Description: fix Remote Code Execution (RCE)
 when selecting certain compiling options to compile templates coming from an
 untrusted source.
Author: Nils Knappmeier <npm@knappi.org>
Origin: upstream, https://github.com/handlebars-lang/handlebars.js/commit/b6d3de71
 https://github.com/handlebars-lang/handlebars.js/commit/f0589701
Bug: https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767
Forwarded: not-needed
Reviewed-By: Yadd <yadd@debian.org>
Last-Update: 2021-04-16

--- a/lib/handlebars/compiler/javascript-compiler.js
+++ b/lib/handlebars/compiler/javascript-compiler.js
@@ -16,7 +16,12 @@
     return this.internalNameLookup(parent, name);
   },
   depthedLookup: function(name) {
-    return [this.aliasable('container.lookup'), '(depths, "', name, '")'];
+    return [
+      this.aliasable('container.lookup'),
+      '(depths, ',
+      JSON.stringify(name),
+      ')'
+    ];
   },
 
   compilerInfo: function() {
--- a/lib/handlebars/runtime.js
+++ b/lib/handlebars/runtime.js
@@ -124,7 +124,7 @@
           loc: loc
         });
       }
-      return obj[name];
+      return container.lookupProperty(obj, name);
     },
     lookupProperty: function(parent, propertyName) {
       let result = parent[propertyName];
--- a/spec/security.js
+++ b/spec/security.js
@@ -320,6 +320,10 @@
         checkProtoPropertyAccess({ compat: true });
       });
 
+      describe('in strict-mode', function() {
+        checkProtoPropertyAccess({ strict: true });
+      });
+
       function checkProtoPropertyAccess(compileOptions) {
         it('should be prohibited by default and log a warning', function() {
           var spy = sinon.spy(console, 'error');
@@ -418,6 +422,28 @@
       });
     });
   });
+
+  describe('escapes template variables', function() {
+    it('in compat mode', function() {
+      expectTemplate("{{'a\\b'}}")
+        .withCompileOptions({ compat: true })
+        .withInput({ 'a\\b': 'c' })
+        .toCompileTo('c');
+    });
+
+    it('in default mode', function() {
+      expectTemplate("{{'a\\b'}}")
+        .withCompileOptions()
+        .withInput({ 'a\\b': 'c' })
+        .toCompileTo('c');
+    });
+    it('in default mode', function() {
+      expectTemplate("{{'a\\b'}}")
+        .withCompileOptions({ strict: true })
+        .withInput({ 'a\\b': 'c' })
+        .toCompileTo('c');
+    });
+  });
 });
 
 function wrapToAdjustContainer(precompiledTemplateFunction) {
