Skip to content

Commit 1bab1cc

Browse files
80avin80avin
committed
fix(eval): rce using __lookupGetter__ or __lookupSetter__
1 parent 5d3d63e commit 1bab1cc

21 files changed

+119
-72
lines changed

‎badges/coverage-badge.svg‎

Lines changed: 1 addition & 1 deletion
Loading

‎dist/index-browser-esm.js‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,10 @@ class Plugins {
7575
* @param {PluginSetup} plugins.init The init function
7676
* @public
7777
*/
78-
register(...plugins) {
78+
register() {
79+
for (var _len = arguments.length, plugins = new Array(_len), _key = 0; _key < _len; _key++) {
80+
plugins[_key] = arguments[_key];
81+
}
7982
plugins.forEach(plugin => {
8083
if (typeof plugin !== 'object' || !plugin.name || !plugin.init) {
8184
throw new Error('Invalid JSEP plugin format');
@@ -1203,7 +1206,7 @@ jsep.addUnaryOp('typeof');
12031206
jsep.addUnaryOp('void');
12041207
jsep.addLiteral('null', null);
12051208
jsep.addLiteral('undefined', undefined);
1206-
const BLOCKED_PROTO_PROPERTIES = new Set(['constructor', '__proto__', '__defineGetter__', '__defineSetter__']);
1209+
const BLOCKED_PROTO_PROPERTIES = new Set(['constructor', '__proto__', '__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__']);
12071210
const SafeEval = {
12081211
/**
12091212
* @param {jsep.Expression} ast
@@ -1334,9 +1337,9 @@ const SafeEval = {
13341337
evalCallExpression(ast, subs) {
13351338
const args = ast.arguments.map(arg => SafeEval.evalAst(arg, subs));
13361339
const func = SafeEval.evalAst(ast.callee, subs);
1337-
// if (func === Function) {
1338-
// throw new Error('Function constructor is disabled');
1339-
// }
1340+
if (func === Function) {
1341+
throw new Error('Function constructor is disabled');
1342+
}
13401343
return func(...args);
13411344
},
13421345
evalAssignmentExpression(ast, subs) {

‎dist/index-browser-esm.min.js‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/index-browser-esm.min.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/index-browser-umd.cjs‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,10 @@
8181
* @param {PluginSetup} plugins.init The init function
8282
* @public
8383
*/
84-
register(...plugins) {
84+
register() {
85+
for (var _len = arguments.length, plugins = new Array(_len), _key = 0; _key < _len; _key++) {
86+
plugins[_key] = arguments[_key];
87+
}
8588
plugins.forEach(plugin => {
8689
if (typeof plugin !== 'object' || !plugin.name || !plugin.init) {
8790
throw new Error('Invalid JSEP plugin format');
@@ -1209,7 +1212,7 @@
12091212
jsep.addUnaryOp('void');
12101213
jsep.addLiteral('null', null);
12111214
jsep.addLiteral('undefined', undefined);
1212-
const BLOCKED_PROTO_PROPERTIES = new Set(['constructor', '__proto__', '__defineGetter__', '__defineSetter__']);
1215+
const BLOCKED_PROTO_PROPERTIES = new Set(['constructor', '__proto__', '__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__']);
12131216
const SafeEval = {
12141217
/**
12151218
* @param {jsep.Expression} ast
@@ -1340,9 +1343,9 @@
13401343
evalCallExpression(ast, subs) {
13411344
const args = ast.arguments.map(arg => SafeEval.evalAst(arg, subs));
13421345
const func = SafeEval.evalAst(ast.callee, subs);
1343-
// if (func === Function) {
1344-
// throw new Error('Function constructor is disabled');
1345-
// }
1346+
if (func === Function) {
1347+
throw new Error('Function constructor is disabled');
1348+
}
13461349
return func(...args);
13471350
},
13481351
evalAssignmentExpression(ast, subs) {

‎dist/index-browser-umd.min.cjs‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎dist/index-browser-umd.min.cjs.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/index-node-cjs.cjs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1207,7 +1207,7 @@ jsep.addUnaryOp('typeof');
12071207
jsep.addUnaryOp('void');
12081208
jsep.addLiteral('null', null);
12091209
jsep.addLiteral('undefined', undefined);
1210-
const BLOCKED_PROTO_PROPERTIES = new Set(['constructor', '__proto__', '__defineGetter__', '__defineSetter__']);
1210+
const BLOCKED_PROTO_PROPERTIES = new Set(['constructor', '__proto__', '__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__']);
12111211
const SafeEval = {
12121212
/**
12131213
* @param {jsep.Expression} ast
@@ -1338,9 +1338,9 @@ const SafeEval = {
13381338
evalCallExpression(ast, subs) {
13391339
const args = ast.arguments.map(arg => SafeEval.evalAst(arg, subs));
13401340
const func = SafeEval.evalAst(ast.callee, subs);
1341-
// if (func === Function) {
1342-
// throw new Error('Function constructor is disabled');
1343-
// }
1341+
if (func === Function) {
1342+
throw new Error('Function constructor is disabled');
1343+
}
13441344
return func(...args);
13451345
},
13461346
evalAssignmentExpression(ast, subs) {

‎dist/index-node-esm.js‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1205,7 +1205,7 @@ jsep.addUnaryOp('typeof');
12051205
jsep.addUnaryOp('void');
12061206
jsep.addLiteral('null', null);
12071207
jsep.addLiteral('undefined', undefined);
1208-
const BLOCKED_PROTO_PROPERTIES = new Set(['constructor', '__proto__', '__defineGetter__', '__defineSetter__']);
1208+
const BLOCKED_PROTO_PROPERTIES = new Set(['constructor', '__proto__', '__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__']);
12091209
const SafeEval = {
12101210
/**
12111211
* @param {jsep.Expression} ast
@@ -1336,9 +1336,9 @@ const SafeEval = {
13361336
evalCallExpression(ast, subs) {
13371337
const args = ast.arguments.map(arg => SafeEval.evalAst(arg, subs));
13381338
const func = SafeEval.evalAst(ast.callee, subs);
1339-
// if (func === Function) {
1340-
// throw new Error('Function constructor is disabled');
1341-
// }
1339+
if (func === Function) {
1340+
throw new Error('Function constructor is disabled');
1341+
}
13421342
return func(...args);
13431343
},
13441344
evalAssignmentExpression(ast, subs) {

0 commit comments

Comments
 (0)