Update dependency handlebars to ~4.7.4 #2

feat: default options for controlling proto access - 7af1c12, #1635
- This makes it possible to disable the prototype access restrictions added in 4.6.0
- an error is logged in the console, if access to prototype properties is attempted and denied
  and no explicit configuration has taken place.

Compatibility notes:

no compatibilities are expected

Commits

`v4.6.0`

Compare Source

Features:

feat: access control to prototype properties via whitelist (#1633)- d03b6ec

Bugfixes:

fix(runtime.js): partials compile not caching (#1600) - 23d58e7

Chores, docs:

various refactorings and improvements to tests - d7f0dcf, 187d611, d337f40
modernize the build-setup
- use prettier to format and eslint to verify - c40d9f3, 8901c28, e97685e, 1f61f21
- use nyc instead of istanbul to collect coverage - 164b7ff, 1ebce2b
- update build code to use modern javascript and make it cleaner - 14b621c, 1ec1737, 3a5b65e, dde108e, 04b1984, 587e7a3
- restructur build commands - e913dc5,
eslint rule changes - ac4655e, dc54952
Update (C) year in the LICENSE file - d1fb07b
chore: try to fix saucelabs credentials (#1627) -
Update readme.md with updated links (#1620) - edcc84f

BREAKING CHANGES:

access to prototype properties is forbidden completely by default,
specific properties or methods can be allowed via runtime-options.
See #1633 for details.
If you are using Handlebars as documented, you should not be accessing prototype
properties from your template anyway, so the changes should not be a problem
for you. Only the use of undocumented features can break your build.

That is why we only bump the minor version despite mentioning breaking changes.

Commits

`v4.5.3`

Compare Source

Bugfixes:

fix: add "no-prototype-builtins" eslint-rule and fix all occurences - f7f05d7
fix: add more properties required to be enumerable - 1988878

Chores / Build:

fix: use !== 0 instead of != 0 - c02b05f
add chai and dirty-chai and sinon, for cleaner test-assertions and spies,
deprecate old assertion-methods - 93e284e, 886ba86, 0817dad, 93516a0

Security:

The properties __proto__, __defineGetter__, __defineSetter__ and __lookupGetter__
have been added to the list of "properties that must be enumerable".
If a property by that name is found and not enumerable on its parent,
it will silently evaluate to undefined. This is done in both the compiled template and the "lookup"-helper.
This will prevent new Remote-Code-Execution exploits that have been
published recently.

Compatibility notes:

Due to the security-fixes. The semantics of the templates using
__proto__, __defineGetter__, __defineSetter__ and __lookupGetter__ in the respect that those expression now return
undefined rather than their actual value from the proto.
The semantics have not changed in cases where the properties are enumerable, as in:

{
  __proto__: 'some string';
}

The change may be breaking in that respect, but we still only
increase the patch-version, because the incompatible use-cases
are not intended, undocumented and far less important than fixing
Remote-Code-Execution exploits on existing systems.

Commits

`v4.5.2`

Compare Source

`v4.5.1`

Compare Source

Bugfixs

fix: move "eslint-plugin-compat" to devDependencies - 5e9d17f (#1589)

Compatibility notes:

No compatibility issues are to be expected

Commits

`v4.5.0`

Compare Source

Features / Improvements

Add method Handlebars.parseWithoutProcessing (#1584) - 62ed3c2
add guard to if & unless helpers (#1549)
show source location for the strict lookup exceptions - feb60f8

Bugfixes:

Use objects for hash value tracking - 7fcf9d2

Chore:

Resolve deprecation warning message from eslint while running eslint (#1586) - 7052e88
chore: add eslint-plugin-compat and eslint-plugin-es5 - 088e618

Compatibility notes:

No compatibility issues are to be expected

Commits

`v4.4.5`

Compare Source

Bugfixes:

Contents of raw-blocks must be matched with non-eager regex-matching - 8d5530e, #1579

Commits

`v4.4.4`

Compare Source

Bugfixes:

fix: prevent zero length tokens in raw-blocks (#1577, #1578) - f1752fe

Chore:

chore: link to s3 bucket with https, add "npm ci" to build instructions - 0b593bf

Compatibility notes:

no compatibility issues are expected

Commits

`v4.4.3`

Compare Source

Bugfixes

Typings:

add missing type fields to AST typings and add tests for them - 0440af2

Commits

`v4.4.2`

Compare Source

chore: fix grunt-saucelabs dependency - b7eada0

Commits

`v4.4.1`

Compare Source

#1562 - Error message for syntax error missing location in 4.2.1+

Commits

`v4.4.0`

Compare Source

Added support for iterable objects in {{#each}} helper (#1557) - cf7545e

Commits

`v4.3.5`

Compare Source

Error message for syntax error missing location in 4.2.1+ (#1562)

Commits

`v4.3.4`

Compare Source

fix: harden "propertyIsEnumerable"-check - ff4d827

Compatibility notes:

No incompatibilities are known.

