René's URL Explorer Experiment

Title: fix(view): shadow dangerous globals in with-scoped evaluator by JosunLP · Pull Request #188 · bQuery/bQuery · GitHub

Open Graph Title: fix(view): shadow dangerous globals in with-scoped evaluator by JosunLP · Pull Request #188 · bQuery/bQuery

X Title: fix(view): shadow dangerous globals in with-scoped evaluator by JosunLP · Pull Request #188 · bQuery/bQuery

Description: Summary Fixes #168 (Medium hardening). evaluate/evaluateRaw run new Function('$ctx', 'with($ctx){ return (expr); }'). The proxy has trap returned prop in target, so inherited Object.prototype members resolved from the context and constructor.constructor('…')() reached the Function constructor — arbitrary code execution wherever bq-* attributes carry untrusted content. Fix The issue's suggested own-keys-only has trap is necessary but not sufficient: once the proxy declines constructor, with resolution falls through to the enclosing global scope, where the global object inherits constructor from Object.prototype and exposes Function/eval/globalThis. A bare Function('…')() escapes the same way. So the evaluator now shadows a denylist (constructor, __proto__, prototype, Function, eval, globalThis, global, window, self, top, parent): has reports them present (so they never fall through to the global scope) and get resolves them to undefined unless the context legitimately owns that property. Member access on the resulting undefined throws → undefined. Both the lazy (evaluate) and raw (evaluateRaw) paths are covered. Legitimate templates are unaffected: own context props (including ones shadowing a dangerous name), arithmetic, and method calls on context values (e.g. name.toUpperCase()) all still work. Verification Tests: constructor.constructor(…)() on both evaluate and evaluateRaw, bare Function(…)() and eval(…), plus positive cases (own props, method calls, own-prop shadowing a global name). The exploit tests fail on the pre-fix code. Full suite: 2993 pass / 0 fail. tsc --noEmit + eslint clean. 🤖 Generated with Claude Code

Open Graph Description: Summary Fixes #168 (Medium hardening). evaluate/evaluateRaw run new Function('$ctx', 'with($ctx){ return (expr); }'). The proxy has trap returned prop in target, so inherited Object...

X Description: Summary Fixes #168 (Medium hardening). evaluate/evaluateRaw run new Function('$ctx', 'with($ctx){ return (expr); }'). The proxy has trap returned prop in target, so ...

Opengraph URL: https://github.com/bQuery/bQuery/pull/188

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width