fix: check prototype property access in strict-mode (#1736)

handlebars-lang · Feb 13, 2021 · b6d3de7 · b6d3de7
1 parent f058970
commit b6d3de7
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/lib/handlebars/runtime.js b/lib/handlebars/runtime.js
@@ -124,7 +124,7 @@ export function template(templateSpec, env) {
           loc: loc
         });
       }
-      return obj[name];
+      return container.lookupProperty(obj, name);
     },
     lookupProperty: function(parent, propertyName) {
       let result = parent[propertyName];

diff --git a/spec/security.js b/spec/security.js
@@ -298,6 +298,10 @@ describe('security issues', function() {
         checkProtoPropertyAccess({ compat: true });
       });
 
+      describe('in strict-mode', function() {
+        checkProtoPropertyAccess({ strict: true });
+      });
+
       function checkProtoPropertyAccess(compileOptions) {
         it('should be prohibited by default and log a warning', function() {
           var spy = sinon.spy(console, 'error');