Member access #291
Member access #291
Conversation
Co-authored-by: Vijay Sarvepalli <vssarvepalli@cert.org>
| // function definition is included in registered functions | ||
| if (Object.values(expr.functions).includes(f)) return true; | ||
| // marked as safe already | ||
| if (f.__expr_eval_safe_def) return true; |
There was a problem hiding this comment.
This line is problematic we should remove it and move it to more reliable way. As this __expr_eval_safe_def can be user defined. It is not safe to trust it.
|
Yeh - needs a little more work. I think
See my https://github.com/sei-vsarvepalli/expr-eval-secure/tree/member-access branch that should fix all the tests and the more security problems that were found from using __expr_eval_safe_def property that can be object defined and NOT trusted. Please test, fix any README's, indentation etc. and release at your convenience. |
hello @jorenbroekema Any questions? or any feedback you need? |
2 participants
@sei-vsarvepalli
Please take a look. I tried to incorporate the fix in the code and clean it up a little but I'm left with 2 failing tests, which also fail on your branch.
Need some helping fixing those tests (or implementation). then happy to merge.