Update dependency handlebars to v4.1.2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
handlebars (source)	dependencies	minor	4.0.12 -> 4.1.2

---

Release Notes

wycats/handlebars.js

v4.1.2

Compare Source

Chore/Test:

• #​1515 - Port over linting and test for typings (@​zimmi88)
• chore: add missing typescript dependency, add package-lock.json - 594f1e3
• test: remove safari from saucelabs - 871accc

Bugfixes:

• fix: prevent RCE through the "lookup"-helper - cd38583

Compatibility notes:

Access to the constructor of a class thought {{lookup obj "constructor" }} is now prohibited. This closes
a leak that only half closed in versions 4.0.13 and 4.1.0, but it is a slight incompatibility.

This kind of access is not the intended use of Handlebars and leads to the vulnerability described
in #​1495. We will not increase the major version, because such use is not intended or documented,
and because of the potential impact of the issue (we fear that most people won't use a new major version
and the issue may not be resolved on many systems).

Commits

v4.1.1

Compare Source

Bugfixes:

• fix: add "runtime.d.ts" to allow "require('handlebars/runtime')" in TypeScript - 5cedd62

Refactorings:

• replace "async" with "neo-async" - 048f2ce
• use "substring"-function instead of "substr" - 445ae12

Compatibility notes:

• This is a bugfix release. There are no breaking change and no new features.

Commits

v4.1.0

Compare Source

New Features

• import TypeScript typings - 27ac1ee

Security fixes:

• disallow access to the constructor in templates to prevent RCE - 42841c4, #​1495

Housekeeping

• chore: fix components/handlebars package.json and auto-update on release - bacd473
• chore: Use node 10 to build handlebars - 78dd89c
• chore/doc: Add more release docs - 6b87c21

Compatibility notes:

Access to class constructors (i.e. ({}).constructor) is now prohibited to prevent
Remote Code Execution. This means that following construct will no work anymore:

class SomeClass {
}

SomeClass.staticProperty = 'static'

var template = Handlebars.compile('{{constructor.staticProperty}}');
document.getElementById('output').innerHTML = template(new SomeClass());
// expected: 'static', but now this is empty.

This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #​1495. We will not increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).

Commits

v4.0.14

Compare Source

v4.0.13

Compare Source

---

Renovate configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever PR becomes conflicted, or if you modify the PR title to begin with "rebase!".

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot. View repository job log here.