Update handlebars package due to a Security Vulnerability

[adelriosantiago]

Update handlebars package due to a Security Vulnerability

[adelriosantiago]

Explanation

The handlebars package is vulnerable to Prototype Pollution resulting from Improper Input Validation. Multiple functions in multiple files, as listed below, do not disallow the calling of helperMissing and blockHelperMissing helpers directly. This can enable an attacker to conduct remote code execution attacks by calling methods from object prototypes which should otherwise not have been called.

Vulnerable File(s) and Function(s)

package/lib/handlebars/compiler/javascript-compiler.js

package/dist/amd/handlebars/compiler/javascript-compiler.js

package/dist/cjs/handlebars/compiler/javascript-compiler.js

package/lib/handlebars/helpers/runtime.js

invokePartialWrapper()
package/dist/cjs/handlebars/helpers/runtime.js

invokePartialWrapper()
package/dist/amd/handlebars/helpers/runtime.js

invokePartialWrapper()
package/dist/handlebars.runtime.js

invokePartialWrapper()
package/dist/handlebars.runtime.amd.js

invokePartialWrapper()
package/dist/handlebars.js

invokePartialWrapper()
package/dist/handlebars.amd.js

invokePartialWrapper()
package/dist/handlebars.runtime.min.js

package/dist/handlebars.runtime.amd.min.js

package/dist/handlebars.min.js

package/dist/handlebars.amd.min.js

[UziTech]

@sahat could you merge this PR to remove the security vulnerability?

[pgnedoy]

@sahat please merge this PR

[adelriosantiago]

Any update on this? We currently rely on this package and we are unable to pass the security checklist.

@sahat

[Jupp56]

Should fix the issue without side effects; Changes on the handlebars side are non-breaking and tested.

[milo526]

@adelriosantiago Could you please update this MR to reflect the new advisories?

https://www.npmjs.com/advisories/1300
https://www.npmjs.com/advisories/1316
https://www.npmjs.com/advisories/1324
https://www.npmjs.com/advisories/1325

Remediation
Upgrade to version 4.5.3 or later.

[milo526]

Handlebars ^4.5.1 could still be vulnerable to Arbitrary Code Execution and Prototype Pollution. Please upgrade this to ^4.5.3

[adelriosantiago]

Fixed, updated the PR, thanks for the observation.

[UziTech]

I have finally gotten around to moving this repo to https://github.com/express-handlebars/express-handlebars/ any new development will be done on that repo.

handlebars is up to date in v4.0.0 so this can be closed.

[adelriosantiago]

Ok, closing this. Thanks!