fix(security): prohibit Function in "safe" vm; fixes #226

CHANGES.md

@@ -1,5 +1,9 @@
 # CHANGES for jsonpath-plus
 
+## 10.0.1
+
+- fix(security): prohibit `Function` in "safe" vm
+
 ## 10.0.0
 
 BREAKING CHANGES:

dist/index-browser-esm.js

@@ -1296,6 +1296,9 @@ const SafeEval = {
     const obj = SafeEval.evalAst(ast.object, subs);
     const result = obj[prop];
     if (typeof result === 'function') {
+      if (result === Function) {
+        throw new Error('Function constructor is disabled');
+      }
       return result.bind(obj); // arrow functions aren't affected by bind.
     }
     return result;

dist/index-browser-umd.cjs

@@ -1302,6 +1302,9 @@
 	    const obj = SafeEval.evalAst(ast.object, subs);
 	    const result = obj[prop];
 	    if (typeof result === 'function') {
+	      if (result === Function) {
+	        throw new Error('Function constructor is disabled');
+	      }
 	      return result.bind(obj); // arrow functions aren't affected by bind.
 	    }
 	    return result;

dist/index-node-cjs.cjs

@@ -1297,6 +1297,9 @@ const SafeEval = {
     const obj = SafeEval.evalAst(ast.object, subs);
     const result = obj[prop];
     if (typeof result === 'function') {
+      if (result === Function) {
+        throw new Error('Function constructor is disabled');
+      }
       return result.bind(obj); // arrow functions aren't affected by bind.
     }
     return result;

dist/index-node-esm.js

@@ -1295,6 +1295,9 @@ const SafeEval = {
     const obj = SafeEval.evalAst(ast.object, subs);
     const result = obj[prop];
     if (typeof result === 'function') {
+      if (result === Function) {
+        throw new Error('Function constructor is disabled');
+      }
       return result.bind(obj); // arrow functions aren't affected by bind.
     }
     return result;

package.json

@@ -1,7 +1,7 @@
 {
   "author": "Stefan Goessner",
   "name": "jsonpath-plus",
-  "version": "10.0.0",
+  "version": "10.0.1",
   "type": "module",
   "bin": {
     "jsonpath": "./bin/jsonpath-cli.js",

src/Safe-Script.js

@@ -111,6 +111,9 @@ const SafeEval = {
         const obj = SafeEval.evalAst(ast.object, subs);
         const result = obj[prop];
         if (typeof result === 'function') {
+            if (result === Function) {
+                throw new Error('Function constructor is disabled');
+            }
             return result.bind(obj); // arrow functions aren't affected by bind.
         }
         return result;