Nils Knappmeier
7af1c12db6
This commmit adds the runtime options - `allowProtoPropertiesByDefault` (boolean, default: false) and - `allowProtoMethodsByDefault` (boolean, default: false)` which can be used to allow access to prototype properties and functions in general. Specific properties and methods can still be disabled from access via `allowedProtoProperties` and `allowedProtoMethods` by setting the corresponding values to false. The methods `constructor`, `__defineGetter__`, `__defineSetter__`, `__lookupGetter__` and the property `__proto__` will be disabled, even if the allow...ByDefault-options are set to true. In order to allow access to those properties and methods, they have to be explicitly set to true in the 'allowedProto...'-options. A warning is logged when the a proto-access it attempted and denied by default (i.e. if no option is set by the user to make the access decision explicit)
56 lines
2.0 KiB
JavaScript
56 lines
2.0 KiB
JavaScript
import { createNewLookupObject } from './create-new-lookup-object';
|
|
|
|
export function createProtoAccessControl(runtimeOptions) {
|
|
let defaultMethodWhiteList = Object.create(null);
|
|
defaultMethodWhiteList['constructor'] = false;
|
|
defaultMethodWhiteList['__defineGetter__'] = false;
|
|
defaultMethodWhiteList['__defineSetter__'] = false;
|
|
defaultMethodWhiteList['__lookupGetter__'] = false;
|
|
|
|
let defaultPropertyWhiteList = Object.create(null);
|
|
// eslint-disable-next-line no-proto
|
|
defaultPropertyWhiteList['__proto__'] = false;
|
|
|
|
return {
|
|
properties: {
|
|
whitelist: createNewLookupObject(
|
|
defaultPropertyWhiteList,
|
|
runtimeOptions.allowedProtoProperties
|
|
),
|
|
defaultValue: runtimeOptions.allowProtoPropertiesByDefault
|
|
},
|
|
methods: {
|
|
whitelist: createNewLookupObject(
|
|
defaultMethodWhiteList,
|
|
runtimeOptions.allowedProtoMethods
|
|
),
|
|
defaultValue: runtimeOptions.allowProtoMethodsByDefault
|
|
}
|
|
};
|
|
}
|
|
|
|
export function resultIsAllowed(result, protoAccessControl, propertyName) {
|
|
if (typeof result === 'function') {
|
|
return checkWhiteList(protoAccessControl.methods, propertyName);
|
|
} else {
|
|
return checkWhiteList(protoAccessControl.properties, propertyName);
|
|
}
|
|
}
|
|
|
|
function checkWhiteList(protoAccessControlForType, propertyName) {
|
|
if (protoAccessControlForType.whitelist[propertyName] !== undefined) {
|
|
return protoAccessControlForType.whitelist[propertyName] === true;
|
|
}
|
|
if (protoAccessControlForType.defaultValue !== undefined) {
|
|
return protoAccessControlForType.defaultValue;
|
|
}
|
|
|
|
// eslint-disable-next-line no-console
|
|
console.error(
|
|
`Handlebars: Access has been denied to resolve the property "${propertyName}" because it is not an "own property" of its parent.\n` +
|
|
`You can add a runtime option to disable the check or this warning:\n` +
|
|
`See http://localhost:8080/api-reference/runtime-options.html#options-to-control-prototype-access for details`
|
|
);
|
|
return false;
|
|
}
|