handlebars/dist/amd/handlebars/internal/proto-access.js

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

define(['exports', '../utils', '../logger'], function (exports, _utils, _logger) {
  'use strict';

  exports.__esModule = true;
  exports.createProtoAccessControl = createProtoAccessControl;
  exports.resultIsAllowed = resultIsAllowed;
  exports.isPrototypeConstructor = isPrototypeConstructor;
  exports.resetLoggedProperties = resetLoggedProperties;
  // istanbul ignore next

  function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { 'default': obj }; }

  var _logger2 = _interopRequireDefault(_logger);

  var loggedProperties = Object.create(null);

  function createProtoAccessControl(runtimeOptions) {
    // Create an object with "null"-prototype to avoid truthy results on
    // prototype properties.
    var propertyWhiteList = Object.create(null);
    // eslint-disable-next-line no-proto
    propertyWhiteList['__proto__'] = false;
    _utils.extend(propertyWhiteList, runtimeOptions.allowedProtoProperties);

    var methodWhiteList = Object.create(null);
    methodWhiteList['constructor'] = false;
    methodWhiteList['__defineGetter__'] = false;
    methodWhiteList['__defineSetter__'] = false;
    methodWhiteList['__lookupGetter__'] = false;
    methodWhiteList['__lookupSetter__'] = false;
    _utils.extend(methodWhiteList, runtimeOptions.allowedProtoMethods);

    return {
      properties: {
        whitelist: propertyWhiteList,
        defaultValue: runtimeOptions.allowProtoPropertiesByDefault
      },
      methods: {
        whitelist: methodWhiteList,
        defaultValue: runtimeOptions.allowProtoMethodsByDefault
      }
    };
  }

  function resultIsAllowed(result, protoAccessControl, propertyName) {
    if (typeof result === 'function') {
      return checkWhiteList(protoAccessControl.methods, propertyName);
    } else {
      return checkWhiteList(protoAccessControl.properties, propertyName);
    }
  }

  /**
   * Detect a prototype object's own "constructor" back-reference, e.g.
   * `Function.prototype.constructor === Function`. Because "constructor" is an
   * "own" property of such objects, it would otherwise bypass the prototype-access
   * checks and expose dangerous constructors (allowing arbitrary code execution).
   *
   * Only functions can be constructors, so other values are never treated as one
   * and their `prototype` is never read.
   *
   * @param {*} parent the object the property is being read from
   * @param {string} propertyName the property being looked up
   * @param {*} result the already-resolved value of `parent[propertyName]`
   * @returns {boolean} true if the lookup resolves `parent`'s own constructor
   */

  function isPrototypeConstructor(parent, propertyName, result) {
    return propertyName === 'constructor' && typeof result === 'function' && parent === result.prototype;
  }

  function checkWhiteList(protoAccessControlForType, propertyName) {
    if (protoAccessControlForType.whitelist[propertyName] !== undefined) {
      return protoAccessControlForType.whitelist[propertyName] === true;
    }
    if (protoAccessControlForType.defaultValue !== undefined) {
      return protoAccessControlForType.defaultValue;
    }
    logUnexpecedPropertyAccessOnce(propertyName);
    return false;
  }

  function logUnexpecedPropertyAccessOnce(propertyName) {
    if (loggedProperties[propertyName] !== true) {
      loggedProperties[propertyName] = true;
      _logger2['default'].log('error', 'Handlebars: Access has been denied to resolve the property "' + propertyName + '" because it is not an "own property" of its parent.\n' + 'You can add a runtime option to disable the check or this warning:\n' + 'See https://handlebarsjs.com/api-reference/runtime-options.html#options-to-control-prototype-access for details');
    }
  }

  function resetLoggedProperties() {
    Object.keys(loggedProperties).forEach(function (propertyName) {
      delete loggedProperties[propertyName];
    });
  }
});
//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL2xpYi9oYW5kbGViYXJzL2ludGVybmFsL3Byb3RvLWFjY2Vzcy5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7OztBQUdBLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQzs7QUFFdEMsV0FBUyx3QkFBd0IsQ0FBQyxjQUFjLEVBQUU7OztBQUd2RCxRQUFNLGlCQUFpQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7O0FBRTlDLHFCQUFpQixDQUFDLFdBQVcsQ0FBQyxHQUFHLEtBQUssQ0FBQztBQUN2QyxXQVhPLE1BQU0sQ0FXTixpQkFBaUIsRUFBRSxjQUFjLENBQUMsc0JBQXNCLENBQUMsQ0FBQzs7QUFFakUsUUFBTSxlQUFlLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUM1QyxtQkFBZSxDQUFDLGFBQWEsQ0FBQyxHQUFHLEtBQUssQ0FBQztBQUN2QyxtQkFBZSxDQUFDLGtCQUFrQixDQUFDLEdBQUcsS0FBSyxDQUFDO0FBQzVDLG1CQUFlLENBQUMsa0JBQWtCLENBQUMsR0FBRyxLQUFLLENBQUM7QUFDNUMsbUJBQWUsQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLEtBQUssQ0FBQztBQUM1QyxtQkFBZSxDQUFDLGtCQUFrQixDQUFDLEdBQUcsS0FBSyxDQUFDO0FBQzVDLFdBbkJPLE1BQU0sQ0FtQk4sZUFBZSxFQUFFLGNBQWMsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDOztBQUU1RCxXQUFPO0FBQ0wsZ0JBQVUsRUFBRTtBQUNWLGlCQUFTLEVBQUUsaUJBQWlCO0FBQzVCLG9CQUFZLEVBQUUsY0FBYyxDQUFDLDZCQUE2QjtPQUMzRDtBQUNELGFBQU8sRUFBRTtBQUNQLGlCQUFTLEVBQUUsZUFBZTtBQUMxQixvQkFBWSxFQUFFLGNBQWMsQ0FBQywwQkFBMEI7T0FDeEQ7S0FDRixDQUFDO0dBQ0g7O0FBRU0sV0FBUyxlQUFlLENBQUMsTUFBTSxFQUFFLGtCQUFrQixFQUFFLFlBQVksRUFBRTtBQUN4RSxRQUFJLE9BQU8sTUFBTSxLQUFLLFVBQVUsRUFBRTtBQUNoQyxhQUFPLGNBQWMsQ0FBQyxrQkFBa0IsQ0FBQyxPQUFPLEVBQUUsWUFBWSxDQUFDLENBQUM7S0FDakUsTUFBTTtBQUNMLGFBQU8sY0FBYyxDQUFDLGtCQUFrQixDQUFDLFVBQVUsRUFBRSxZQUFZLENBQUMsQ0FBQztLQUNwRTtHQUNGOzs7Ozs7Ozs7Ozs7Ozs7OztBQWdCTSxXQUFTLHNCQUFzQixDQUFDLE1BQU0sRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFO0FBQ25FLFdBQ0UsWUFBWSxLQUFLLGFBQWEsSUFDOUIsT0FBTyxNQUFNLEtBQUssVUFBVSxJQUM1QixNQUFNLEtBQUssTUFBTSxDQUFDLFNBQVMsQ0FDM0I7R0FDSDs7QUFFRCxXQUFTLGNBQWMsQ0FBQyx5QkFBeUIsRUFBRSxZQUFZLEVBQUU7QUFDL0QsUUFBSSx5QkFBeUIsQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLEtBQUssU0FBUyxFQUFFO0FBQ25FLGFBQU8seUJBQXlCLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxLQUFLLElBQUksQ0FBQztLQUNuRTtBQUNELFFBQUkseUJBQXlCLENBQUMsWUFBWSxLQUFLLFNBQVMsRUFBRTtBQUN4RCxhQUFPLHlCQUF5QixDQUFDLFlBQVksQ0FBQztLQUMvQztBQUNELGtDQUE4QixDQUFDLFlBQVksQ0FBQyxDQUFDO0FBQzdDLFdBQU8sS0FBSyxDQUFDO0dBQ2Q7O0FBRUQsV0FBUyw4QkFBOEIsQ0FBQyxZQUFZLEVBQUU7QUFDcEQsUUFBSSxnQkFBZ0IsQ0FBQyxZQUFZLENBQUMsS0FBSyxJQUFJLEVBQUU7QUFDM0Msc0JBQWdCLENBQUMsWUFBWSxDQUFDLEdBQUcsSUFBSSxDQUFDO0FBQ3RDLDBCQUFPLEdBQUcsQ0FDUixPQUFPLEVBQ1AsaUVBQStELFlBQVksb0lBQ0gsb0hBQzJDLENBQ3BILENBQUM7S0FDSDtHQUNGOztBQUVNLFdBQVMscUJBQXFCLEdBQUc7QUFDdEMsVUFBTSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxVQUFBLFlBQVksRUFBSTtBQUNwRCxhQUFPLGdCQUFnQixDQUFDLFlBQVksQ0FBQyxDQUFDO0tBQ3ZDLENBQUMsQ0FBQztHQUNKIiwiZmlsZSI6InByb3RvLWFjY2Vzcy5qcyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGV4dGVuZCB9IGZyb20gJy4uL3V0aWxzJztcbmltcG9ydCBsb2dnZXIgZnJvbSAnLi4vbG9nZ2VyJztcblxuY29uc3QgbG9nZ2VkUHJvcGVydGllcyA9IE9iamVjdC5jcmVhdGUobnVsbCk7XG5cbmV4cG9ydCBmdW5jdGlvbiBjcmVhdGVQcm90b0FjY2Vzc0NvbnRyb2wocnVudGltZU9wdGlvbnMpIHtcbiAgLy8gQ3JlYXRlIGFuIG9iamVjdCB3aXRoIFwibnVsbFwiLXByb3RvdHlwZSB0byBhdm9pZCB0cnV0aHkgcmVzdWx0cyBvblxuICAvLyBwcm90b3R5cGUgcHJvcGVydGllcy5cbiAgY29uc3QgcHJvcGVydHlXaGl0ZUxpc3QgPSBPYmplY3QuY3JlYXRlKG51bGwpO1xuICAvLyBlc2xpbnQtZGlzYWJsZS1uZXh0LWxpbmUgbm8tcHJvdG9cbiAgcHJvcGVydHlXaGl0ZUxpc3RbJ19fcHJvdG9fXyddID0gZmFsc2U7XG4gIGV4dGVuZChwcm9wZXJ0eVdoaXRlTGlzdCwgcnVudGltZU9wdGlvbnMuYWxsb3dlZFByb3RvUHJvcGVydGllcyk7XG5cbiAgY29uc3QgbWV0aG9kV2hpdGVMaXN0ID0gT2JqZWN0LmNyZWF0ZShudWxsKTtcbiAgbWV0aG9kV2hpdGVMaXN0Wydjb25zdHJ1Y3RvciddID0gZmFsc2U7XG4gIG1ldGhvZFdoaXRlTGlzdFsnX19kZWZpbmVHZXR0ZXJfXyddID0gZmFsc2U7XG4gIG1ldGhvZFdoaXRlTGlzdFsnX19kZWZpbmVTZXR0ZXJfXyddID0gZmFsc2U7XG4gIG1ldGhvZFdoaXRlTGlzdFsnX19sb29rdXBHZXR0ZXJfXyddID0gZmFsc2U7XG4gIG1ldGhvZFdoaXRlTGlzdFsnX19sb29rdXBTZXR0ZXJfXyddID0gZmFsc2U7XG4gIGV4dGVuZChtZXRob2RXaGl0ZUxpc3QsIHJ1bnRpbWVPcHRpb25zLmFsbG93ZWRQcm90b01ldGhvZHMpO1xuXG4gIHJldHVybiB7XG4gICAgcHJvcGVydGllczoge1xuICAgICAgd2hpdGVsaXN0OiBwcm9wZXJ0eVdoaXRlTGlzdCxcbiAgICAgIGRlZmF1bHRWYWx1ZTogcnVudGltZU9wdGlvbnMuYWxsb3dQcm90b1Byb3BlcnRpZXNCeURlZmF1bHRcbiAgICB9LFxuICAgIG1ldGhvZHM6IHtcbiAgICAgIHdoaXRlbGlzdDogbWV0aG9kV2hpdGVMaXN0LFxuICAgICAgZGVmYXVsdFZhbHVlOiBydW50aW1lT3B0aW9ucy5hbGxvd1Byb3RvTWV0aG9kc0J5RGVmYXVsdFxuICAgIH1cbiAgfTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIHJlc3VsdElzQWxsb3dlZChyZXN1bHQsIHByb3RvQWNjZXNzQ29udHJvbCwgcHJvcGVydHlOYW1lKSB7XG4gIGlmICh0eXBlb2YgcmVzdWx0ID09PSAnZnVuY3Rpb24nKSB7XG4gICAgcmV0dXJuIGNoZWNrV2hpdGVMaXN0KHByb3RvQWNjZXNzQ29udHJvbC5tZXRob2RzLCBwcm9wZXJ0eU5hbWUpO1xuICB9IGVsc2Uge1xuICAgIHJldHVybiBjaGVja1doaXRlTGlzdChwcm90b0FjY2Vzc0NvbnRyb2wucHJvcGVydGllcywgcHJvcGVydHlOYW1lKTtcbiAgfVxufVxuXG4vKipcbiAqIERldGVjdCBhIHByb3RvdHlwZSBvYmplY3QncyBvd24gXCJjb25zdHJ1Y3RvclwiIGJhY2stcmVmZXJlbmNlLCBlLmcuXG4gKiBgRnVuY3Rpb24ucHJvdG90eXBlLmNvbnN0cnVjdG9yID09PSBGdW5jdGlvbmAuIEJlY2F1c2UgXCJjb25zdHJ1Y3RvclwiIGlzIGFuXG4gKiBcIm93blwiIHByb3BlcnR5IG9mIHN1Y2ggb2JqZWN0cywgaXQgd291bGQgb3RoZXJ3aXNlIGJ5cGFzcyB0aGUgcHJvdG90eXBlLWFjY2Vzc1xuICogY2hlY2tzIGFuZCBleHBvc2UgZGFuZ2Vyb3VzIGNvbnN0cnVjdG9ycyAoYWxsb3dpbmcgYXJiaXRyYXJ5IGNvZGUgZXhlY3V0aW9uKS5cbiAqXG4gKiBPbmx5IGZ1bmN0aW9ucyBjYW4gYmUgY29uc3RydWN0b3JzLCBzbyBvdGhlciB2YWx1ZXMgYXJlIG5ldmVyIHRyZWF0ZWQgYXMgb25lXG4gKiBhbmQgdGhlaXIgYHByb3RvdHlwZWAgaXMgbmV2ZXIgcmVhZC5cbiAqXG4gKiBAcGFyYW0geyp9IHBhcmVudCB0aGUgb2JqZWN0IHRoZSBwcm9wZXJ0eSBpcyBiZWluZyByZWFkIGZyb21cbiAqIEBwYXJhbSB7c3RyaW5nfSBwcm9wZXJ0eU5hbWUgdGhlIHByb3BlcnR5IGJlaW5nIGxvb2tlZCB1cFxuICogQHBhcmFtIHsqfSByZXN1bHQgdGhlIGFscmVhZHktcmVzb2x2ZWQgdmFsdWUgb2YgYHBhcmVudFtwcm9wZXJ0eU5