Security review: builtin calls and prototype chain restrictions #1098
Conversation
| } | ||
| }; | ||
| expect(mustache.render( | ||
| '{{#t}}{{x.pop}}X{{x.pop}}{{/t}}' + |
There was a problem hiding this comment.
can you explain why it would mutate t instead of just popping from x (which is empty in this scenario)?
There was a problem hiding this comment.
Just how mustache works. It passes the view object into the func.call(). In this case it's whatever is in {{#}}.
There was a problem hiding this comment.
Accessing nested attributes is a JS-specific extension to mustache. When you reference a nested function, it will be called with the current context as this, instead of the parent of the function.
There was a problem hiding this comment.
Maybe it's worth opening a ticket for mustache.js since this might be surprizing to most developers.
There was a problem hiding this comment.
@molnarg thanks, appreciate the explanation!
|
@dvoytenko LGTM |
dvoytenko
force-pushed
the
mustache-sec1
branch
from
fa46295
to
8b9ef6c
Compare
Security review: builtin calls and prototype chain restrictions
No description provided.