fix(deps): update dependency handlebars to v4.7.7 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
handlebars (source)	4.2.0 -> 4.7.7

GitHub Vulnerability Alerts

CVE-2019-19919

Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Recommendation

Upgrade to version 3.0.8, 4.3.0 or later.

GHSA-f52g-6jhx-586p

Affected versions of handlebars are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service.

Recommendation

Upgrade to version 4.4.5 or later.

GHSA-2cf5-4w76-r9qv

Versions of handlebars prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

The following template can be used to demonstrate the vulnerability:

Recommendation

Upgrade to version 3.0.8, 4.5.2 or later.

GHSA-g9r4-xpmj-mj65

Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.

Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.

GHSA-q2c6-c6pm-g3gh

Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a previous issue. This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.

CVE-2021-23369

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.

CVE-2019-20920

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

CVE-2021-23383

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

---

Release Notes

wycats/handlebars.js

v4.7.7

Compare Source

• fix weird error in integration tests - eb860c0
• fix: check prototype property access in strict-mode (#​1736) - b6d3de7
• fix: escape property names in compat mode (#​1736) - f058970
• refactor: In spec tests, use expectTemplate over equals and shouldThrow (#​1683) - 77825f8
• chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

• the changes from version 4.6.0 now also apply
  in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods
  can be allowed via runtime-options. See #​1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties
  from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

v4.7.6

Compare Source

Chore/Housekeeping:

• #​1672 - Switch cmd parser to latest minimist (@​dougwilson

Compatibility notes:

• Restored Node.js compatibility

Commits

v4.7.5

Compare Source

Chore/Housekeeping:

• ~Node.js version support has been changed to v6+~ Reverted in 4.7.6

Compatibility notes:

• ~Node.js < v6 is no longer supported~ Reverted in 4.7.6

Commits

v4.7.4

Compare Source

Chore/Housekeeping:

• #​1666 - Replaced minimist with yargs for handlebars CLI (@​aorinevo, @​AviVahl & @​fabb)

Compatibility notes:

• No incompatibilities are to be expected

Commits

v4.7.3

Compare Source

Chore/Housekeeping:

• #​1644 - Download links to aws broken on handlebarsjs.com - access denied (@​Tea56)
• Fix spelling and punctuation in changelog - d78cc73

Bugfixes:

• Add Type Definition for Handlebars.VERSION, Fixes #​1647 - 4de51fe
• Include Type Definition for runtime.js in Package - a32d05f

Compatibility notes:

• No incompatibilities are to be expected

Commits

v4.7.2

Compare Source

Bugfixes:

• fix: don't wrap helpers that are not functions - 9d5aa36, #​1639

Chore/Build:

• chore: execute saucelabs-task only if access-key exists - a4fd391

Compatibility notes:

• No breaking changes are to be expected

Commits

v4.7.1

Compare Source

Bugfixes:

• fix: fix log output in case of illegal property access - f152dfc
• fix: log error for illegal property access only once per property - 3c1e252

Compatibility notes:

• no incompatibilities are to be expected.

Commits

v4.7.0

Compare Source

Features:

• feat: default options for controlling proto access - 7af1c12, #​1635
  • This makes it possible to disable the prototype access restrictions added in 4.6.0
  • an error is logged in the console, if access to prototype properties is attempted and denied
    and no explicit configuration has taken place.

Compatibility notes:

• no compatibilities are expected

Commits

v4.6.0

Compare Source

Features:

• feat: access control to prototype properties via whitelist (#​1633)- d03b6ec

Bugfixes:

• fix(runtime.js): partials compile not caching (#​1600) - 23d58e7

Chores, docs:

• various refactorings and improvements to tests - d7f0dcf, 187d611, d337f40
• modernize the build-setup
  • use prettier to format and eslint to verify - c40d9f3, 8901c28, e97685e, 1f61f21
  • use nyc instead of istanbul to collect coverage - 164b7ff, 1ebce2b
  • update build code to use modern javascript and make it cleaner - 14b621c, 1ec1737, 3a5b65e, dde108e, 04b1984, 587e7a3
  • restructur build commands - e913dc5,
• eslint rule changes - ac4655e, dc54952
• Update (C) year in the LICENSE file - d1fb07b
• chore: try to fix saucelabs credentials (#​1627) -
• Update readme.md with updated links (#​1620) - edcc84f

BREAKING CHANGES:

• access to prototype properties is forbidden completely by default,
  specific properties or methods can be allowed via runtime-options.
  See #​1633 for details.
  If you are using Handlebars as documented, you should not be accessing prototype
  properties from your template anyway, so the changes should not be a problem
  for you. Only the use of undocumented features can break your build.

  That is why we only bump the minor version despite mentioning breaking changes.

