Default handlebars.js (4.0.4) contains security issues

[gtudan]

The default handlebars version shipped with the plugin contains some security issues that have been fixed in upstream versions:

• handlebars-lang/handlebars.js@7372d4e
• Prototype Pollution with Remote Code Execution handlebars-lang/handlebars.js#1495

I don't know if this is really an issue with handlebars.java, but it causes scanners like Snyk or RetireJS to trigger if they see it in the project dependencies. I suggest to update the default file to the latest version of the 4.0.x tree (currently 4.0.14).

[pettazz]

Our project's security scanner (BlackDuck) is also getting tripped by the handlebars.js 4.0.4 that's included in the jar. Any chance we could get a new release upgrading it?

[krassib]

Hi Edgar,
A few months ago our security scanners also reported on handlbars.java 4.1.2 that the upstream handlebars-4.0.4.js (included in the build jar) has high severity vulnerability (prototype pollution). The suggestion is to upgrade to the latest - handlebars-4.7.3.js, which has a fix for the prototype pollution.
Can you kindly reply with your plan on fixing the issue?
Thanks,
Krassimir Boyanov

[krassib]

@jknack ^^^