Nils Knappmeier
cd38583216
- The "lookup" helper could also be used to run a remote code execution by manipulating the template. The same check as for regular path queries now also is done in the "lookup"-helper
12 lines
267 B
JavaScript
12 lines
267 B
JavaScript
export default function(instance) {
|
|
instance.registerHelper('lookup', function(obj, field) {
|
|
if (!obj) {
|
|
return obj;
|
|
}
|
|
if (field === 'constructor' && !obj.propertyIsEnumerable(field)) {
|
|
return undefined;
|
|
}
|
|
return obj[field];
|
|
});
|
|
}
|