, prop, bench;
         for (prop in self.errors) {
-          if (self.errors.hasOwnProperty(prop)
+          if (Object.prototype.hasOwnProperty.call(self, prop)
               && self.errors[prop].error.message !== 'EWOT') {
             errors = true;
             break;
@@ -86,9 +86,8 @@ BenchWarmer.prototype = {
 
         if (errors) {
           print('\n\nErrors:\n');
-          for (prop in self.errors) {
+          Object.keys(self.errors).forEach(function(prop) {
-            if (self.errors.hasOwnProperty(prop)
+            if (self.errors[prop].error.message !== 'EWOT') {
-                && self.errors[prop].error.message !== 'EWOT') {
               bench = self.errors[prop];
               print('\n' + bench.name + ':\n');
               print(bench.error.message);
@@ -97,7 +96,7 @@ BenchWarmer.prototype = {
               }
               print('\n');
             }
-          }
+          });
         }
 
         callback();

components/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "4.5.0",
+  "version": "4.5.3",
   "main": "handlebars.js",
   "license": "MIT",
   "dependencies": {}

components/handlebars.js.nuspec

@@ -2,7 +2,7 @@
 <package>
 	<metadata>
 		<id>handlebars.js</id>
-		<version>4.5.0</version>
+		<version>4.5.3</version>
 		<authors>handlebars.js Authors</authors>
 		<licenseUrl>https://github.com/wycats/handlebars.js/blob/master/LICENSE</licenseUrl>
 		<projectUrl>https://github.com/wycats/handlebars.js/</projectUrl>

components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "4.5.0",
+  "version": "4.5.3",
   "license": "MIT",
   "jspm": {
     "main": "handlebars",

integration-testing/webpack-babel-test/src/handlebars-inline-precompile-test.js

@@ -1,12 +1,12 @@
-import * as Handlebars from 'handlebars/runtime'
+import * as Handlebars from 'handlebars/runtime';
 import hbs from 'handlebars-inline-precompile';
-import {assertEquals} from "../../webpack-test/src/lib/assert";
+import {assertEquals} from '../../webpack-test/src/lib/assert';
 
 Handlebars.registerHelper('loud', function(text) {
     return text.toUpperCase();
 });
 
 const template = hbs`{{loud name}}`;
-const output = template({name: 'yehuda'})
+const output = template({name: 'yehuda'});
 
-assertEquals(output, 'YEHUDA')
+assertEquals(output, 'YEHUDA');

integration-testing/webpack-babel-test/webpack.config.js

@@ -10,6 +10,7 @@ testFiles
 
 module.exports = {
     entry: entryPoints,
+    mode: 'production',
     output: {
         filename: '[name]',
         path: __dirname + '/dist'

lib/handlebars.js

@@ -9,10 +9,9 @@ import Visitor from './handlebars/compiler/visitor';
 
 import noConflict from './handlebars/no-conflict';
 
-let _create = runtime.create;
 function create() {
-  let hb = _create();
+  let hb = runtime.create();
-
+  hb.create = create;
   hb.compile = function(input, options) {
     return compile(input, options, hb);
   };
@@ -31,8 +30,6 @@ function create() {
 }
 
 let inst = create();
-inst.create = create;
-
 noConflict(inst);
 
 inst.Visitor = Visitor;

lib/handlebars.runtime.js

@@ -4,31 +4,52 @@ import * as base from './handlebars/base';
 // (This is done to easily share code between commonjs and browse envs)
 import SafeString from './handlebars/safe-string';
 import Exception from './handlebars/exception';
-import * as Utils from './handlebars/utils';
+import {
-import * as runtime from './handlebars/runtime';
+  extend,
+  toString,
+  isFunction,
+  isArray,
+  indexOf,
+  escapeExpression,
+  isEmpty,
+  createFrame,
+  blockParams,
+  appendContextPath
+} from './handlebars/utils';
+import {checkRevision, template, wrapProgram, resolvePartial, invokePartial, noop} from './handlebars/runtime';
 
 import noConflict from './handlebars/no-conflict';
 
 // For compatibility and usage outside of module systems, make the Handlebars object a namespace
-function create() {
+export function create() {
   let hb = new base.HandlebarsEnvironment();
 
-  Utils.extend(hb, base);
+  extend(hb, base);
   hb.SafeString = SafeString;
   hb.Exception = Exception;
-  hb.Utils = Utils;
+  hb.Utils = {
-  hb.escapeExpression = Utils.escapeExpression;
+    extend,
-
+    toString,
-  hb.VM = runtime;
+    isFunction,
+    isArray,
+    indexOf,
+    escapeExpression,
+    isEmpty,
+    createFrame,
+    blockParams,
+    appendContextPath
+  };
+  hb.escapeExpression = escapeExpression;
+  hb.create = create;
+  hb.VM = {checkRevision, template, wrapProgram, resolvePartial, invokePartial, noop};
   hb.template = function(spec) {
-    return runtime.template(spec, hb);
+    return template(spec, hb);
   };
 
   return hb;
 }
 
 let inst = create();
-inst.create = create;
 
 noConflict(inst);
 

lib/handlebars/base.js

@@ -4,7 +4,7 @@ import {registerDefaultHelpers} from './helpers';
 import {registerDefaultDecorators} from './decorators';
 import logger from './logger';
 
-export const VERSION = '4.5.0';
+export const VERSION = '4.5.3';
 export const COMPILER_REVISION = 8;
 export const LAST_COMPATIBLE_COMPILER_REVISION = 7;
 

lib/handlebars/compiler/code-gen.js

@@ -1,16 +1,11 @@
-/* global define */
 import {isArray} from '../utils';
 
 let SourceNode;
 
 try {
-  /* istanbul ignore next */
+  // the 'source-map' map package is ignored in 'umd' and 'amd' builds (via webpack-config)
-  if (typeof define !== 'function' || !define.amd) {
+  let SourceMap = require('source-map');
-    // We don't support this in AMD environments. For these environments, we asusme that
+  SourceNode = SourceMap.SourceNode;
-    // they are running on the browser and thus have no need for the source-map library.
-    let SourceMap = require('source-map');
-    SourceNode = SourceMap.SourceNode;
-  }
 } catch (err) {
   /* NOP */
 }
@@ -125,14 +120,12 @@ CodeGen.prototype = {
   objectLiteral: function(obj) {
     let pairs = [];
 
-    for (let key in obj) {
+    Object.keys(obj).forEach(key => {
-      if (obj.hasOwnProperty(key)) {
+      let value = castChunk(obj[key], this);
-        let value = castChunk(obj[key], this);
+      if (value !== 'undefined') {
-        if (value !== 'undefined') {
+        pairs.push([this.quotedString(key), ':', value]);
-          pairs.push([this.quotedString(key), ':', value]);
-        }
       }
-    }
+    });
 
     let ret = this.generateList(pairs);
     ret.prepend('{');

lib/handlebars/compiler/compiler.js

@@ -54,9 +54,7 @@ Compiler.prototype = {
 
     options.blockParams = options.blockParams || [];
 
