René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Medium][ssr] DOM-backed evaluateSSR uses new Function() eval fallback (defeats CSP-safe design) + missing proto guard","articleBody":"## Severity: 🟡 Medium (High if templates can carry untrusted content, e.g. a CMS/page-builder)\n\n## Location\n[`src/ssr/render.ts:189-197`](../blob/main/src/ssr/render.ts#L189-L197) (`new Function()` fallback) and [`:174-187`](../blob/main/src/ssr/render.ts#L174-L187) (dot-path, missing proto guard). Used by the DOM-backed renderer — active whenever a global/configured `DOMParser` exists (browsers, happy-dom, or `configureSSR({ backend: 'dom' })`).\n\n## Description\n`evaluateSSR` falls back to dynamic code generation for any non-trivial expression:\n```ts\nconst fn = new Function(...keys, `return (${trimmed});`);\nreturn fn(...values);\n```\nThis directly contradicts the module's stated security posture — [`src/ssr/expression.ts`](../blob/main/src/ssr/expression.ts) was written specifically to be CSP-safe (no `eval`/`Function`) — and re-introduces `unsafe-eval` on the DOM path. If any part of a template expression is attacker-influenced, this is code execution.\n\nAdditionally, the fast dot-notation path (`render.ts:174-187`) does **not** call `isPrototypePollutionKey`, unlike the hardened `expression.ts` (`lookupIdent`/`safeMember`). `evaluateSSR('constructor.constructor', ctx)` walks the prototype chain and returns the `Function` constructor — an inconsistent hardening gap and a stepping stone when combined with the `new Function` fallback.\n\n## Suggested fix\nReplace `evaluateSSR` with the CSP-safe `evaluateExpression` from `expression.ts` (already used by the pure renderer), eliminating both the `new Function` fallback and the prototype-pollution gap, and unifying evaluator behaviour across backends.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:09.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/167/bQuery/issues/167"}