Nils Knappmeier
cd38583216
- The "lookup" helper could also be used to run a remote code execution by manipulating the template. The same check as for regular path queries now also is done in the "lookup"-helper
36 lines
1.3 KiB
JavaScript
36 lines
1.3 KiB
JavaScript
describe('security issues', function() {
|
|
describe('GH-1495: Prevent Remote Code Execution via constructor', function() {
|
|
it('should not allow constructors to be accessed', function() {
|
|
shouldCompileTo('{{constructor.name}}', {}, '');
|
|
shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {}, '');
|
|
});
|
|
|
|
it('should allow the "constructor" property to be accessed if it is enumerable', function() {
|
|
shouldCompileTo('{{constructor.name}}', {'constructor': {
|
|
'name': 'here we go'
|
|
}}, 'here we go');
|
|
shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {'constructor': {
|
|
'name': 'here we go'
|
|
}}, 'here we go');
|
|
});
|
|
|
|
it('should allow prototype properties that are not constructors', function() {
|
|
function TestClass() {
|
|
}
|
|
|
|
Object.defineProperty(TestClass.prototype, 'abc', {
|
|
get: function() {
|
|
return 'xyz';
|
|
}
|
|
|
|
});
|
|
|
|
shouldCompileTo('{{#with this as |obj|}}{{obj.abc}}{{/with}}',
|
|
new TestClass(), 'xyz');
|
|
shouldCompileTo('{{#with this as |obj|}}{{lookup obj "abc"}}{{/with}}',
|
|
new TestClass(), 'xyz');
|
|
|
|
});
|
|
});
|
|
});
|