-    // These changes will propagate to the other compiler components
+    options.knownHelpers = extend(Object.create(null), {
-    let knownHelpers = options.knownHelpers;
-    options.knownHelpers = {
       'helperMissing': true,
       'blockHelperMissing': true,
       'each': true,
@@ -65,15 +63,7 @@ Compiler.prototype = {
       'with': true,
       'log': true,
       'lookup': true
-    };
+    }, options.knownHelpers);
-    if (knownHelpers) {
-      // the next line should use "Object.keys", but the code has been like this a long time and changing it, might
-      // cause backwards-compatibility issues... It's an old library...
-      // eslint-disable-next-line guard-for-in
-      for (let name in knownHelpers) {
-          this.options.knownHelpers[name] = knownHelpers[name];
-      }
-    }
 
     return this.accept(program);
   },
@@ -369,7 +359,6 @@ Compiler.prototype = {
     if (isEligible && !isHelper) {
       let name = sexpr.path.parts[0],
           options = this.options;
-
       if (options.knownHelpers[name]) {
         isHelper = true;
       } else if (options.knownHelpersOnly) {

lib/handlebars/compiler/javascript-compiler.js

@@ -2,6 +2,7 @@ import { COMPILER_REVISION, REVISION_CHANGES } from '../base';
 import Exception from '../exception';
 import {isArray} from '../utils';
 import CodeGen from './code-gen';
+import {dangerousPropertyRegex} from '../helpers/lookup';
 
 function Literal(value) {
   this.value = value;
@@ -13,9 +14,8 @@ JavaScriptCompiler.prototype = {
   // PUBLIC API: You can override these methods in a subclass to provide
   // alternative compiled forms for name lookup and buffering semantics
   nameLookup: function(parent, name/* , type*/) {
-    const isEnumerable = [ this.aliasable('container.propertyIsEnumerable'), '.call(', parent, ',"constructor")'];
+    if (dangerousPropertyRegex.test(name)) {
-
+      const isEnumerable = [ this.aliasable('container.propertyIsEnumerable'), '.call(', parent, ',', JSON.stringify(name), ')'];
-    if (name === 'constructor') {
       return ['(', isEnumerable, '?', _actualLookup(), ' : undefined)'];
     }
     return _actualLookup();
@@ -218,13 +218,13 @@ JavaScriptCompiler.prototype = {
     // aliases will not be used, but this case is already being run on the client and
     // we aren't concern about minimizing the template size.
     let aliasCount = 0;
-    for (let alias in this.aliases) { // eslint-disable-line guard-for-in
+    Object.keys(this.aliases).forEach(alias => {
       let node = this.aliases[alias];
-      if (this.aliases.hasOwnProperty(alias) && node.children && node.referenceCount > 1) {
+      if (node.children && node.referenceCount > 1) {
         varDeclarations += ', alias' + (++aliasCount) + '=' + alias;
         node.children[0] = 'alias' + aliasCount;
       }
-    }
+    });
 
     let params = ['container', 'depth0', 'helpers', 'partials', 'data'];
 

lib/handlebars/helpers/each.js

@@ -62,18 +62,16 @@ export default function(instance) {
       } else {
         let priorKey;
 
-        for (let key in context) {
+        Object.keys(context).forEach(key => {
-          if (context.hasOwnProperty(key)) {
+          // We're running the iterations one step out of sync so we can detect
-            // We're running the iterations one step out of sync so we can detect
+          // the last iteration without have to scan the object twice and create
-            // the last iteration without have to scan the object twice and create
+          // an itermediate keys array.
-            // an itermediate keys array.
+          if (priorKey !== undefined) {
-            if (priorKey !== undefined) {
+            execIteration(priorKey, i - 1);
-              execIteration(priorKey, i - 1);
-            }
-            priorKey = key;
-            i++;
           }
-        }
+          priorKey = key;
+          i++;
+        });
         if (priorKey !== undefined) {
           execIteration(priorKey, i - 1, true);
         }

lib/handlebars/helpers/lookup.js

@@ -1,9 +1,11 @@
+export const dangerousPropertyRegex = /^(constructor|__defineGetter__|__defineSetter__|__lookupGetter__|__proto__)$/;
+
 export default function(instance) {
   instance.registerHelper('lookup', function(obj, field) {
     if (!obj) {
       return obj;
     }
-    if (field === 'constructor' && !obj.propertyIsEnumerable(field)) {
+    if (dangerousPropertyRegex.test(String(field)) && !Object.prototype.propertyIsEnumerable.call(obj, field)) {
       return undefined;
     }
     return obj[field];

lib/handlebars/runtime.js

@@ -1,4 +1,4 @@
-import * as Utils from './utils';
+import {extend, escapeExpression} from './utils';
 import Exception from './exception';
 import {COMPILER_REVISION, createFrame, LAST_COMPATIBLE_COMPILER_REVISION, REVISION_CHANGES} from './base';
 import {moveHelperToHooks} from './helpers';
@@ -44,14 +44,14 @@ export function template(templateSpec, env) {
 
   function invokePartialWrapper(partial, context, options) {
     if (options.hash) {
-      context = Utils.extend({}, context, options.hash);
+      context = extend({}, context, options.hash);
       if (options.ids) {
         options.ids[0] = true;
       }
     }
     partial = env.VM.resolvePartial.call(this, partial, context, options);
 
-    let optionsWithHooks = Utils.extend({}, options, {hooks: this.hooks});
+    let optionsWithHooks = extend({}, options, {hooks: this.hooks});
 
     let result = env.VM.invokePartial.call(this, partial, context, optionsWithHooks);
 
@@ -97,7 +97,7 @@ export function template(templateSpec, env) {
       return typeof current === 'function' ? current.call(context) : current;
     },
 
-    escapeExpression: Utils.escapeExpression,
+    escapeExpression: escapeExpression,
     invokePartial: invokePartialWrapper,
 
     fn: function(i) {
@@ -158,13 +158,13 @@ export function template(templateSpec, env) {
 
   ret._setup = function(options) {
     if (!options.partial) {
-      container.helpers = Utils.extend({}, env.helpers, options.helpers);
+      container.helpers = extend({}, env.helpers, options.helpers);
 
       if (templateSpec.usePartial) {
-        container.partials = Utils.extend({}, env.partials, options.partials);
+        container.partials = extend({}, env.partials, options.partials);
       }
       if (templateSpec.usePartial || templateSpec.useDecorators) {
-        container.decorators = Utils.extend({}, env.decorators, options.decorators);
+        container.decorators = extend({}, env.decorators, options.decorators);
       }
 
       container.hooks = {};
@@ -258,7 +258,7 @@ export function invokePartial(partial, context, options) {
       return fn(context, options);
     };
     if (fn.partials) {
-      options.partials = Utils.extend({}, options.partials, fn.partials);
+      options.partials = extend({}, options.partials, fn.partials);
     }
   }
 