Commits

`v4.3.3`

Compare Source

fix test case for browsers that do not support defineGetter - 8742bde

Commits

`v4.3.2`

Compare Source

Use Object.prototype.propertyIsEnumerable to check for constructors - 213c0bb, #1563

Compatibility notes:

There are no breaking changes

Commits

`v4.3.1`

Compare Source

Fixes:

do not break on precompiled templates from Handlebars >=4.0.0 <4.3.0 - 1266838, #1561
Ensure allowCallsToHelperMissing runtime option is optional in typings - 93444c5, 64ecb9e, #1560

Commits

`v4.3.0`

Compare Source

Fixes:

Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72

Features:

Add new runtime option allowCallsToHelperMissing to allow calling blockHelperMissing and helperMissing.

Breaking changes:

Compatibility notes:

Compiler revision increased - 06b7224
- This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0
  The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers
  to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest
  that you always recompile your templates with the latest compiler in your build pipelines.
Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
- Calling "helperMissing" and "blockHelperMissing" directly from a template (like in {{blockHelperMissing}} was
  never intended and was part of the exploits that have been revealed early in 2019
  (see Prototype Pollution with Remote Code Execution handlebars-lang/handlebars.js#1495). It is also part of a new exploit that
  is not captured by the earlier fix. In order to harden Handlebars against such exploits, calling thos helpers
  is now not possible anymore. Overriding those helpers is still possible.
- If you really need this behavior, you can set the runtime option allowCallsToHelperMissing to true and the
  calls will again be possible

Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump.

We consider it more important to resolve a major security issue than to maintain 100% compatibility.

Commits

`v4.2.2`

Compare Source

Error message for syntax error missing location in 4.2.1+ (#1562)

Commits

`v4.2.1`

Compare Source

Bugfixes:

The "browser" property in the package.json has been updated to use the common-js builds instead of the minified UMD - c55a7be, #1553

Compatibility notes:

No compatibility issues should arise

Commits

`v4.2.0`

Compare Source

Chore/Test:

Use custom grunt-saucelab with current sauce-connect proxy - f119497
Add framework for various integration tests - f9cce4d
Add integration test for webpack - a57b682

Bugfixes:

#1544 - Typescript types: knownHelpers doesnt allow for custom helpers (@NickCis)
#1534 - Add typings for "Handlebars.VM.resolvePartial (@AndrewLeedham)

Features:

#1540 - added "browser"-property to package.json, resolves #1102 (@ouijan)

Compatibility notes:

The new "browser"-property should not break anything, but you can never be sure. The integration test for webpack
shows that it works, but if it doesn't please open an issue.

Commits

`v4.1.2`

Compare Source

#1540 - added browser to package.json, resolves #1102 (@ouijan)

Compatibility notes:

We are not sure if imports via webpack are still working, which is why this release is a pre-release

Commits

`v4.1.1`

Compare Source

Bugfixes:

fix: add "runtime.d.ts" to allow "require('handlebars/runtime')" in TypeScript - 5cedd62

Refactorings:

replace "async" with "neo-async" - 048f2ce
use "substring"-function instead of "substr" - 445ae12

Compatibility notes:

This is a bugfix release. There are no breaking change and no new features.

Commits

`v4.1.0`

Compare Source

New Features

import TypeScript typings - 27ac1ee

Security fixes:

disallow access to the constructor in templates to prevent RCE - 42841c4, #1495

Housekeeping

chore: fix components/handlebars package.json and auto-update on release - bacd473
chore: Use node 10 to build handlebars - 78dd89c
chore/doc: Add more release docs - 6b87c21

Compatibility notes:

Access to class constructors (i.e. ({}).constructor) is now prohibited to prevent
Remote Code Execution. This means that following construct will no work anymore:

class SomeClass {
}

SomeClass.staticProperty = 'static'

var template = Handlebars.compile('{{constructor.staticProperty}}');
document.getElementById('output').innerHTML = template(new SomeClass());
// expected: 'static', but now this is empty.

This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #1495. We will not increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).

Commits

New features:

none

Various dependency updates

#1464 - Bump versions of grunt-plugins to 1.x
#1398 - Chore: updated various dev dependencies
upgrade uglify-js - d3d3942
Update grunt-eslint to 20.1.0 - 7729aa9
Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1 (73d5637)

Bugfixes:

components/handlebars.js#24 Add package.json to components shim
Updated source-map-package should work better with rollup#1463

Removed obsolete code:

unnecessary check - 0ddff8b
Use files field - 69c6ca5
Update jsfiddle to 4.0.11 - 8947dd0

Compatibility notes:

No compatibility issues are to be expected

Commits

`v4.0.11`

Compare Source

#1391 - uglify-js is unconditionally imported, but only listed as optional dependency (@Turbo87)
#1233 - Unable to build under windows - error at test:bin task (@blikblum)
Update (C) year in the LICENSE file - 21386b6

Compatibility notes:

This is a bugfix release. There are no breaking change and no new features.

Commits

`v4.0.10`

Compare Source

Fix regression in 4.0.9: Replace "Object.assign" (not support in IE) by "util/extend" - 0e953d1

Commits

`v4.0.9`

Compare Source

#1327 Handlebars.compile() does not modify "options" anymore
pending #1331 Attempts to build Handlebars in a Windows environment
- Fix build in windows - cc554a5
- Ensure LF line-edings in handlebars-template fixtures (*.hbs) - ed879a6
- Run integration test with node handlebars -a ... on Windows - 2e21e2b
- Ensure LF line-edings in lexer-files (*.l) - bdfdbea
- Force LF line-endings for spec/artifacts - b50ef03
- Use istanbul/lib/cli.js instead of node_modules/.bin/istanbul - 6e6269f
TravisCI: Publish valid semver tags independently of the branch - 7378f85

Compatibility notes:

No compatibility issues are expected.

Commits

`v4.0.8`

Compare Source

#1341 #1342 Allow partial-blocks to be executed without "options" (@nknapp) - a00c598

Compatibility notes:

No breaking changes

Commits

`v4.0.7`

Compare Source

#1319: Fix context-stack when calling block-helpers on null values (@nknapp) - c8f4b57
#1315 Parser: Change suffix to use ES6 default module export (@Turbo87)- b617375
#1290 #1252 Add more tests for partial-blocks and inline partials (@nknapp) - 63a8e0c
#1252 Using @partial-block twice in a template not possible (@nknapp) - 5a164d0
#1310 Avoid duplicate "sourceMappingURL=" lines. (@joonas-lahtinen) - 01b0f65
#1275 require('sys') is deprecated, using 'util' instead (@travnels) - 406f2ee
#1285 #1284 Make "column"-property of Errors enumerable (@nknapp) - a023cb4
#1285 Testcase to verify that compile-errors have a column-property (@nknapp) - c7dc353

Commits

`v4.0.6`

Compare Source

#1243 - Walk up data frames for nested @partial-block (@lawnsea)
#1210 - Add a new lightweight package based on handlebars in the README (@kabirbaidhya)
#1187 - Ensure that existing blockParams and depths are respected on dupe programs (@charleso)
#1191 - Added cory (@leo)
#1177 - Preserve License info in Closure Compiler (@gennadiylitvinyuk)
#1171 - Contributing doc fix: failing thats -> failing tests (@paulfalgout)
#1166 - Update license date (@timwangdev)
Update jsfiddle to point to latest - 959ee55 (originally dfc7554 by @kpdecker)
#1163 - Fix typos on decorators-api.md. (@adjohnson916)
Drop extra Error params - 8c19874 (originally 63fdb92 by @kpdecker)
#1153 - Add documentation for running tests to contributing.md (@ryanmurakami)
Avoid error in older browsers in test - 400916c (originally a6121ca by @kpdecker)
Update target browser test versions - fee2334 (originally 871c32a by @kpdecker)
Exclude coverage check in exception conditional - 32d6363 (originally 326734b by @kpdecker)
Fix throw when creating exception object in Safari - 20c965c (originally 2ea6119 by @kpdecker)
Update build for modern node versions - 6c9f98c (originally 8289c0b by @kpdecker)
#1135 - Relax depth check for context push - c393c81 (originally 25458fd by @kpdecker)

Commits

`v4.0.5`

Compare Source

#1132 - Update uglify-js to avoid vulnerability (@plynchnlm)
#1129 - Minified lib returns an empty string (@bricss)
Return current handlebars instance from noConflict - 685cf92
Add webpack to dev dependency to support npm 3 - 7a6c228
Further relax uglify dependency - 0a3b3c2
Include tests for minimized artifacts - c21118d
Fix lint errors under latest eslint - 9f59de9
Add print-script helper script - 98a6717

Commits

If you want to rebase/retry this PR, click this checkbox.

mend-for-github-com · 2022-07-06T11:53:10Z

Autoclosing Skipped

This PR has been flagged for autoclosing, however it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

Update dependency handlebars to ~4.7.4

f379782

mend-for-github-com bot added the security fix Security fix generated by WhiteSource label Feb 4, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency handlebars to ~4.7.4 #2

Update dependency handlebars to ~4.7.4 #2

mend-for-github-com bot commented Feb 4, 2022

mend-for-github-com bot commented Jul 6, 2022

Update dependency handlebars to ~4.7.4 #2

Are you sure you want to change the base?

Update dependency handlebars to ~4.7.4 #2

Conversation

mend-for-github-com bot commented Feb 4, 2022

Release Notes

mend-for-github-com bot commented Jul 6, 2022

Autoclosing Skipped