fix: escape property names in compat mode (handlebars-lang#1736)

bitwiseman · May 18, 2021 · 30e3ed9 · 30e3ed9
1 parent 70d19e7
commit 30e3ed9
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 4 deletions.
diff --git a/lib/handlebars/compiler/javascript-compiler.js b/lib/handlebars/compiler/javascript-compiler.js
@@ -28,7 +28,12 @@ JavaScriptCompiler.prototype = {
     }
   },
   depthedLookup: function(name) {
-    return [this.aliasable('this.lookup'), '(depths, "', name, '")'];
+    return [
+      this.aliasable('this.lookup'),
+      '(depths, ',
+      JSON.stringify(name),
+      ')'
+    ];
   },
 
   compilerInfo: function() {

diff --git a/package-lock.json b/package-lock.json
diff --git a/spec/security.js b/spec/security.js
@@ -99,4 +99,26 @@ describe('security issues', function() {
             shouldCompileTo('{{lookup this "__proto__"}}', {}, '');
         });
     });
+
+  describe('escapes template variables', function() {
+    it('in compat mode', function() {
+      expectTemplate("{{'a\\b'}}")
+        .withCompileOptions({ compat: true })
+        .withInput({ 'a\\b': 'c' })
+        .toCompileTo('c');
+    });
+
+    it('in default mode', function() {
+      expectTemplate("{{'a\\b'}}")
+        .withCompileOptions()
+        .withInput({ 'a\\b': 'c' })
+        .toCompileTo('c');
+    });
+    it('in default mode', function() {
+      expectTemplate("{{'a\\b'}}")
+        .withCompileOptions({ strict: true })
+        .withInput({ 'a\\b': 'c' })
+        .toCompileTo('c');
+    });
+  });
 });