diff --git a/lib/handlebars/runtime.js b/lib/handlebars/runtime.js index 1c7cc4cc..88a6f5a6 100644 --- a/lib/handlebars/runtime.js +++ b/lib/handlebars/runtime.js @@ -133,6 +133,9 @@ export function template(templateSpec, env) { } if (resultIsAllowed(result, container.protoAccessControl, propertyName)) { + if (typeof result === 'function') { + return parent[propertyName](); + } return result; } return undefined; diff --git a/spec/security.js b/spec/security.js index 163d7b3d..b62c0195 100644 --- a/spec/security.js +++ b/spec/security.js @@ -285,6 +285,17 @@ describe('security issues', function () { }) .toCompileTo('abc'); }); + + it('should use a proto method to trim a string', function () { + expectTemplate('{{aString.trim}}') + .withInput({ aString: ' abc ' }) + .withRuntimeOptions({ + allowedProtoMethods: { + trim: true, + }, + }) + .toCompileTo('abc'); + }); }); describe('control access to prototype non-methods via "allowedProtoProperties" and "allowProtoPropertiesByDefault', function () {