Impact area
Security
Severity
High
Affected element
ServiceNow
UI Script
Salesforce
Static Resource
Rule number #
SN-JSL-HANDLEBARS-LESSTHAN-V453 (for ServiceNow)
SF-JSL-HANDLEBARS-LESSTHAN-V453 (for Salesforce)
Impact #
The properties __proto__, __defineGetter__, __defineSetter__ and __lookupGetter__ have been added to the list of “properties that must be enumerable”. If a property by that name is found and not enumerable on its parent, it will silently evaluate to undefined. This is done in both the compiled template and the “lookup”-helper. This will prevent new Remote-Code-Execution exploits that have been published recently.
Remediation
Update the Handlebars JS library to the latest version.
Time to fix #
30 min
References #
This rule is linked to Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’).
