Security Patch. #288
Security Patch. #288
Conversation
|
I'm in the remote outback of Australia on a trip so that's why I've been hard to reach. When I have slightly better connection I'll try to make sure this is resolved on my end (jorenbroekema/expr-eval-fork). Sorry for not being as responsive as I would usually be! |
| * This logic is the core security allowance gate. | ||
| */ | ||
| var isAllowedFunc = function (f) { | ||
| if (typeof f !== 'function') return true; |
There was a problem hiding this comment.
Shouldn't this return false if f is not a function?
There was a problem hiding this comment.
The check here is redundant anyways because we already check if the var is a function at the place where this is called. I'm guessing if it's not a function, then the expression is allowed because only functions are potentially malicious.
|
Could you @sei-vsarvepalli take a look here jorenbroekema#1 , I created a PR on my fork to include these security fixes, some linting fixes and adding an exports map (since we're doing a breaking change anyways, makes sense imo to include it now, see also #280) |
|
Continued work in jorenbroekema#1 |
4 participants
Fixes a vulnerability in the
expr-evalpackage. We are unable to reach the researcher @silentmatt and @jorenbroekema developers who have their versions in the npmjs repository.Vijay Sarvepalli
on behalf of CERT/CC