hbWVdYFxuICogQHJldHVybnMge2Jvb2xlYW59IHRydWUgaWYgdGhlIGxvb2t1cCByZXNvbHZlcyBgcGFyZW50YCdzIG93biBjb25zdHJ1Y3RvclxuICovXG5leHBvcnQgZnVuY3Rpb24gaXNQcm90b3R5cGVDb25zdHJ1Y3RvcihwYXJlbnQsIHByb3BlcnR5TmFtZSwgcmVzdWx0KSB7XG4gIHJldHVybiAoXG4gICAgcHJvcGVydHlOYW1lID09PSAnY29uc3RydWN0b3InICYmXG4gICAgdHlwZW9mIHJlc3VsdCA9PT0gJ2Z1bmN0aW9uJyAmJlxuICAgIHBhcmVudCA9PT0gcmVzdWx0LnByb3RvdHlwZVxuICApO1xufVxuXG5mdW5jdGlvbiBjaGVja1doaXRlTGlzdChwcm90b0FjY2Vzc0NvbnRyb2xGb3JUeXBlLCBwcm9wZXJ0eU5hbWUpIHtcbiAgaWYgKHByb3RvQWNjZXNzQ29udHJvbEZvclR5cGUud2hpdGVsaXN0W3Byb3BlcnR5TmFtZV0gIT09IHVuZGVmaW5lZCkge1xuICAgIHJldHVybiBwcm90b0FjY2Vzc0NvbnRyb2xGb3JUeXBlLndoaXRlbGlzdFtwcm9wZXJ0eU5hbWVdID09PSB0cnVlO1xuICB9XG4gIGlmIChwcm90b0FjY2Vzc0NvbnRyb2xGb3JUeXBlLmRlZmF1bHRWYWx1ZSAhPT0gdW5kZWZpbmVkKSB7XG4gICAgcmV0dXJuIHByb3RvQWNjZXNzQ29udHJvbEZvclR5cGUuZGVmYXVsdFZhbHVlO1xuICB9XG4gIGxvZ1VuZXhwZWNlZFByb3BlcnR5QWNjZXNzT25jZShwcm9wZXJ0eU5hbWUpO1xuICByZXR1cm4gZmFsc2U7XG59XG5cbmZ1bmN0aW9uIGxvZ1VuZXhwZWNlZFByb3BlcnR5QWNjZXNzT25jZShwcm9wZXJ0eU5hbWUpIHtcbiAgaWYgKGxvZ2dlZFByb3BlcnRpZXNbcHJvcGVydHlOYW1lXSAhPT0gdHJ1ZSkge1xuICAgIGxvZ2dlZFByb3BlcnRpZXNbcHJvcGVydHlOYW1lXSA9IHRydWU7XG4gICAgbG9nZ2VyLmxvZyhcbiAgICAgICdlcnJvcicsXG4gICAgICBgSGFuZGxlYmFyczogQWNjZXNzIGhhcyBiZWVuIGRlbmllZCB0byByZXNvbHZlIHRoZSBwcm9wZXJ0eSBcIiR7cHJvcGVydHlOYW1lfVwiIGJlY2F1c2UgaXQgaXMgbm90IGFuIFwib3duIHByb3BlcnR5XCIgb2YgaXRzIHBhcmVudC5cXG5gICtcbiAgICAgICAgYFlvdSBjYW4gYWRkIGEgcnVudGltZSBvcHRpb24gdG8gZGlzYWJsZSB0aGUgY2hlY2sgb3IgdGhpcyB3YXJuaW5nOlxcbmAgK1xuICAgICAgICBgU2VlIGh0dHBzOi8vaGFuZGxlYmFyc2pzLmNvbS9hcGktcmVmZXJlbmNlL3J1bnRpbWUtb3B0aW9ucy5odG1sI29wdGlvbnMtdG8tY29udHJvbC1wcm90b3R5cGUtYWNjZXNzIGZvciBkZXRhaWxzYFxuICAgICk7XG4gIH1cbn1cblxuZXhwb3J0IGZ1bmN0aW9uIHJlc2V0TG9nZ2VkUHJvcGVydGllcygpIHtcbiAgT2JqZWN0LmtleXMobG9nZ2VkUHJvcGVydGllcykuZm9yRWFjaChwcm9wZXJ0eU5hbWUgPT4ge1xuICAgIGRlbGV0ZSBsb2dnZWRQcm9wZXJ0aWVzW3Byb3BlcnR5TmFtZV07XG4gIH0pO1xufVxuIl19