Disallow calling "helperMissing" and "blockHelperMissing" directly

[nknapp]

The recent remote-code-execution exploits where misusing the helper blockHelperMissing in order to call methods from object prototypes that actually should not have been called.

The helpers "helperMissing" and "blockHelperMissing" are not meant to be called directly as in

{{helperMissing}}
{{#helperMissing}}{{/helperMissing}}
{{blockHelperMissing arg}}
{{#blockHelperMissing arg}}{{/blockHelperMissing}}

We can offer a flag that allows execution in case someone really wants it, but the default will be not to allow this.

Note that although calling {{helperMissing}} from the template is not part of the documented API and I assume it makes no sense other then to build an exploit. From this point of view this is not a breaking change an will result in a minor version update only (because of the feature flag).

Even though it is not documented, I would rather try to maintain compatibility here, but since this a security-relevant change I will not do that in this case.

[NicoleG25]

@nknapp Does 7b67a29 fix CVE-2019-19919 ? :)

[nknapp]

Please look at the docs. Under api-reference -> runtime options. I have added links to all npm advisories regarding prototype access that are public so far. They contain the resolved versions. I think your CVE has an advisory linked, so you can compare it.

I can't post any links right now, doesn't work with my mobile phone.

[nknapp]

You can also search advisories. Just add a "search=handlebars" query param when you are on the advisory list at npmjs.com

[rohitchoudhary87]

MongoDB Connected
Handlebars: Access has been denied to resolve the property "name" because it is not an "own property" of its parent.
You can add a runtime option to disable the check or this warning:
See https://handlebarsjs.com/api-reference/runtime-options.html#options-to-control-prototype-access for details

hey
I am getting this error. please help

[nknapp]

Are you using handlebars directly in your project, or is it used by another dependency of yours?

[rohitchoudhary87]

I am using handlebars directly in the project.

…

On Sat, Jan 18, 2020 at 11:33 PM Nils Knappmeier ***@***.***> wrote: Are you using handlebars directly in your project, or is it used by another dependency of yours? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1558>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKSQTLN2YZEWI2VNAEEGZ4LQ6M77LANCNFSM4IY6IYTQ> .

[nknapp]

Have you had a look at the link to the documentation? It explains the thoughts behind the new limitation and the runtime-options that control it. If the documentation is not good enough, I would like to know what is missing. I can explain of here as well, but please have a look at the documentation before.

[rohitchoudhary87]

I have read the documentation but I unable to figure out the problem. earlier it was working just fine.
In this project, the fields are getting stored in the database.
but as soon as I try to fetch them out and show in the UI its showing this error.

//menu index
router.get('/index' , (req,res) => {
Menu.find({})
.then(menus => {
res.render('menu/index' , {
menus: menus,
});
});
});

in this block the error is generating when i output {{#each menus}} {{name}} {{/each}}

[nknapp]

The problem is that "name" is defined on the prototype of the object you are using as input. See #1635 for details about the change that forbids that.

You are not using handlebars directly. You are using "express-hbs" or something like that. I am not sure how to pass a runtime option to the template with that framework.

What handlebars-related dependencies do you have in your package.json exactly? I can look for a solution but there are multiple similar packages and I need to know which one you are using

[rohitchoudhary87]

I am using express handlebars.

"express-handlebars": "^3.1.0",

[nknapp]

I'd like to move this discussion to #1642, which I just created for this kind of question (I have some of them already)

[rohitchoudhary87]

Thank You @nknapp . I figured out the problem.