Skip to content
This repository has been archived by the owner on Dec 20, 2023. It is now read-only.

Update dependency handlebars to v4 (master) - autoclosed #313

Closed
wants to merge 1 commit into from
Closed

Update dependency handlebars to v4 (master) - autoclosed #313

wants to merge 1 commit into from

Conversation

appcues-wss[bot]
Copy link

@appcues-wss appcues-wss bot commented Jun 16, 2023

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
handlebars (source) ^1.0.0 -> ^4.0.0 age adoption passing confidence
handlebars (source) ~2.0.0 -> ~4.7.0 age adoption passing confidence

Release Notes

wycats/handlebars.js

v4.7.7

Compare Source

  • fix weird error in integration tests - eb860c0
  • fix: check prototype property access in strict-mode (#​1736) - b6d3de7
  • fix: escape property names in compat mode (#​1736) - f058970
  • refactor: In spec tests, use expectTemplate over equals and shouldThrow (#​1683) - 77825f8
  • chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

  • the changes from version 4.6.0 now also apply
    in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods
    can be allowed via runtime-options. See #​1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties
    from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

v4.7.6

Compare Source

Chore/Housekeeping:

Compatibility notes:

  • Restored Node.js compatibility

Commits

v4.7.5

Compare Source

Chore/Housekeeping:

  • ~Node.js version support has been changed to v6+~ Reverted in 4.7.6

Compatibility notes:

  • ~Node.js < v6 is no longer supported~ Reverted in 4.7.6

Commits

v4.7.4

Compare Source

Chore/Housekeeping:

Compatibility notes:

  • No incompatibilities are to be expected

Commits

v4.7.3

Compare Source

Chore/Housekeeping:

  • #​1644 - Download links to aws broken on handlebarsjs.com - access denied (@​Tea56)
  • Fix spelling and punctuation in changelog - d78cc73

Bugfixes:

  • Add Type Definition for Handlebars.VERSION, Fixes #​1647 - 4de51fe
  • Include Type Definition for runtime.js in Package - a32d05f

Compatibility notes:

  • No incompatibilities are to be expected

Commits

v4.7.2

Compare Source

Bugfixes:

Chore/Build:

  • chore: execute saucelabs-task only if access-key exists - a4fd391

Compatibility notes:

  • No breaking changes are to be expected

Commits

v4.7.1

Compare Source

Bugfixes:

  • fix: fix log output in case of illegal property access - f152dfc
  • fix: log error for illegal property access only once per property - 3c1e252

Compatibility notes:

  • no incompatibilities are to be expected.

Commits

v4.7.0

Compare Source

Features:

  • feat: default options for controlling proto access - 7af1c12, #​1635
    • This makes it possible to disable the prototype access restrictions added in 4.6.0
    • an error is logged in the console, if access to prototype properties is attempted and denied
      and no explicit configuration has taken place.

Compatibility notes:

  • no compatibilities are expected

Commits

v4.6.0

Compare Source

Features:

  • feat: access control to prototype properties via whitelist (#​1633)- d03b6ec

Bugfixes:

Chores, docs:

BREAKING CHANGES:

  • access to prototype properties is forbidden completely by default,
    specific properties or methods can be allowed via runtime-options.
    See #​1633 for details.
    If you are using Handlebars as documented, you should not be accessing prototype
    properties from your template anyway, so the changes should not be a problem
    for you. Only the use of undocumented features can break your build.

    That is why we only bump the minor version despite mentioning breaking changes.

Commits

v4.5.3

Compare Source

Bugfixes:

  • fix: add "no-prototype-builtins" eslint-rule and fix all occurences - f7f05d7
  • fix: add more properties required to be enumerable - 1988878

Chores / Build:

  • fix: use !== 0 instead of != 0 - c02b05f
  • add chai and dirty-chai and sinon, for cleaner test-assertions and spies,
    deprecate old assertion-methods - 93e284e, 886ba86, 0817dad, 93516a0

Security:

  • The properties __proto__, __defineGetter__, __defineSetter__ and __lookupGetter__
    have been added to the list of "properties that must be enumerable".
    If a property by that name is found and not enumerable on its parent,
    it will silently evaluate to undefined. This is done in both the compiled template and the "lookup"-helper.
    This will prevent new Remote-Code-Execution exploits that have been
    published recently.

Compatibility notes:

  • Due to the security-fixes. The semantics of the templates using
    __proto__, __defineGetter__, __defineSetter__ and __lookupGetter__ in the respect that those expression now return
    undefined rather than their actual value from the proto.
  • The semantics have not changed in cases where the properties are enumerable, as in:
{
  __proto__: 'some string';
}
  • The change may be breaking in that respect, but we still only
    increase the patch-version, because the incompatible use-cases
    are not intended, undocumented and far less important than fixing
    Remote-Code-Execution exploits on existing systems.

Commits

v4.5.2

Compare Source

v4.5.1

Compare Source

Bugfixs

Compatibility notes:

  • No compatibility issues are to be expected

Commits

v4.5.0

Compare Source

Features / Improvements

  • Add method Handlebars.parseWithoutProcessing (#​1584) - 62ed3c2
  • add guard to if & unless helpers (#​1549)
  • show source location for the strict lookup exceptions - feb60f8

Bugfixes:

  • Use objects for hash value tracking - 7fcf9d2

Chore:

  • Resolve deprecation warning message from eslint while running eslint (#​1586) - 7052e88
  • chore: add eslint-plugin-compat and eslint-plugin-es5 - 088e618

Compatibility notes:

  • No compatibility issues are to be expected

Commits

v4.4.5

Compare Source

Bugfixes:

  • Contents of raw-blocks must be matched with non-eager regex-matching - 8d5530e, #​1579

Commits

v4.4.4

Compare Source

Bugfixes:

Chore:

  • chore: link to s3 bucket with https, add "npm ci" to build instructions - 0b593bf

Compatibility notes:

  • no compatibility issues are expected

Commits

v4.4.3

Compare Source

Bugfixes

Typings:

  • add missing type fields to AST typings and add tests for them - 0440af2

Commits

v4.4.2

Compare Source

  • chore: fix grunt-saucelabs dependency - b7eada0

Commits

v4.4.1

Compare Source

  • #​1562 - Error message for syntax error missing location in 4.2.1+

Commits

v4.4.0

Compare Source

  • Added support for iterable objects in {{#each}} helper (#​1557) - cf7545e

Commits

v4.3.5

Compare Source

  • Error message for syntax error missing location in 4.2.1+ (#​1562)

Commits

v4.3.4

Compare Source

  • fix: harden "propertyIsEnumerable"-check - ff4d827

Compatibility notes:

  • No incompatibilities are known.

Commits

v4.3.3

Compare Source

  • fix test case for browsers that do not support defineGetter - 8742bde

Commits

v4.3.2

Compare Source

  • Use Object.prototype.propertyIsEnumerable to check for constructors - 213c0bb, #​1563

Compatibility notes:

  • There are no breaking changes

Commits

v4.3.1

Compare Source

Fixes:

  • do not break on precompiled templates from Handlebars >=4.0.0 <4.3.0 - 1266838, #​1561
  • Ensure allowCallsToHelperMissing runtime option is optional in typings - 93444c5, 64ecb9e, #​1560

Commits

v4.3.0

Compare Source

Fixes:

  • Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
  • Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72

Features:

  • Add new runtime option allowCallsToHelperMissing to allow calling blockHelperMissing and helperMissing.

Breaking changes:

Compatibility notes:

  • Compiler revision increased - 06b7224

    • This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0
      The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers
      to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest
      that you always recompile your templates with the latest compiler in your build pipelines.

  • Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72

    • Calling "helperMissing" and "blockHelperMissing" directly from a template (like in {{blockHelperMissing}} was
      never intended and was part of the exploits that have been revealed early in 2019
      (see Prototype Pollution with Remote Code Execution handlebars-lang/handlebars.js#1495). It is also part of a new exploit that
      is not captured by the earlier fix.       In order to harden Handlebars against such exploits, calling thos helpers
      is now not possible anymore. Overriding those helpers is still possible.
    • If you really need this behavior, you can set the runtime option allowCallsToHelperMissing to true and the
      calls will again be possible

Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump.

We consider it more important to resolve a major security issue than to maintain 100% compatibility.

Commits

v4.2.2

Compare Source

  • Error message for syntax error missing location in 4.2.1+ (#​1562)

Commits

v4.2.1

Compare Source

Bugfixes:

  • The "browser" property in the package.json has been updated to use the common-js builds instead of the minified UMD - c55a7be, #​1553

Compatibility notes:

  • No compatibility issues should arise

Commits

v4.2.0

Compare Source

Chore/Test:

  • Use custom grunt-saucelab with current sauce-connect proxy - f119497
  • Add framework for various integration tests - f9cce4d
  • Add integration test for webpack - a57b682

Bugfixes:

Features:

Compatibility notes:

  • The new "browser"-property should not break anything, but you can never be sure. The integration test for webpack
    shows that it works, but if it doesn't please open an issue.

Commits

v4.1.2

Compare Source

#​1540 - added browser to package.json, resolves #​1102 (@​ouijan)

Compatibility notes:

  • We are not sure if imports via webpack are still working, which is why this release is a pre-release

Commits

v4.1.1

Compare Source

Bugfixes:

  • fix: add "runtime.d.ts" to allow "require('handlebars/runtime')" in TypeScript - 5cedd62

Refactorings:

  • replace "async" with "neo-async" - 048f2ce
  • use "substring"-function instead of "substr" - 445ae12

Compatibility notes:

  • This is a bugfix release. There are no breaking change and no new features.

Commits

v4.1.0

Compare Source

New Features

  • import TypeScript typings - 27ac1ee

Security fixes:

  • disallow access to the constructor in templates to prevent RCE - 42841c4, #​1495

Housekeeping

  • chore: fix components/handlebars package.json and auto-update on release - bacd473
  • chore: Use node 10 to build handlebars - 78dd89c
  • chore/doc: Add more release docs - 6b87c21

Compatibility notes:

Access to class constructors (i.e. ({}).constructor) is now prohibited to prevent
Remote Code Execution. This means that following construct will no work anymore:

class SomeClass {
}

SomeClass.staticProperty = 'static'

var template = Handlebars.compile('{{constructor.staticProperty}}');
document.getElementById('output').innerHTML = template(new SomeClass());
// expected: 'static', but now this is empty.

This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #​1495. We will not increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).

Commits

v4.0.14

Compare Source

v4.0.13

Compare Source

v4.0.12

Compare Source

New features:

  • none

Various dependency updates

  • #​1464 - Bump versions of grunt-plugins to 1.x
  • #​1398 - Chore: updated various dev dependencies
  • upgrade uglify-js - d3d3942
  • Update grunt-eslint to 20.1.0 - 7729aa9
  • Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1 (73d5637)

Bugfixes:

Removed obsolete code:

Compatibility notes:

  • No compatibility issues are to be expected

Commits

v4.0.11

Compare Source

  • #​1391 - uglify-js is unconditionally imported, but only listed as optional dependency (@​Turbo87)
  • #​1233 - Unable to build under windows - error at test:bin task (@​blikblum)
  • Update (C) year in the LICENSE file - 21386b6

Compatibility notes:

  • This is a bugfix release. There are no breaking change and no new features.

