Further security issue

[nknapp]

Disallows calls to the helperMissing-helpers (#1558) didn't solve all the problem and another exploit was reported.

The exploit will be released well after the fix is in place to give people a chance to update.

Before filing issues, please check the following points first:

• Please don't open issues for security issues. Instead, file a report at https://www.npmjs.com/advisories/report?package=handlebars
• Have a look at https://github.com/wycats/handlebars.js/blob/master/CONTRIBUTING.md
• Read the FAQ at https://github.com/wycats/handlebars.js/blob/master/FAQ.md
• Use the jsfiddle-template at https://jsfiddle.net/4nbwjaqz/4/ to reproduce problems or bugs

This will probably help you to get a solution faster.
For bugs, it would be great to have a PR with a failing test-case.

[XhmikosR]

Is this fixed by 4.3.3?

[nknapp]

All proofs-of-concept that I have received so far are not working anymore with 4.3.3

I am still trying to work out if there are any ways circumvent my fixes. I cannot say for certain that everything is fixed.

[nknapp]

I have reported the fix of this issue to npm only yesterday. It may take them until next week to update the audit-database.

[NicoleG25]

Ah @nknapp , just came across this.. would you be able to confirm if there was a fix for CVE-2019-19919 made and if so in what commit/version release?

Thanks in advance !

[nknapp]

The npm advisory that is references in the CVE was resolved in 4.3.0.

There were variations that were possible until 4.5.3.

4.6.0 now provides a more complete solution.

I think the npm-security advisories give a more complete picture than CVEs.

[NicoleG25]

The npm advisory that is references in the CVE was resolved in 4.3.0.

There were variations that were possible until 4.5.3.

4.6.0 now provides a more complete solution.

I think the npm-security advisories give a more complete picture than CVEs.

Thanks for the quick response,
Was there another npm-security advisory issue opened for those variations that are now completely fixed in 4.6.0 or is the same issue referring to all of them?

Also, would you be able to kindly point out the commit fixing the issue in 4.6.0? :)