Commits

v4.5.3

Compare Source

Bugfixes:

• fix: add "no-prototype-builtins" eslint-rule and fix all occurences - f7f05d7
• fix: add more properties required to be enumerable - 1988878

Chores / Build:

• fix: use !== 0 instead of != 0 - c02b05f
• add chai and dirty-chai and sinon, for cleaner test-assertions and spies,
  deprecate old assertion-methods - 93e284e, 886ba86, 0817dad, 93516a0

Security:

• The properties __proto__, __defineGetter__, __defineSetter__ and __lookupGetter__
  have been added to the list of "properties that must be enumerable".
  If a property by that name is found and not enumerable on its parent,
  it will silently evaluate to undefined. This is done in both the compiled template and the "lookup"-helper.
  This will prevent new Remote-Code-Execution exploits that have been
  published recently.

Compatibility notes:

• Due to the security-fixes. The semantics of the templates using
  __proto__, __defineGetter__, __defineSetter__ and __lookupGetter__ in the respect that those expression now return
  undefined rather than their actual value from the proto.
• The semantics have not changed in cases where the properties are enumerable, as in:

{
  __proto__: 'some string';
}

• The change may be breaking in that respect, but we still only
  increase the patch-version, because the incompatible use-cases
  are not intended, undocumented and far less important than fixing
  Remote-Code-Execution exploits on existing systems.

Commits

v4.5.2

Compare Source

v4.5.1

Compare Source

Bugfixs

• fix: move "eslint-plugin-compat" to devDependencies - 5e9d17f (#​1589)

Compatibility notes:

• No compatibility issues are to be expected

Commits

v4.5.0

Compare Source

Features / Improvements

• Add method Handlebars.parseWithoutProcessing (#​1584) - 62ed3c2
• add guard to if & unless helpers (#​1549)
• show source location for the strict lookup exceptions - feb60f8

Bugfixes:

• Use objects for hash value tracking - 7fcf9d2

Chore:

• Resolve deprecation warning message from eslint while running eslint (#​1586) - 7052e88
• chore: add eslint-plugin-compat and eslint-plugin-es5 - 088e618

Compatibility notes:

• No compatibility issues are to be expected

Commits

v4.4.5

Compare Source

Bugfixes:

• Contents of raw-blocks must be matched with non-eager regex-matching - 8d5530e, #​1579

Commits

v4.4.4

Compare Source

Bugfixes:

• fix: prevent zero length tokens in raw-blocks (#​1577, #​1578) - f1752fe

Chore:

• chore: link to s3 bucket with https, add "npm ci" to build instructions - 0b593bf

Compatibility notes:

• no compatibility issues are expected

Commits

v4.4.3

Compare Source

Bugfixes

Typings:

• add missing type fields to AST typings and add tests for them - 0440af2

Commits

v4.4.2

Compare Source

• chore: fix grunt-saucelabs dependency - b7eada0

Commits

v4.4.1

Compare Source

• #​1562 - Error message for syntax error missing location in 4.2.1+

Commits

v4.4.0

Compare Source

• Added support for iterable objects in {{#each}} helper (#​1557) - cf7545e

Commits

v4.3.5

Compare Source

• Error message for syntax error missing location in 4.2.1+ (#​1562)

Commits

v4.3.4

Compare Source

• fix: harden "propertyIsEnumerable"-check - ff4d827

Compatibility notes:

• No incompatibilities are known.

Commits

v4.3.3

Compare Source

• fix test case for browsers that do not support defineGetter - 8742bde

Commits

v4.3.2

Compare Source

• Use Object.prototype.propertyIsEnumerable to check for constructors - 213c0bb, #​1563

Compatibility notes:

• There are no breaking changes

Commits

v4.3.1

Compare Source

Fixes:

• do not break on precompiled templates from Handlebars >=4.0.0 <4.3.0 - 1266838, #​1561
• Ensure allowCallsToHelperMissing runtime option is optional in typings - 93444c5, 64ecb9e, #​1560

Commits

v4.3.0

Compare Source

Fixes:

• Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
• Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72

Features:

• Add new runtime option allowCallsToHelperMissing to allow calling blockHelperMissing and helperMissing.

Breaking changes:

Compatibility notes:

• Compiler revision increased - 06b7224

  • This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0
    The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers
    to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest
    that you always recompile your templates with the latest compiler in your build pipelines.

• Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72

  • Calling "helperMissing" and "blockHelperMissing" directly from a template (like in {{blockHelperMissing}} was
    never intended and was part of the exploits that have been revealed early in 2019
    (see Prototype Pollution with Remote Code Execution handlebars-lang/handlebars.js#1495). It is also part of a new exploit that
    is not captured by the earlier fix. In order to harden Handlebars against such exploits, calling thos helpers
    is now not possible anymore. Overriding those helpers is still possible.
  • If you really need this behavior, you can set the runtime option allowCallsToHelperMissing to true and the
    calls will again be possible

Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump.

We consider it more important to resolve a major security issue than to maintain 100% compatibility.

Commits

v4.2.2

Compare Source

• Error message for syntax error missing location in 4.2.1+ (#​1562)

Commits

v4.2.1

Compare Source

Bugfixes:

• The "browser" property in the package.json has been updated to use the common-js builds instead of the minified UMD - c55a7be, #​1553

Compatibility notes:

• No compatibility issues should arise

Commits

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by Mend Renovate. View repository job log here.