Commits

v4.0.10

Compare Source

  • Fix regression in 4.0.9: Replace "Object.assign" (not support in IE) by "util/extend" - 0e953d1

Commits

v4.0.9

Compare Source

  • #​1327 Handlebars.compile() does not modify "options" anymore
  • pending #​1331 Attempts to build Handlebars in a Windows environment
    • Fix build in windows - cc554a5
    • Ensure LF line-edings in handlebars-template fixtures (*.hbs) - ed879a6
    • Run integration test with node handlebars -a ... on Windows - 2e21e2b
    • Ensure LF line-edings in lexer-files (*.l) - bdfdbea
    • Force LF line-endings for spec/artifacts - b50ef03
    • Use istanbul/lib/cli.js instead of node_modules/.bin/istanbul - 6e6269f
  • TravisCI: Publish valid semver tags independently of the branch - 7378f85

Compatibility notes:

  • No compatibility issues are expected.

Commits

v4.0.8

Compare Source

Compatibility notes:

  • No breaking changes

Commits

v4.0.7

Compare Source

Commits

v4.0.6

Compare Source

Commits

v4.0.5

Compare Source

  • #​1132 - Update uglify-js to avoid vulnerability (@​plynchnlm)
  • #​1129 - Minified lib returns an empty string (@​bricss)
  • Return current handlebars instance from noConflict - 685cf92
  • Add webpack to dev dependency to support npm 3 - 7a6c228
  • Further relax uglify dependency - 0a3b3c2
  • Include tests for minimized artifacts - c21118d
  • Fix lint errors under latest eslint - 9f59de9
  • Add print-script helper script - 98a6717

Commits

v4.0.4

Compare Source

Commits

v4.0.3

Compare Source

Compatibility notes:

  • each iteration with undefined values has been restored to the 3.0 behaviors. Helper calls with undefined context values will now execute against an arbitrary empty object to avoid executing against global object in non-strict mode.
  • ] can now be included in [] wrapped identifiers by escaping with \. Any [] identifiers that include \ will now have to properly escape these values.

Commits

v4.0.2

Compare Source

Commits

v4.0.1

Compare Source

New features:

  • none

Various dependency updates

  • #​1464 - Bump versions of grunt-plugins to 1.x
  • #​1398 - Chore: updated various dev dependencies
  • upgrade uglify-js - d3d3942
  • Update grunt-eslint to 20.1.0 - 7729aa9
  • Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1 (73d5637)

Bugfixes:

Removed obsolete code:

Compatibility notes:

  • No compatibility issues are to be expected

Commits

v4.0.0

Compare Source

Compatibility notes:

  • Depthed paths are now conditionally pushed on to the stack. If the helper uses the same context, then a new stack is not created. This leads to behavior that better matches expectations for helpers like if that do not seem to alter the context. Any instances of ../ in templates will need to be checked for the correct behavior under 4.0.0. In general templates will either reduce the number of ../ instances or leave them as is. See #​1028.
  • The = character is now HTML escaped. This closes a potential exploit case when using unquoted attributes, i.e. <div foo={{bar}}>. In general it's recommended that attributes always be quoted when their values are generated from a mustache to avoid any potential exploit surfaces.
  • AST constructors have been dropped in favor of plain old javascript objects
  • The runtime version has been increased. Precompiled templates will need to use runtime of at least 4.0.0.

Commits

v3.0.8

Compare Source

v3.0.7

Compare Source

v3.0.6

Compare Source

v3.0.5

Compare Source

v3.0.4

Compare Source

v3.0.3

Compare Source

Commits

v3.0.2

Compare Source

Commits

v3.0.1

Compare Source

Commits

v3.0.0

Compare Source

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, click this checkbox.

@appcues-wss appcues-wss bot changed the title Update dependency handlebars to v4 (master) Update dependency handlebars to v4 (master) - autoclosed Jun 16, 2023
@appcues-wss appcues-wss bot closed this Jun 16, 2023
@appcues-wss appcues-wss bot deleted the whitesource-remediate/master-handlebars-4.x branch June 16, 2023 14:31
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants