Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Release Notes
wycats/handlebars.js
### [`v4.3.0`](https://togithub.com/wycats/handlebars.js/blob/master/release-notes.md#v430---September-24th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.2...v4.3.0)
Fixes:
- Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72)
- Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72)
Features:
- Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`.
Breaking changes:
Compatibility notes:
- Compiler revision increased - [`06b7224`](https://togithub.com/wycats/handlebars.js/commit/06b7224)
- This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0
The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers
to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest
that you always recompile your templates with the latest compiler in your build pipelines.
- Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72)
- Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was
never intended and was part of the exploits that have been revealed early in 2019
(see [#1495](https://togithub.com/wycats/handlebars.js/issues/1495)). _It is also part of a new exploit that
is not captured by the earlier fix._ In order to harden Handlebars against such exploits, calling thos helpers
is now not possible anymore. _Overriding_ those helpers is still possible.
- If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the
calls will again be possible
Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump.
We consider it more important to resolve a major security issue than to maintain 100% compatibility.
[Commits](https://togithub.com/wycats/handlebars.js/compare/v4.2.1...v4.3.0)
### [`v4.2.2`](https://togithub.com/wycats/handlebars.js/compare/v4.2.1...v4.2.2)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.1...v4.2.2)
### [`v4.2.1`](https://togithub.com/wycats/handlebars.js/blob/master/release-notes.md#v421---September-20th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.0...v4.2.1)
Bugfixes:
- The "browser" property in the package.json has been updated to use the common-js builds instead of the minified UMD - [`c55a7be`](https://togithub.com/wycats/handlebars.js/commit/c55a7be), [#1553](https://togithub.com/wycats/handlebars.js/issues/1553)
Compatibility notes:
- No compatibility issues should arise
[Commits](https://togithub.com/wycats/handlebars.js/compare/v4.2.0...v4.2.1)
### [`v4.2.0`](https://togithub.com/wycats/handlebars.js/blob/master/release-notes.md#v420---September-3rd-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.1.2...v4.2.0)
Chore/Test:
- Use custom `grunt-saucelab` with current sauce-connect proxy - [`f119497`](https://togithub.com/wycats/handlebars.js/commit/f119497)
- Add framework for various integration tests - [`f9cce4d`](https://togithub.com/wycats/handlebars.js/commit/f9cce4d)
- Add integration test for webpack - [`a57b682`](https://togithub.com/wycats/handlebars.js/commit/a57b682)
Bugfixes:
- [#1544](https://togithub.com/wycats/handlebars.js/issues/1544) - Typescript types: `knownHelpers` doesnt allow for custom helpers ([@NickCis](https://api.github.com/users/NickCis))
- [#1534](https://togithub.com/wycats/handlebars.js/pull/1534) - Add typings for "Handlebars.VM.resolvePartial ([@AndrewLeedham](https://api.github.com/users/AndrewLeedham))
Features:
- [#1540](https://togithub.com/wycats/handlebars.js/pull/1540) - added "browser"-property to package.json, resolves [#1102](https://togithub.com/wycats/handlebars.js/issues/1102) ([@ouijan](https://api.github.com/users/ouijan))
Compatibility notes:
- The new "browser"-property should not break anything, but you can never be sure. The integration test for webpack
shows that it works, but if it doesn't please open an issue.
[Commits](https://togithub.com/wycats/handlebars.js/compare/v4.1.2-0...v4.2.0)
Renovate configuration
:date: Schedule: "" (UTC).
:vertical_traffic_light: Automerge: Disabled by config. Please merge this manually once you are satisfied.
:recycle: Rebasing: Whenever PR becomes conflicted, or if you tick the rebase/retry checkbox below.
:no_bell: Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box
This PR contains the following updates:
4.1.2->4.3.0GitHub Vulnerability Alerts
CVE-2019-19919
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Release Notes
wycats/handlebars.js
### [`v4.3.0`](https://togithub.com/wycats/handlebars.js/blob/master/release-notes.md#v430---September-24th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.2...v4.3.0) Fixes: - Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72) - Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72) Features: - Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`. Breaking changes: Compatibility notes: - Compiler revision increased - [`06b7224`](https://togithub.com/wycats/handlebars.js/commit/06b7224) - This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0 The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest that you always recompile your templates with the latest compiler in your build pipelines. - Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72) - Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was never intended and was part of the exploits that have been revealed early in 2019 (see [#1495](https://togithub.com/wycats/handlebars.js/issues/1495)). _It is also part of a new exploit that is not captured by the earlier fix._ In order to harden Handlebars against such exploits, calling thos helpers is now not possible anymore. _Overriding_ those helpers is still possible. - If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the calls will again be possible Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump. We consider it more important to resolve a major security issue than to maintain 100% compatibility. [Commits](https://togithub.com/wycats/handlebars.js/compare/v4.2.1...v4.3.0) ### [`v4.2.2`](https://togithub.com/wycats/handlebars.js/compare/v4.2.1...v4.2.2) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.1...v4.2.2) ### [`v4.2.1`](https://togithub.com/wycats/handlebars.js/blob/master/release-notes.md#v421---September-20th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.0...v4.2.1) Bugfixes: - The "browser" property in the package.json has been updated to use the common-js builds instead of the minified UMD - [`c55a7be`](https://togithub.com/wycats/handlebars.js/commit/c55a7be), [#1553](https://togithub.com/wycats/handlebars.js/issues/1553) Compatibility notes: - No compatibility issues should arise [Commits](https://togithub.com/wycats/handlebars.js/compare/v4.2.0...v4.2.1) ### [`v4.2.0`](https://togithub.com/wycats/handlebars.js/blob/master/release-notes.md#v420---September-3rd-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.1.2...v4.2.0) Chore/Test: - Use custom `grunt-saucelab` with current sauce-connect proxy - [`f119497`](https://togithub.com/wycats/handlebars.js/commit/f119497) - Add framework for various integration tests - [`f9cce4d`](https://togithub.com/wycats/handlebars.js/commit/f9cce4d) - Add integration test for webpack - [`a57b682`](https://togithub.com/wycats/handlebars.js/commit/a57b682) Bugfixes: - [#1544](https://togithub.com/wycats/handlebars.js/issues/1544) - Typescript types: `knownHelpers` doesnt allow for custom helpers ([@NickCis](https://api.github.com/users/NickCis)) - [#1534](https://togithub.com/wycats/handlebars.js/pull/1534) - Add typings for "Handlebars.VM.resolvePartial ([@AndrewLeedham](https://api.github.com/users/AndrewLeedham)) Features: - [#1540](https://togithub.com/wycats/handlebars.js/pull/1540) - added "browser"-property to package.json, resolves [#1102](https://togithub.com/wycats/handlebars.js/issues/1102) ([@ouijan](https://api.github.com/users/ouijan)) Compatibility notes: - The new "browser"-property should not break anything, but you can never be sure. The integration test for webpack shows that it works, but if it doesn't please open an issue. [Commits](https://togithub.com/wycats/handlebars.js/compare/v4.1.2-0...v4.2.0)Renovate configuration
:date: Schedule: "" (UTC).
:vertical_traffic_light: Automerge: Disabled by config. Please merge this manually once you are satisfied.
:recycle: Rebasing: Whenever PR becomes conflicted, or if you tick the rebase/retry checkbox below.
:no_bell: Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by WhiteSource Renovate. View repository job log here.