@@ -287,7 +287,7 @@ function executeDecorators(fn, prog, container, depths, data, blockParams) {
   if (fn.decorator) {
     let props = {};
     prog = fn.decorator(prog, props, container, depths && depths[0], data, blockParams, depths);
-    Utils.extend(prog, props);
+    extend(prog, props);
   }
   return prog;
 }

lib/handlebars/utils.js

@@ -33,18 +33,23 @@ export let toString = Object.prototype.toString;
 // Sourced from lodash
 // https://github.com/bestiejs/lodash/blob/master/LICENSE.txt
 /* eslint-disable func-style */
-let isFunction = function(value) {
+export const isFunction = createIsFunction();
-  return typeof value === 'function';
+
-};
+
-// fallback for older versions of Chrome and Safari
+function createIsFunction() {
-/* istanbul ignore next */
+  // istanbul ignore next
-if (isFunction(/x/)) {
+  // eslint-disable-next-line no-constant-condition
-  isFunction = function(value) {
+  if (typeof /x/ === 'function') {
-    return typeof value === 'function' && toString.call(value) === '[object Function]';
+    // fallback for older chrome/firefox versions
+    return function isFunction(value) {
+      return typeof value === 'function' && toString.call(value) === '[object Function]';
+    };
+  }
+  return function isFunction(value) {
+    return typeof value === 'function';
   };
 }
-export {isFunction};
+
-/* eslint-enable func-style */
 
 /* istanbul ignore next */
 export const isArray = Array.isArray || function(value) {
@@ -62,6 +67,7 @@ export function indexOf(array, value) {
 }
 
 
+
 export function escapeExpression(string) {
   if (typeof string !== 'string') {
     // don't escape SafeStrings, since they're already safe
@@ -83,6 +89,7 @@ export function escapeExpression(string) {
   return string.replace(badChars, escapeChar);
 }
 
+
 export function isEmpty(value) {
   if (!value && value !== 0) {
     return true;

lib/precompiler.js

@@ -1,7 +1,7 @@
 /* eslint-disable no-console */
 import Async from 'neo-async';
 import fs from 'fs';
-import * as Handlebars from './handlebars';
+import Handlebars from './handlebars';
 import {basename} from 'path';
 import {SourceMapConsumer, SourceNode} from 'source-map';
 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "4.5.0",
+  "version": "4.5.3",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
   "homepage": "http://www.handlebarsjs.com/",
   "keywords": [
@@ -21,7 +21,6 @@
     "node": ">=0.4.7"
   },
   "dependencies": {
-    "eslint-plugin-compat": "^3.3.0",
     "neo-async": "^2.6.0",
     "optimist": "^0.6.1",
     "source-map": "^0.6.1"
@@ -30,38 +29,46 @@
     "uglify-js": "^3.1.4"
   },
   "devDependencies": {
+    "@babel/core": "^7.7.4",
+    "@babel/plugin-transform-modules-amd": "^7.7.4",
+    "@babel/plugin-transform-modules-commonjs": "^7.7.4",
+    "@babel/plugin-transform-runtime": "^7.7.4",
+    "@babel/preset-env": "^7.7.4",
+    "@babel/runtime": "^7.7.4",
     "@knappi/grunt-saucelabs": "^9.0.2",
     "aws-sdk": "^2.1.49",
-    "babel-loader": "^5.0.0",
+    "babel-loader": "^8.0.6",
-    "babel-runtime": "^5.1.10",
+    "babel-plugin-add-module-exports": "^1.0.2",
     "benchmark": "~1.0",
+    "chai": "^4.2.0",
+    "dirty-chai": "^2.0.1",
     "dtslint": "^0.5.5",
     "dustjs-linkedin": "^2.0.2",
     "eco": "~1.1.0-rc-3",
+    "eslint-plugin-compat": "^3.3.0",
     "eslint-plugin-es5": "^1.4.1",
-    "grunt": "^1.0.3",
+    "grunt": "^1.0.4",
-    "grunt-babel": "^5.0.0",
+    "grunt-babel": "^8.0.0",
     "grunt-bg-shell": "^2.3.3",
     "grunt-cli": "^1",
     "grunt-contrib-clean": "^1",
     "grunt-contrib-concat": "^1",
     "grunt-contrib-connect": "^1",
     "grunt-contrib-copy": "^1",
-    "grunt-contrib-requirejs": "^1",
-    "grunt-contrib-uglify": "^1",
     "grunt-contrib-watch": "^1.1.0",
     "grunt-eslint": "^20.1.0",
-    "grunt-webpack": "^1.0.8",
+    "grunt-webpack": "^3.1.3",
     "istanbul": "^0.3.0",
     "jison": "~0.3.0",
     "mocha": "^5",
     "mock-stdin": "^0.3.0",
     "mustache": "^2.1.3",
     "semver": "^5.0.1",
+    "sinon": "^7.5.0",
     "typescript": "^3.4.3",
     "underscore": "^1.5.1",
-    "webpack": "^1.12.6",
+    "webpack": "^4.41.2",
-    "webpack-dev-server": "^1.12.1"
+    "webpack-dev-server": "^3.9.0"
   },
   "main": "lib/index.js",
   "types": "types/index.d.ts",

release-notes.md

@@ -2,7 +2,71 @@
 
 ## Development
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.5.0...master)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.5.3...master)
+
+## v4.5.3 - November 18th, 2019
+Bugfixes:
+
+- fix: add "no-prototype-builtins" eslint-rule and fix all occurences - f7f05d7
+- fix: add more properties required to be enumerable - 1988878
+
+Chores / Build:
+- fix: use !== 0 instead of != 0 - c02b05f
+- add chai and dirty-chai and sinon, for cleaner test-assertions and spies, 
+  deprecate old assertion-methods  - 93e284e, 886ba86, 0817dad, 93516a0
+
+Security:
+
+- The properties `__proto__`, `__defineGetter__`, `__defineSetter__` and `__lookupGetter__` 
+  have been added to the list of "properties that must be enumerable".
+  If a property by that name is found and not enumerable on its parent, 
+  it will silently evaluate to `undefined`. This is done in both the compiled template and the "lookup"-helper. 
+  This will prevent new Remote-Code-Execution exploits that have been
+  published recently.
+
+Compatibility notes: 
+
+- Due to the security-fixes. The semantics of the templates using
+  `__proto__`, `__defineGetter__`, `__defineSetter__` and `__lookupGetter__` in the respect that those expression now return 
+  `undefined` rather than their actual value from the proto.
+- The semantics have not changed in cases where the properties are  enumerable, as in:
+
+```js
+{
+  __proto__: 'some string'
+}
+```
+
+- The change may be breaking in that respect, but we still only 
+  increase the patch-version, because the incompatible use-cases
+  are not intended, undocumented and far less important than fixing
+  Remote-Code-Execution exploits on existing systems.
+
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.5.2...v4.5.3)
+
+## v4.5.2 - November 13th, 2019
+# Bugfixes
+
+- fix: use String(field) in lookup when checking for "constructor" - d541378
+- test: add fluent API for testing Handlebars - c2ac79c
+
+Compatibility notes:
+- no incompatibility are to be expected
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.5.1...v4.5.2)
+
+## v4.5.1 - October 29th, 2019
+Bugfixs
+
+- fix: move "eslint-plugin-compat" to devDependencies - 5e9d17f (#1589)
+
+Compatibility notes:
+- No compatibility issues are to be expected
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.5.0...v4.5.1)
 
 ## v4.5.0 - October 28th, 2019
 Features / Improvements

spec/.eslintrc

@@ -13,6 +13,7 @@
     "shouldCompileTo": true,
     "shouldCompileToWithPartials": true,
     "shouldThrow": true,
+    "expectTemplate": true,
     "compileWithPartials": true,
     "console": true,
     "require": true,
@@ -26,16 +27,20 @@
     "start": true,
     "stop": true,
     "ok": true,
+    "sinon": true,
     "strictEqual": true,
-    "define": true
+    "define": true,
+    "expect": true,
+    "chai": true
   },
   "env": {
     "mocha": true
   },
   "rules": {
     // Disabling for tests, for now.
-    "no-path-concat": 0,
+    "no-path-concat": "off",
 
-    "no-var": 0
+    "no-var": "off",
+    "dot-notation": "off"
   }
 }

spec/amd-runtime.html

@@ -18,12 +18,14 @@
         document.documentElement.className = 'headless';
       }
     </script>
+    <script src="/node_modules/sinon/pkg/sinon.js"></script>
+    <script src="/node_modules/chai/chai.js"></script>
+    <script src="/node_modules/dirty-chai/lib/dirty-chai.js"></script>
     <script src="/node_modules/mocha/mocha.js"></script>
     <script>
+      window.expect = chai.expect;
       mocha.setup('bdd');
     </script>
-
-    <script src="/spec/env/json2.js"></script>
     <script src="/spec/env/require.js"></script>
 
     <script src="/spec/env/common.js"></script>

spec/amd.html

@@ -19,14 +19,15 @@
         document.documentElement.className = 'headless';
       }
     </script>
+    <script src="/node_modules/sinon/pkg/sinon.js"></script>
+    <script src="/node_modules/chai/chai.js"></script>
+    <script src="/node_modules/dirty-chai/lib/dirty-chai.js"></script>
     <script src="/node_modules/mocha/mocha.js"></script>
     <script>
+      window.expect = chai.expect;
       mocha.setup('bdd');
     </script>
-
-    <script src="/spec/env/json2.js"></script>
     <script src="/spec/env/require.js"></script>
-
     <script src="/spec/env/common.js"></script>
     <script>
       var requireFailure;

spec/compiler.js

@@ -59,7 +59,7 @@ describe('compiler', function() {
         Handlebars.compile(' \n  {{#if}}\n{{/def}}')();
         equal(true, false, 'Statement must throw exception. This line should not be executed.');
       } catch (err) {
-        equal(err.propertyIsEnumerable('column'), true, 'Checking error column');
+        equal(Object.prototype.propertyIsEnumerable.call(err, 'column'), true, 'Checking error column');
       }
     });
 

spec/env/browser.js

@@ -3,6 +3,15 @@ require('./common');
 var fs = require('fs'),
     vm = require('vm');
 
+var chai = require('chai');
+var dirtyChai = require('dirty-chai');
+
+
+chai.use(dirtyChai);
+global.expect = chai.expect;
+
+global.sinon = require('sinon');
+
 global.Handlebars = 'no-conflict';
 
 var filename = 'dist/handlebars.js';

spec/env/common.js

@@ -1,4 +1,6 @@
-var global = (function() { return this; }());
+var global = (function() {
+  return this;
+}());
 
 var AssertError;
 if (Error.captureStackTrace) {
@@ -16,10 +18,16 @@ if (Error.captureStackTrace) {
   AssertError = Error;
 }
 
+/**
+ * @deprecated Use "expectTemplate(template)...toCompileTo(output)" instead
+ */
 global.shouldCompileTo = function(string, hashOrArray, expected, message) {
   shouldCompileToWithPartials(string, hashOrArray, false, expected, message);
 };
 
+/**
+ * @deprecated Use "expectTemplate(template)...toCompileTo(output)" instead
+ */
 global.shouldCompileToWithPartials = function shouldCompileToWithPartials(string, hashOrArray, partials, expected, message) {
   var result = compileWithPartials(string, hashOrArray, partials);
   if (result !== expected) {
@@ -27,6 +35,9 @@ global.shouldCompileToWithPartials = function shouldCompileToWithPartials(string
   }
 };
 
+/**
+ * @deprecated Use "expectTemplate(template)...toCompileTo(output)" instead
+ */
 global.compileWithPartials = function(string, hashOrArray, partials) {
   var template,
       ary,
@@ -36,8 +47,8 @@ global.compileWithPartials = function(string, hashOrArray, partials) {
     delete hashOrArray.hash;
   } else if (Object.prototype.toString.call(hashOrArray) === '[object Array]') {
     ary = [];
-    ary.push(hashOrArray[0]);
+    ary.push(hashOrArray[0]); // input
-    ary.push({ helpers: hashOrArray[1], partials: hashOrArray[2] });
+    ary.push({helpers: hashOrArray[1], partials: hashOrArray[2]});
     options = typeof hashOrArray[3] === 'object' ? hashOrArray[3] : {compat: hashOrArray[3]};
     if (hashOrArray[4] != null) {
       options.data = !!hashOrArray[4];
@@ -52,12 +63,20 @@ global.compileWithPartials = function(string, hashOrArray, partials) {
 };
 
 
+/**
+ * @deprecated Use chai's expect-style API instead (`expect(actualValue).to.equal(expectedValue)`)
+ * @see https://www.chaijs.com/api/bdd/
+ */
 global.equals = global.equal = function equals(a, b, msg) {
   if (a !== b) {
     throw new AssertError("'" + a + "' should === '" + b + "'" + (msg ? ': ' + msg : ''), equals);
   }
 };
 
+/**
+ * @deprecated Use chai's expect-style API instead (`expect(actualValue).to.equal(expectedValue)`)
+ * @see https://www.chaijs.com/api/bdd/#method_throw
+ */
 global.shouldThrow = function(callback, type, msg) {
   var failed;
   try {
@@ -75,3 +94,83 @@ global.shouldThrow = function(callback, type, msg) {
     throw new AssertError('It failed to throw', shouldThrow);
   }
 };
+
+
+global.expectTemplate = function(templateAsString) {
+  return new HandlebarsTestBench(templateAsString);
+};
+
+
+function HandlebarsTestBench(templateAsString) {
+  this.templateAsString = templateAsString;
+  this.helpers = {};
+  this.partials = {};
+  this.input = {};
+  this.message = 'Template' + templateAsString + ' does not evaluate to expected output';
+  this.compileOptions = {};
+  this.runtimeOptions = {};
+}
+
+HandlebarsTestBench.prototype.withInput = function(input) {
+  this.input = input;
+  return this;
+};
+
+HandlebarsTestBench.prototype.withHelper = function(name, helperFunction) {
+  this.helpers[name] = helperFunction;
+  return this;
+};
+
+HandlebarsTestBench.prototype.withPartial = function(name, partialAsString) {
+  this.partials[name] = partialAsString;
+  return this;
+};
+
+HandlebarsTestBench.prototype.withCompileOptions = function(compileOptions) {
+  this.compileOptions = compileOptions;
+  return this;
+};
+
+HandlebarsTestBench.prototype.withRuntimeOptions = function(runtimeOptions) {
+  this.runtimeOptions = runtimeOptions;
+  return this;
+};
+
+HandlebarsTestBench.prototype.withMessage = function(message) {
+  this.message = message;
+  return this;
+};
+
+HandlebarsTestBench.prototype.toCompileTo = function(expectedOutputAsString) {
+  expect(this._compileAndExeute()).to.equal(expectedOutputAsString);
+};
+
+// see chai "to.throw" (https://www.chaijs.com/api/bdd/#method_throw)
+HandlebarsTestBench.prototype.toThrow = function(errorLike, errMsgMatcher, msg) {
+  var self = this;
+  expect(function() {
+    self._compileAndExeute();
+  }).to.throw(errorLike, errMsgMatcher, msg);
+};
+
+HandlebarsTestBench.prototype._compileAndExeute = function() {
+  var compile = Object.keys(this.partials).length > 0
+      ? CompilerContext.compileWithPartial
+      : CompilerContext.compile;
+
+  var combinedRuntimeOptions = this._combineRuntimeOptions();
+
+  var template = compile(this.templateAsString, this.compileOptions);
+  return template(this.input, combinedRuntimeOptions);
+};
+
+HandlebarsTestBench.prototype._combineRuntimeOptions = function() {
+  var self = this;
+  var combinedRuntimeOptions = {};
+  Object.keys(this.runtimeOptions).forEach(function(key) {
+    combinedRuntimeOptions[key] = self.runtimeOptions[key];
+  });
+  combinedRuntimeOptions.helpers = this.helpers;
+  combinedRuntimeOptions.partials = this.partials;
+  return combinedRuntimeOptions;
+};

