-
Notifications
You must be signed in to change notification settings - Fork 3.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Security review: builtin calls and prototype chain restrictions #1098
Conversation
} | ||
}; | ||
expect(mustache.render( | ||
'{{#t}}{{x.pop}}X{{x.pop}}{{/t}}' + |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can you explain why it would mutate t
instead of just popping from x
(which is empty in this scenario)?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just how mustache works. It passes the view object into the func.call()
. In this case it's whatever is in {{#}}
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Accessing nested attributes is a JS-specific extension to mustache. When you reference a nested function, it will be called with the current context as this, instead of the parent of the function.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe it's worth opening a ticket for mustache.js since this might be surprizing to most developers.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@molnarg thanks, appreciate the explanation!
@dvoytenko LGTM |
fa46295
to
8b9ef6c
Compare
Security review: builtin calls and prototype chain restrictions
No description provided.