-
Notifications
You must be signed in to change notification settings - Fork 2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: default options for controlling proto access
This commmit adds the runtime options - `allowProtoPropertiesByDefault` (boolean, default: false) and - `allowProtoMethodsByDefault` (boolean, default: false)` which can be used to allow access to prototype properties and functions in general. Specific properties and methods can still be disabled from access via `allowedProtoProperties` and `allowedProtoMethods` by setting the corresponding values to false. The methods `constructor`, `__defineGetter__`, `__defineSetter__`, `__lookupGetter__` and the property `__proto__` will be disabled, even if the allow...ByDefault-options are set to true. In order to allow access to those properties and methods, they have to be explicitly set to true in the 'allowedProto...'-options. A warning is logged when the a proto-access it attempted and denied by default (i.e. if no option is set by the user to make the access decision explicit)
- Loading branch information
Showing
6 changed files
with
251 additions
and
120 deletions.
There are no files selected for viewing
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,55 @@ | ||
import { createNewLookupObject } from './create-new-lookup-object'; | ||
|
||
export function createProtoAccessControl(runtimeOptions) { | ||
let defaultMethodWhiteList = Object.create(null); | ||
defaultMethodWhiteList['constructor'] = false; | ||
defaultMethodWhiteList['__defineGetter__'] = false; | ||
defaultMethodWhiteList['__defineSetter__'] = false; | ||
defaultMethodWhiteList['__lookupGetter__'] = false; | ||
|
||
let defaultPropertyWhiteList = Object.create(null); | ||
// eslint-disable-next-line no-proto | ||
defaultPropertyWhiteList['__proto__'] = false; | ||
|
||
return { | ||
properties: { | ||
whitelist: createNewLookupObject( | ||
defaultPropertyWhiteList, | ||
runtimeOptions.allowedProtoProperties | ||
), | ||
defaultValue: runtimeOptions.allowProtoPropertiesByDefault | ||
}, | ||
methods: { | ||
whitelist: createNewLookupObject( | ||
defaultMethodWhiteList, | ||
runtimeOptions.allowedProtoMethods | ||
), | ||
defaultValue: runtimeOptions.allowProtoMethodsByDefault | ||
} | ||
}; | ||
} | ||
|
||
export function resultIsAllowed(result, protoAccessControl, propertyName) { | ||
if (typeof result === 'function') { | ||
return checkWhiteList(protoAccessControl.methods, propertyName); | ||
} else { | ||
return checkWhiteList(protoAccessControl.properties, propertyName); | ||
} | ||
} | ||
|
||
function checkWhiteList(protoAccessControlForType, propertyName) { | ||
if (protoAccessControlForType.whitelist[propertyName] !== undefined) { | ||
return protoAccessControlForType.whitelist[propertyName] === true; | ||
} | ||
if (protoAccessControlForType.defaultValue !== undefined) { | ||
return protoAccessControlForType.defaultValue; | ||
} | ||
|
||
// eslint-disable-next-line no-console | ||
console.error( | ||
`Handlebars: Access has been denied to resolve the property "${propertyName}" because it is not an "own property" of its parent.\n` + | ||
`You can add a runtime option to disable the check or this warning:\n` + | ||
`See http://localhost:8080/api-reference/runtime-options.html#options-to-control-prototype-access for details` | ||
); | ||
return false; | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.