spec/env/json2.js

@@ -1,489 +0,0 @@
-/*
-    json2.js
-    2014-02-04
-
-    Public Domain.
-
-    NO WARRANTY EXPRESSED OR IMPLIED. USE AT YOUR OWN RISK.
-
-    See http://www.JSON.org/js.html
-
-
-    This code should be minified before deployment.
-    See http://javascript.crockford.com/jsmin.html
-
-    USE YOUR OWN COPY. IT IS EXTREMELY UNWISE TO LOAD CODE FROM SERVERS YOU DO
-    NOT CONTROL.
-
-
-    This file creates a global JSON object containing two methods: stringify
-    and parse.
-
-        JSON.stringify(value, replacer, space)
-            value       any JavaScript value, usually an object or array.
-
-            replacer    an optional parameter that determines how object
-                        values are stringified for objects. It can be a
-                        function or an array of strings.
-
-            space       an optional parameter that specifies the indentation
-                        of nested structures. If it is omitted, the text will
-                        be packed without extra whitespace. If it is a number,
-                        it will specify the number of spaces to indent at each
-                        level. If it is a string (such as '\t' or ' '),
-                        it contains the characters used to indent at each level.
-
-            This method produces a JSON text from a JavaScript value.
-
-            When an object value is found, if the object contains a toJSON
-            method, its toJSON method will be called and the result will be
-            stringified. A toJSON method does not serialize: it returns the
-            value represented by the name/value pair that should be serialized,
-            or undefined if nothing should be serialized. The toJSON method
-            will be passed the key associated with the value, and this will be
-            bound to the value
-
-            For example, this would serialize Dates as ISO strings.
-
-                Date.prototype.toJSON = function (key) {
-                    function f(n) {
-                        // Format integers to have at least two digits.
-                        return n < 10 ? '0' + n : n;
-                    }
-
-                    return this.getUTCFullYear()   + '-' +
-                         f(this.getUTCMonth() + 1) + '-' +
-                         f(this.getUTCDate())      + 'T' +
-                         f(this.getUTCHours())     + ':' +
-                         f(this.getUTCMinutes())   + ':' +
-                         f(this.getUTCSeconds())   + 'Z';
-                };
-
-            You can provide an optional replacer method. It will be passed the
-            key and value of each member, with this bound to the containing
-            object. The value that is returned from your method will be
-            serialized. If your method returns undefined, then the member will
-            be excluded from the serialization.
-
-            If the replacer parameter is an array of strings, then it will be
-            used to select the members to be serialized. It filters the results
-            such that only members with keys listed in the replacer array are
-            stringified.
-
-            Values that do not have JSON representations, such as undefined or
-            functions, will not be serialized. Such values in objects will be
-            dropped; in arrays they will be replaced with null. You can use
-            a replacer function to replace those with JSON values.
-            JSON.stringify(undefined) returns undefined.
-
-            The optional space parameter produces a stringification of the
-            value that is filled with line breaks and indentation to make it
-            easier to read.
-
-            If the space parameter is a non-empty string, then that string will
-            be used for indentation. If the space parameter is a number, then
-            the indentation will be that many spaces.
-
-            Example:
-
-            text = JSON.stringify(['e', {pluribus: 'unum'}]);
-            // text is '["e",{"pluribus":"unum"}]'
-
-
-            text = JSON.stringify(['e', {pluribus: 'unum'}], null, '\t');
-            // text is '[\n\t"e",\n\t{\n\t\t"pluribus": "unum"\n\t}\n]'
-
-            text = JSON.stringify([new Date()], function (key, value) {
-                return this[key] instanceof Date ?
-                    'Date(' + this[key] + ')' : value;
-            });
-            // text is '["Date(---current time---)"]'
-
-
-        JSON.parse(text, reviver)
-            This method parses a JSON text to produce an object or array.
-            It can throw a SyntaxError exception.
-
-            The optional reviver parameter is a function that can filter and
-            transform the results. It receives each of the keys and values,
-            and its return value is used instead of the original value.
-            If it returns what it received, then the structure is not modified.
-            If it returns undefined then the member is deleted.
-
-            Example:
-
-            // Parse the text. Values that look like ISO date strings will
-            // be converted to Date objects.
-
-            myData = JSON.parse(text, function (key, value) {
-                var a;
-                if (typeof value === 'string') {
-                    a =
-/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2}(?:\.\d*)?)Z$/.exec(value);
-                    if (a) {
-                        return new Date(Date.UTC(+a[1], +a[2] - 1, +a[3], +a[4],
-                            +a[5], +a[6]));
-                    }
-                }
-                return value;
-            });
-
-            myData = JSON.parse('["Date(09/09/2001)"]', function (key, value) {
-                var d;
-                if (typeof value === 'string' &&
-                        value.slice(0, 5) === 'Date(' &&
-                        value.slice(-1) === ')') {
-                    d = new Date(value.slice(5, -1));
-                    if (d) {
-                        return d;
-                    }
-                }
-                return value;
-            });
-
-
-    This is a reference implementation. You are free to copy, modify, or
-    redistribute.
-*/
-
-/*jslint evil: true, regexp: true */
-
-/*members "", "\b", "\t", "\n", "\f", "\r", "\"", JSON, "\\", apply,
-    call, charCodeAt, getUTCDate, getUTCFullYear, getUTCHours,
-    getUTCMinutes, getUTCMonth, getUTCSeconds, hasOwnProperty, join,
-    lastIndex, length, parse, prototype, push, replace, slice, stringify,
-    test, toJSON, toString, valueOf
-*/
-
-
-// Create a JSON object only if one does not already exist. We create the
-// methods in a closure to avoid creating global variables.
-
-if (typeof JSON !== 'object') {
-    JSON = {};
-}
-
-(function () {
-    'use strict';
-
-    function f(n) {
-        // Format integers to have at least two digits.
-        return n < 10 ? '0' + n : n;
-    }
-
-    if (typeof Date.prototype.toJSON !== 'function') {
-
-        Date.prototype.toJSON = function () {
-
-            return isFinite(this.valueOf())
-                ? this.getUTCFullYear()     + '-' +
-                    f(this.getUTCMonth() + 1) + '-' +
-                    f(this.getUTCDate())      + 'T' +
-                    f(this.getUTCHours())     + ':' +
-                    f(this.getUTCMinutes())   + ':' +
-                    f(this.getUTCSeconds())   + 'Z'
-                : null;
-        };
-
-        String.prototype.toJSON      =
-            Number.prototype.toJSON  =
-            Boolean.prototype.toJSON = function () {
-                return this.valueOf();
-            };
-    }
-
-    var cx,
-        escapable,
-        gap,
-        indent,
-        meta,
-        rep;
-
-
-    function quote(string) {
-
-// If the string contains no control characters, no quote characters, and no
-// backslash characters, then we can safely slap some quotes around it.
-// Otherwise we must also replace the offending characters with safe escape
-// sequences.
-
-        escapable.lastIndex = 0;
-        return escapable.test(string) ? '"' + string.replace(escapable, function (a) {
-            var c = meta[a];
-            return typeof c === 'string'
-                ? c
-                : '\\u' + ('0000' + a.charCodeAt(0).toString(16)).slice(-4);
-        }) + '"' : '"' + string + '"';
-    }
-
-
-    function str(key, holder) {
-
-// Produce a string from holder[key].
-
-        var i,          // The loop counter.
-            k,          // The member key.
-            v,          // The member value.
-            length,
-            mind = gap,
-            partial,
-            value = holder[key];
-
-// If the value has a toJSON method, call it to obtain a replacement value.
-
-        if (value && typeof value === 'object' &&
-                typeof value.toJSON === 'function') {
-            value = value.toJSON(key);
