Rule number #

SN-JSL-HANDLEBARS-LESSTHAN-V430 (for ServiceNow)

SF-JSL-HANDLEBARS-LESSTHAN-V430 (for Salesforce)

Impact #

Calling “helperMissing” and “blockHelperMissing” directly from a template (like in {{blockHelperMissing}} was never intended and was part of the exploits that have been revealed early in 2019. It is also part of a new exploit that is not captured by the earlier fix.

Remediation

Update the Handlebars JS library to the latest version.

Time to fix #

30 min

References #

This rule is linked to Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’).