Only allow 'this' or '..' to lead a path

Paths like 'outer/../key' raise an exception when compiling.

1 files changed, 5 insertions, 2 deletions

diff --git a/lib/handlebars/compiler/ast.js b/lib/handlebars/compiler/ast.js
index fd6cdc5..f448523 100644
--- a/lib/handlebars/compiler/ast.js
+++ b/lib/handlebars/compiler/ast.js
@@ -76,8 +76,11 @@ var Handlebars = require('./base');
     for(var i=0,l=parts.length; i<l; i++) {
       var part = parts[i];
 
-      if(part === "..") { depth++; }
-      else if(part === "." || part === "this") { this.isScoped = true; }
+      if (part === ".." || part === "." || part === "this") {
+        if (dig.length > 0) { throw new Handlebars.Exception("Invalid path: " + this.original); }
+        else if (part === "..") { depth++; }
+        else { this.isScoped = true; }
+      }
       else { dig.push(part); }
     }