-        }
-
-// If we were called with a replacer function, then call the replacer to
-// obtain a replacement value.
-
-        if (typeof rep === 'function') {
-            value = rep.call(holder, key, value);
-        }
-
-// What happens next depends on the value's type.
-
-        switch (typeof value) {
-        case 'string':
-            return quote(value);
-
-        case 'number':
-
-// JSON numbers must be finite. Encode non-finite numbers as null.
-
-            return isFinite(value) ? String(value) : 'null';
-
-        case 'boolean':
-        case 'null':
-
-// If the value is a boolean or null, convert it to a string. Note:
-// typeof null does not produce 'null'. The case is included here in
-// the remote chance that this gets fixed someday.
-
-            return String(value);
-
-// If the type is 'object', we might be dealing with an object or an array or
-// null.
-
-        case 'object':
-
-// Due to a specification blunder in ECMAScript, typeof null is 'object',
-// so watch out for that case.
-
-            if (!value) {
-                return 'null';
-            }
-
-// Make an array to hold the partial results of stringifying this object value.
-
-            gap += indent;
-            partial = [];
-
-// Is the value an array?
-
-            if (Object.prototype.toString.apply(value) === '[object Array]') {
-
-// The value is an array. Stringify every element. Use null as a placeholder
-// for non-JSON values.
-
-                length = value.length;
-                for (i = 0; i < length; i += 1) {
-                    partial[i] = str(i, value) || 'null';
-                }
-
-// Join all of the elements together, separated with commas, and wrap them in
-// brackets.
-
-                v = partial.length === 0
-                    ? '[]'
-                    : gap
-                    ? '[\n' + gap + partial.join(',\n' + gap) + '\n' + mind + ']'
-                    : '[' + partial.join(',') + ']';
-                gap = mind;
-                return v;
-            }
-
-// If the replacer is an array, use it to select the members to be stringified.
-
-            if (rep && typeof rep === 'object') {
-                length = rep.length;
-                for (i = 0; i < length; i += 1) {
-                    if (typeof rep[i] === 'string') {
-                        k = rep[i];
-                        v = str(k, value);
-                        if (v) {
-                            partial.push(quote(k) + (gap ? ': ' : ':') + v);
-                        }
-                    }
-                }
-            } else {
-
-// Otherwise, iterate through all of the keys in the object.
-
-                for (k in value) {
-                    if (Object.prototype.hasOwnProperty.call(value, k)) {
-                        v = str(k, value);
-                        if (v) {
-                            partial.push(quote(k) + (gap ? ': ' : ':') + v);
-                        }
-                    }
-                }
-            }
-
-// Join all of the member texts together, separated with commas,
-// and wrap them in braces.
-
-            v = partial.length === 0
-                ? '{}'
-                : gap
-                ? '{\n' + gap + partial.join(',\n' + gap) + '\n' + mind + '}'
-                : '{' + partial.join(',') + '}';
-            gap = mind;
-            return v;
-        }
-    }
-
-// If the JSON object does not yet have a stringify method, give it one.
-
-    if (typeof JSON.stringify !== 'function') {
-        escapable = /[\\\"\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g;
-        meta = {    // table of character substitutions
-            '\b': '\\b',
-            '\t': '\\t',
-            '\n': '\\n',
-            '\f': '\\f',
-            '\r': '\\r',
-            '"' : '\\"',
-            '\\': '\\\\'
-        };
-        JSON.stringify = function (value, replacer, space) {
-
-// The stringify method takes a value and an optional replacer, and an optional
-// space parameter, and returns a JSON text. The replacer can be a function
-// that can replace values, or an array of strings that will select the keys.
-// A default replacer method can be provided. Use of the space parameter can
-// produce text that is more easily readable.
-
-            var i;
-            gap = '';
-            indent = '';
-
-// If the space parameter is a number, make an indent string containing that
-// many spaces.
-
-            if (typeof space === 'number') {
-                for (i = 0; i < space; i += 1) {
-                    indent += ' ';
-                }
-
-// If the space parameter is a string, it will be used as the indent string.
-
-            } else if (typeof space === 'string') {
-                indent = space;
-            }
-
-// If there is a replacer, it must be a function or an array.
-// Otherwise, throw an error.
-
-            rep = replacer;
-            if (replacer && typeof replacer !== 'function' &&
-                    (typeof replacer !== 'object' ||
-                    typeof replacer.length !== 'number')) {
-                throw new Error('JSON.stringify');
-            }
-
-// Make a fake root object containing our value under the key of ''.
-// Return the result of stringifying the value.
-
-            return str('', {'': value});
-        };
-    }
-
-
-// If the JSON object does not yet have a parse method, give it one.
-
-    if (typeof JSON.parse !== 'function') {
-        cx = /[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g;
-        JSON.parse = function (text, reviver) {
-
-// The parse method takes a text and an optional reviver function, and returns
-// a JavaScript value if the text is a valid JSON text.
-
-            var j;
-
-            function walk(holder, key) {
-
-// The walk method is used to recursively walk the resulting structure so
-// that modifications can be made.
-
-                var k, v, value = holder[key];
-                if (value && typeof value === 'object') {
-                    for (k in value) {
-                        if (Object.prototype.hasOwnProperty.call(value, k)) {
-                            v = walk(value, k);
-                            if (v !== undefined) {
-                                value[k] = v;
-                            } else {
-                                delete value[k];
-                            }
-                        }
-                    }
-                }
-                return reviver.call(holder, key, value);
-            }
-
-
-// Parsing happens in four stages. In the first stage, we replace certain
-// Unicode characters with escape sequences. JavaScript handles many characters
-// incorrectly, either silently deleting them, or treating them as line endings.
-
-            text = String(text);
-            cx.lastIndex = 0;
-            if (cx.test(text)) {
-                text = text.replace(cx, function (a) {
-                    return '\\u' +
-                        ('0000' + a.charCodeAt(0).toString(16)).slice(-4);
-                });
-            }
-
-// In the second stage, we run the text against regular expressions that look
-// for non-JSON patterns. We are especially concerned with '()' and 'new'
-// because they can cause invocation, and '=' because it can cause mutation.
-// But just to be safe, we want to reject all unexpected forms.
-
-// We split the second stage into 4 regexp operations in order to work around
-// crippling inefficiencies in IE's and Safari's regexp engines. First we
-// replace the JSON backslash pairs with '@' (a non-JSON character). Second, we
-// replace all simple value tokens with ']' characters. Third, we delete all
-// open brackets that follow a colon or comma or that begin the text. Finally,
-// we look to see that the remaining characters are only whitespace or ']' or
-// ',' or ':' or '{' or '}'. If that is so, then the text is safe for eval.
-
-            if (/^[\],:{}\s]*$/
-                    .test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')
-                        .replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, ']')
-                        .replace(/(?:^|:|,)(?:\s*\[)+/g, ''))) {
-
-// In the third stage we use the eval function to compile the text into a
-// JavaScript structure. The '{' operator is subject to a syntactic ambiguity
-// in JavaScript: it can begin a block or an object literal. We wrap the text
-// in parens to eliminate the ambiguity.
-
-                j = eval('(' + text + ')');
-
-// In the optional fourth stage, we recursively walk the new structure, passing
-// each name/value pair to a reviver function for possible transformation.
-
-                return typeof reviver === 'function'
-                    ? walk({'': j}, '')
-                    : j;
-            }
-
-// If the text is not JSON parseable, then a SyntaxError is thrown.
-
-            throw new SyntaxError('JSON.parse');
-        };
-    }
-}());

