Fix handlebars-lang#1748 where allowed prototype methods are not called

aalimovs · Jul 25, 2023 · 5cae846 · 5cae846
1 parent 668c4fb
commit 5cae846
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/lib/handlebars/runtime.js b/lib/handlebars/runtime.js
@@ -136,6 +136,9 @@ export function template(templateSpec, env) {
       }
 
       if (resultIsAllowed(result, container.protoAccessControl, propertyName)) {
+        if (typeof result === 'function') {
+          return parent[propertyName]();
+        }
         return result;
       }
       return undefined;

diff --git a/spec/security.js b/spec/security.js
@@ -289,6 +289,17 @@ describe('security issues', function() {
           })
           .toCompileTo('abc');
       });
+
+      it('should call an allowed proto method', function() {
+        expectTemplate('{{aString.trim}}')
+          .withInput({ aString: '  abc  ' })
+          .withRuntimeOptions({
+            allowedProtoMethods: {
+              trim: true
+            }
+          })
+          .toCompileTo('abc');
+      });
     });
 
     describe('control access to prototype non-methods via "allowedProtoProperties" and "allowProtoPropertiesByDefault', function() {