allowProtoMethods/Properties runtime options do not work for nested objects

[vassudanagunta]

For example, given the following input:

function TestClass() {}
TestClass.prototype.aMethod = function() {
    return 'returnValue'
};
TestClass.prototype.nested = new TestClass()
const context = new TestClass()

the following,

const template = Handlebars.compile('{{nested.aMethod}}')
template(context, {allowProtoMethodsByDefault: true})

should yield 'returnValue'. Instead, it yields 'undefined'.

PR with failing test-cases submitted: #1859.

[vassudanagunta]

Workaround:

{{#with nested}}{{this.aMethod}}{{/with}}

The fact that this workaround works also shows fixing this issue does not increase access / loosen security, it would just restore API consistency, treating nested objects the same regardless of access mode.

The other option would be to disallow the workaround. This would at least restore consistency to the security restriction.