Fix handlebars-lang#1748 where allowed prototype methods are not called

Author: aalimovs

lib/handlebars/runtime.js

@@ -133,6 +133,9 @@ export function template(templateSpec, env) {
       }
 
       if (resultIsAllowed(result, container.protoAccessControl, propertyName)) {
+        if (typeof result === 'function') {
+          return parent[propertyName]();
+        }
         return result;
       }
       return undefined;

spec/security.js

@@ -285,6 +285,17 @@ describe('security issues', function () {
           })
           .toCompileTo('abc');
       });
+
+      it('should use a proto method to trim a string', function () {
+        expectTemplate('{{aString.trim}}')
+          .withInput({ aString: '  abc  ' })
+          .withRuntimeOptions({
+            allowedProtoMethods: {
+              trim: true,
+            },
+          })
+          .toCompileTo('abc');
+      });
     });
 
     describe('control access to prototype non-methods via "allowedProtoProperties" and "allowProtoPropertiesByDefault', function () {