Skip to content

Commit b1d1aa8

Browse files
committed
Fix #1748 where allowed prototype methods are not called
1 parent c65c6cc commit b1d1aa8

File tree

2 files changed

+14
-0
lines changed

2 files changed

+14
-0
lines changed

lib/handlebars/runtime.js

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,9 @@ export function template(templateSpec, env) {
136136
}
137137

138138
if (resultIsAllowed(result, container.protoAccessControl, propertyName)) {
139+
if (typeof result === 'function') {
140+
return parent[propertyName]();
141+
}
139142
return result;
140143
}
141144
return undefined;

spec/security.js

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,17 @@ describe('security issues', function() {
289289
})
290290
.toCompileTo('abc');
291291
});
292+
293+
it('should call an allowed proto method', function() {
294+
expectTemplate('{{aString.trim}}')
295+
.withInput({ aString: ' abc ' })
296+
.withRuntimeOptions({
297+
allowedProtoMethods: {
298+
trim: true
299+
}
300+
})
301+
.toCompileTo('abc');
302+
});
292303
});
293304

294305
describe('control access to prototype non-methods via "allowedProtoProperties" and "allowProtoPropertiesByDefault', function() {

0 commit comments

Comments
 (0)