spec/env/node.js

@@ -1,5 +1,14 @@
 require('./common');
 
+var chai = require('chai');
+var dirtyChai = require('dirty-chai');
+
+
+chai.use(dirtyChai);
+global.expect = chai.expect;
+
+global.sinon = require('sinon');
+
 global.Handlebars = require('../../lib');
 
 global.CompilerContext = {

spec/env/runner.js

@@ -39,7 +39,11 @@ if (global.minimizedTest) {
 
 
 function run(env, callback) {
+  if (errors > 0) {
+    throw new Error('Errors have been detected before');
+  }
   var mocha = new Mocha();
+  mocha.bail();
   mocha.ui('bdd');
   mocha.files = files.slice();
   if (grep) {
@@ -54,6 +58,6 @@ function run(env, callback) {
   require(env);
   mocha.run(function(errorCount) {
     errors += errorCount;
-    callback();
+      callback();
   });
 }

spec/env/runtime.js

@@ -3,6 +3,15 @@ require('./common');
 var fs = require('fs'),
     vm = require('vm');
 
+var chai = require('chai');
+var dirtyChai = require('dirty-chai');
+
+
+chai.use(dirtyChai);
+global.expect = chai.expect;
+
+global.sinon = require('sinon');
+
 global.Handlebars = 'no-conflict';
 
 var filename = 'dist/handlebars.runtime.js';

spec/index.html

@@ -19,13 +19,15 @@
         document.documentElement.className = 'headless';
       }
     </script>
+    <script src="/node_modules/sinon/pkg/sinon.js"></script>
+    <script src="/node_modules/chai/chai.js"></script>
+    <script src="/node_modules/dirty-chai/lib/dirty-chai.js"></script>
     <script src="/node_modules/mocha/mocha.js"></script>
     <script>
+      window.expect = chai.expect;
       mocha.setup('bdd');
     </script>
     <script src="/dist/handlebars.js"></script>
-
-    <script src="/spec/env/json2.js"></script>
     <script src="/spec/env/common.js"></script>
     <script>
       var CompilerContext = {

spec/regressions.js

@@ -211,12 +211,12 @@ describe('Regressions', function() {
         // It's valid to execute a block against an undefined context, but
         // helpers can not do so, so we expect to have an empty object here;
         for (var name in this) {
-          if (this.hasOwnProperty(name)) {
+          if (Object.prototype.hasOwnProperty.call(this, name)) {
             return 'found';
           }
         }
         // And to make IE happy, check for the known string as length is not enumerated.
-        return (this == 'bat' ? 'found' : 'not');
+        return (this === 'bat' ? 'found' : 'not');
       }
     };
 

spec/security.js

@@ -1,11 +1,26 @@
 describe('security issues', function() {
     describe('GH-1495: Prevent Remote Code Execution via constructor', function() {
         it('should not allow constructors to be accessed', function() {
-            shouldCompileTo('{{constructor.name}}', {}, '');
+            expectTemplate('{{lookup (lookup this "constructor") "name"}}')
-            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {}, '');
+                .withInput({})
+                .toCompileTo('');
+
+            expectTemplate('{{constructor.name}}')
+                .withInput({})
+                .toCompileTo('');
         });
 
-        it('should allow the "constructor" property to be accessed if it is enumerable', function() {
+        it('GH-1603: should not allow constructors to be accessed (lookup via toString)', function() {
+          expectTemplate('{{lookup (lookup this (list "constructor")) "name"}}')
+              .withInput({})
+              .withHelper('list', function(element) {
+                return [element];
+              })
+              .toCompileTo('');
+        });
+
+
+      it('should allow the "constructor" property to be accessed if it is enumerable', function() {
             shouldCompileTo('{{constructor.name}}', {'constructor': {
                 'name': 'here we go'
             }}, 'here we go');
@@ -14,6 +29,13 @@ describe('security issues', function() {
             }}, 'here we go');
         });
 
+        it('should allow the "constructor" property to be accessed if it is enumerable', function() {
+            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {'constructor': {
+                    'name': 'here we go'
+                }}, 'here we go');
+        });
+
+
         it('should allow prototype properties that are not constructors', function() {
             function TestClass() {
             }
@@ -53,11 +75,11 @@ describe('security issues', function() {
             });
             it('should throw an exception when calling  "{{blockHelperMissing "abc" .}}" ', function() {
                 var functionCalls = [];
-                shouldThrow(function() {
+                expect(function() {
                     var template = Handlebars.compile('{{blockHelperMissing "abc" .}}');
                     template({ fn: function() { functionCalls.push('called'); }});
-                }, Error);
+                }).to.throw(Error);
-                equals(functionCalls.length, 0);
+                expect(functionCalls.length).to.equal(0);
             });
             it('should throw an exception when calling  "{{#blockHelperMissing .}}{{/blockHelperMissing}}"', function() {
                 shouldThrow(function() {
@@ -92,13 +114,31 @@ describe('security issues', function() {
     describe('GH-1563', function() {
         it('should not allow to access constructor after overriding via __defineGetter__', function() {
             if (({}).__defineGetter__ == null || ({}).__lookupGetter__ == null) {
-                return; // Browser does not support this exploit anyway
+                return this.skip(); // Browser does not support this exploit anyway
             }
-            shouldCompileTo('{{__defineGetter__ "undefined" valueOf }}' +
+            expectTemplate('{{__defineGetter__ "undefined" valueOf }}' +
                 '{{#with __lookupGetter__ }}' +
                 '{{__defineGetter__ "propertyIsEnumerable" (this.bind (this.bind 1)) }}' +
                 '{{constructor.name}}' +
-                '{{/with}}', {}, '');
+                '{{/with}}')
+                .withInput({})
+                .toThrow(/Missing helper: "__defineGetter__"/);
         });
     });
+
+    describe('GH-1595', function() {
+      it('properties, that are required to be enumerable', function() {
+        expectTemplate('{{constructor}}').withInput({}).toCompileTo('');
+        expectTemplate('{{__defineGetter__}}').withInput({}).toCompileTo('');
+        expectTemplate('{{__defineSetter__}}').withInput({}).toCompileTo('');
+        expectTemplate('{{__lookupGetter__}}').withInput({}).toCompileTo('');
+        expectTemplate('{{__proto__}}').withInput({}).toCompileTo('');
+
+        expectTemplate('{{lookup "constructor"}}').withInput({}).toCompileTo('');
+        expectTemplate('{{lookup "__defineGetter__"}}').withInput({}).toCompileTo('');
+        expectTemplate('{{lookup "__defineSetter__"}}').withInput({}).toCompileTo('');
+        expectTemplate('{{lookup "__lookupGetter__"}}').withInput({}).toCompileTo('');
+        expectTemplate('{{lookup "__proto__"}}').withInput({}).toCompileTo('');
+      });
+    });
 });

spec/umd-runtime.html

@@ -18,14 +18,15 @@
         document.documentElement.className = 'headless';
       }
     </script>
+    <script src="/node_modules/sinon/pkg/sinon.js"></script>
+    <script src="/node_modules/chai/chai.js"></script>
+    <script src="/node_modules/dirty-chai/lib/dirty-chai.js"></script>
     <script src="/node_modules/mocha/mocha.js"></script>
     <script>
+      window.expect = chai.expect;
       mocha.setup('bdd');
     </script>
-
-    <script src="/spec/env/json2.js"></script>
     <script src="/spec/env/require.js"></script>
-
     <script src="/spec/env/common.js"></script>
     <script>
       requirejs.config({

spec/umd.html

@@ -18,14 +18,16 @@
         document.documentElement.className = 'headless';
       }
     </script>
+
+    <script src="/node_modules/sinon/pkg/sinon.js"></script>
+    <script src="/node_modules/chai/chai.js"></script>
+    <script src="/node_modules/dirty-chai/lib/dirty-chai.js"></script>
     <script src="/node_modules/mocha/mocha.js"></script>
     <script>
+      window.expect = chai.expect;
       mocha.setup('bdd');
     </script>
-
-    <script src="/spec/env/json2.js"></script>
     <script src="/spec/env/require.js"></script>
-
     <script src="/spec/env/common.js"></script>
     <script>
       requirejs.config({

tasks/test.js

@@ -33,7 +33,7 @@ module.exports = function(grunt) {
 
     var runner = childProcess.fork('./spec/env/runner', [], {stdio: 'inherit'});
     runner.on('close', function(code) {
-      if (code != 0) {
+      if (code !== 0) {
         grunt.fatal(code + ' tests failed');
       }
       done();
@@ -55,7 +55,7 @@ module.exports = function(grunt) {
 
     var runner = childProcess.fork('./spec/env/runner', ['--min'], {stdio: 'inherit'});
     runner.on('close', function(code) {
-      if (code != 0) {
+      if (code !== 0) {
         grunt.fatal(code + ' tests failed');
       }
       done();

webpack.config.js

@@ -0,0 +1,134 @@
+const path = require('path');
+const webpack = require('webpack');
+const assert = require('assert');
+
+module.exports = [
+    createBuild({
+        name: 'umd-compiler-runtime',
+        entry: './lib/handlebars.js',
+        output: buildUmdOutput('handlebars.js'),
+        shouldHandlebarsSupportSourceMaps: false,
+        minimize: false
+    }),
+    createBuild({
+        name: 'umd-compiler-runtime-min',
+        entry: './lib/handlebars.js',
+        output: buildUmdOutput('handlebars.min.js'),
+        shouldHandlebarsSupportSourceMaps: false,
+        minimize: true
+    }),
+    createBuild({
+        name: 'umd-runtime',
+        entry: './lib/handlebars.runtime.js',
+        output: buildUmdOutput('handlebars.runtime.js'),
+        shouldHandlebarsSupportSourceMaps: false,
+        minimize: false
+    }),
+    createBuild({
+        name: 'umd-runtime',
+        entry: './lib/handlebars.runtime.js',
+        output: buildUmdOutput('handlebars.runtime.min.js'),
+        shouldHandlebarsSupportSourceMaps: false,
+        minimize: true
+    }),
+
+    createBuild({
+        name: 'amd-compiler-runtime',
+        entry: './lib/handlebars.js',
+        output: buildAmdOutput('handlebars.amd.js', 'handlebars'),
+        shouldHandlebarsSupportSourceMaps: false,
+        minimize: false
+    }),
+    createBuild({
+        name: 'amd-compiler-runtime-min',
+        entry: './lib/handlebars.js',
+        output: buildAmdOutput('handlebars.amd.min.js', 'handlebars'),
+        shouldHandlebarsSupportSourceMaps: false,
+        minimize: true
+    }),
+    createBuild({
+        name: 'amd-runtime',
+        entry: './lib/handlebars.runtime.js',
+        output: buildAmdOutput('handlebars.runtime.amd.js', 'handlebars.runtime'),
+        shouldHandlebarsSupportSourceMaps: false,
+        minimize: false
+    }),
+    createBuild({
+        name: 'amd-runtime-min',
+        entry: './lib/handlebars.runtime.js',
+        output: buildAmdOutput('handlebars.runtime.amd.min.js', 'handlebars.runtime'),
+        shouldHandlebarsSupportSourceMaps: false,
+        minimize: true
+    })
+];
+
+function createBuild({name, entry, shouldHandlebarsSupportSourceMaps, output, minimize}) {
+    assert(output != null);
+    assert(name != null);
+    assert(entry != null);
+    assert(shouldHandlebarsSupportSourceMaps != null);
+    assert(minimize != null);
+    return {
+        name,
+        module: {
+            rules: [
+                {
+                    test: /\.m?js$/,
+                    exclude: /node_modules/,
+                    use: {
+                        loader: 'babel-loader'
+                    }
+                }
+            ]
+        },
+        plugins: buildPluginConfig(shouldHandlebarsSupportSourceMaps),
+        mode: 'production',
+        devtool: false,
+        optimization: {
+            minimize
+        },
+        entry,
+        output
+    };
+}
+
+function buildPluginConfig(shouldHandlebarsSupportSourceMaps) {
+    const plugins = [];
+    if (!shouldHandlebarsSupportSourceMaps) {
+        plugins.push(
+            new webpack.IgnorePlugin({
+                resourceRegExp: /source-map/
+            })
+        );
+    }
+    return plugins;
+}
+
+function buildAmdOutput(outputFile, targetModuleName) {
+    return {
+        path: path.resolve(__dirname, 'dist'),
+            library: targetModuleName,
+            libraryTarget: 'amd',
+            filename: outputFile,
+            globalObject: 'this',
+            sourceMapFilename: '[file].map',
+            libraryExport: 'default'
+
+    };
+}
+
+function buildUmdOutput(outputFile) {
+    return {
+        path: path.resolve(__dirname, 'dist'),
+            library: 'Handlebars',
+            libraryTarget: 'umd',
+            filename: outputFile,
+            globalObject: 'this',
+            sourceMapFilename: '[file].map',
+            libraryExport: 'default'
+
+    };
+}
+
+
+