Backport security fixes to 3.x branch #1532
Conversation
- Handle path-separators properly. Use "path.sep" instead of "/". Or use "require.resolve()" if possible - Use "execFile" instead of "exec" to run the Handlebars executable. This prevents problems due to (missing) shell escaping. - Use explicit call to "node" in order to run the executable on Windows. - Add "appveyor"-CI in order to run regular tests on Windows.
Due to the way, "bin"-files are distributed into the node_modules/.bin directory on Windows, the task "test:cov" did not work on Windows. This commit uses the node-script directly.
|
@nknapp Can you take a look? |
|
Hello @mattolson, first of all, thanks for this PR. I think it looks good. I haven't backported the fix myself, because I haven't been able to reproduce the vulnerability with handlebary 3.x. This is mostly because "#with" helper does not exist in this version, but it is required for the exploits. I just hope this change breaks nobodys build... But it is hardly possible to know without publishing it. |
|
@nknapp Thanks for the merge. Can you put together a new release? Perhaps 3.1.0? |
|
This would be 3.0.7. To me its a fix, not a new feature. However, if people complain about the changes, I might rollback the changes. That didn't happen with 4.x though, so I don't expect it here as well. |
|
Ok, sounds good. Thank you! |
|
Released in 3.0.7 |
Backport the security fixes from 4.1.0 and 4.1.2 to the 3.x branch.
Other edits needed to get tests working on 3.x branch: