fix: prevent proto-access bypass via Symbol.toStringTag and escape bypass via toHTML

[eddieran]

Summary

Fixes #2146. Replaces #2147 (auto-closed when fork was deleted).

Two security fixes in lib/handlebars/utils.js:

1. Proto-access control bypass via Symbol.toStringTag spoofing

isMap / isSet used Object.prototype.toString tag detection, which is spoofable via Symbol.toStringTag. An attacker can craft a plain object that passes the Map check, causing lookupProperty to skip all proto-access controls and return blocked properties like constructor.

Fix: Use instanceof Map / instanceof Set instead of toString tag comparison.

2. HTML escape bypass via toHTML duck-typing

escapeExpression treated any object with a toHTML property as a SafeString, skipping HTML escaping entirely. Attacker-controlled template data with a toHTML method could inject raw HTML into {{}} expressions.

Fix: Use instanceof SafeString instead of checking for the toHTML property.

Test plan

• Verify {{value}} with { [Symbol.toStringTag]: 'Map', get: () => 'Function' } no longer bypasses proto-access controls
• Verify {{value}} with { toHTML: () => '<img src=x onerror=alert(1)>' } now escapes the HTML output
• Verify normal SafeString and Map usage continues to work correctly
• Run existing test suite: npm test

[Copilot]

Pull request overview

Addresses two reported security issues by hardening type checks in Handlebars utility helpers to prevent spoofing-based bypasses.

Changes:

• Replace isMap / isSet tag-based detection with instanceof Map / instanceof Set checks.
• Replace escapeExpression’s toHTML duck-typing with an instanceof SafeString check.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

testTag() is now unused after switching isMap/isSet to instanceof, so this helper (and its call sites that were removed) can be deleted to avoid dead code and keep utils.js focused on active helpers.

[Copilot]

This change makes escapeExpression stop treating arbitrary objects with a toHTML property as safe. The existing unit test in spec/utils.js currently asserts that a plain object with toHTML() is not escaped, which will fail and also conflicts with the new security behavior—update that expectation and add a regression test that verifies attacker-controlled toHTML() output is escaped.

[Copilot]

Given isMap now gates proto-access control behavior in runtime.lookupProperty, it would be good to add a security regression test that a plain object spoofing [Symbol.toStringTag] = 'Map' is not treated as a Map and cannot be used to read blocked proto properties (e.g. constructor). No existing spec appears to cover the spoofing case.

[eddieran]

Scope-reduced per @copilot-pull-request-reviewer's note that the instanceof SafeString change was a breaking change to the documented .toHTML duck-typing contract. Reverted that piece; the remaining change is just the Map/Set Symbol.toStringTag spoofing fix (issue #2146 first bullet), which has no API impact. CI should be green now.

[kibertoad]

The PR title and description still claim two fixes, but commit 0e4b21 reverted the toHTML → SafeString portion.

The final diff is only the Map/Set tag-check fix in lib/handlebars/utils.js. Before merge, the title and body should be updated to match.

[kibertoad]

this needs a regression test, something like

it('does not treat Symbol.toStringTag-spoofed objects as Map', function () {
    expectTemplate('{{value.constructor}}')
      .withInput({ value: { [Symbol.toStringTag]: 'Map', get: () => 'pwned' } })
      .toCompileTo(''); // or whatever the proto-controlled path produces
  });

[kibertoad]

Add one each for isMap / isSet at the unit level (spec/utils.js already has the happy-path tests) plus an end-to-end runtime.js lookup test.