handlebars.js

Files

T

Nils Knappmeier edc6220d51 fix: disallow access to the constructor in templates to prevent RCE

This commit fixes a Remote Code Execution (RCE) reported by
npm-security. Access to non-enumerable "constructor"-properties
is now prohibited by the compiled template-code, because this
the first step on the way to creating and execution arbitrary
JavaScript code.
The vulnerability affects systems where an attacker is allowed to
inject templates into the Handlebars setup.
Further details of the attack may be disclosed by npm-security.

Closes #1267
Closes #1495

2019-02-07 08:49:41 +01:00

ast.js

Drop AST constructors in favor of JSON

2015-08-18 23:57:27 -07:00

base.js

Drop AST constructors in favor of JSON

2015-08-18 23:57:27 -07:00

code-gen.js

Update grunt-eslint to 20.1.0

2017-10-21 15:42:27 +02:00

compiler.js

style: omit linting error caused by removing "if"