Only using known handlers with handlebars (#27061) (#27318)

elastic · Jan 22, 2019 · 59ab496 · 59ab496
1 parent f909937
commit 59ab496
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/src/core_plugins/metrics/public/components/lib/replace_vars.js b/src/core_plugins/metrics/public/components/lib/replace_vars.js
@@ -2,7 +2,7 @@ import _ from 'lodash';
 import handlebars from 'handlebars/dist/handlebars';
 export default function replaceVars(str, args = {}, vars = {}) {
   try {
-    const template = handlebars.compile(str);
+    const template = handlebars.compile(str, { knownHelpersOnly: true });
     return template(_.assign({}, vars, { args }));
   } catch (e) {
     return str;

diff --git a/src/core_plugins/metrics/public/components/lib/tick_formatter.js b/src/core_plugins/metrics/public/components/lib/tick_formatter.js
@@ -10,7 +10,7 @@ const formatLookup = {
 
 export default (format = '0,0.[00]', template) => {
   if (!template) template = '{{value}}';
-  const render = handlebars.compile(template);
+  const render = handlebars.compile(template, { knownHelpersOnly: true });
   return (val) => {
     const formatString = formatLookup[format] || format;
     let value;

diff --git a/utilities/visual_regression.js b/utilities/visual_regression.js
@@ -37,7 +37,7 @@ async function buildGallery(comparisons) {
 
   const template = Handlebars.compile(await readFileAsync(
     path.resolve('./utilities/templates/visual_regression_gallery.handlebars')
-  , 'utf8'));
+    , 'utf8'), { knownHelpersOnly: true });
 
   const html = template({
     date: moment().format('MMMM Do YYYY, h:mm:ss a'),