Impact area
Security
Severity
High
Affected element
ServiceNow
UI Script
Salesforce
Static Resource
Rule number #
SN-JSL-HANDLEBARS-LESSTHAN-V430 (for ServiceNow)
SF-JSL-HANDLEBARS-LESSTHAN-V430 (for Salesforce)
Impact #
Calling “helperMissing” and “blockHelperMissing” directly from a template (like in {{blockHelperMissing}} was never intended and was part of the exploits that have been revealed early in 2019. It is also part of a new exploit that is not captured by the earlier fix.
Remediation
Update the Handlebars JS library to the latest version.
Time to fix #
30 min
References #
This rule is linked to Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’).
