diff --git a/lib/handlebars/runtime.js b/lib/handlebars/runtime.js index 67a500d7..36bf6c94 100644 --- a/lib/handlebars/runtime.js +++ b/lib/handlebars/runtime.js @@ -124,7 +124,7 @@ export function template(templateSpec, env) { loc: loc }); } - return obj[name]; + return container.lookupProperty(obj, name); }, lookupProperty: function(parent, propertyName) { let result = parent[propertyName]; diff --git a/spec/security.js b/spec/security.js index 2bc66f71..00eb1318 100644 --- a/spec/security.js +++ b/spec/security.js @@ -298,6 +298,10 @@ describe('security issues', function() { checkProtoPropertyAccess({ compat: true }); }); + describe('in strict-mode', function() { + checkProtoPropertyAccess({ strict: true }); + }); + function checkProtoPropertyAccess(compileOptions) { it('should be prohibited by default and log a warning', function() { var spy = sinon.spy(console, 'error');