fix(security): further prevent binding of Function calls which may ev…

…ade detection

CHANGES.md

@@ -1,5 +1,9 @@
 # CHANGES for jsonpath-plus
 
+## 10.0.4
+
+- fix(security): further prevent binding of Function calls which may evade detection
+
 ## 10.0.3
 
 - fix(security): prevent binding of Function calls which may evade detection

dist/index-browser-esm.js

@@ -1325,6 +1325,9 @@ const SafeEval = {
     if (func === Function) {
       throw new Error('Function constructor is disabled');
     }
+    if (func.toString() === 'function () { [native code] }') {
+      throw new Error('Native functions are disabled');
+    }
     return func(...args);
   },
   evalAssignmentExpression(ast, subs) {

dist/index-browser-umd.cjs

@@ -1331,6 +1331,9 @@
 	    if (func === Function) {
 	      throw new Error('Function constructor is disabled');
 	    }
+	    if (func.toString() === 'function () { [native code] }') {
+	      throw new Error('Native functions are disabled');
+	    }
 	    return func(...args);
 	  },
 	  evalAssignmentExpression(ast, subs) {

dist/index-node-cjs.cjs

@@ -1326,6 +1326,9 @@ const SafeEval = {
     if (func === Function) {
       throw new Error('Function constructor is disabled');
     }
+    if (func.toString() === 'function () { [native code] }') {
+      throw new Error('Native functions are disabled');
+    }
     return func(...args);
   },
   evalAssignmentExpression(ast, subs) {

dist/index-node-esm.js

@@ -1324,6 +1324,9 @@ const SafeEval = {
     if (func === Function) {
       throw new Error('Function constructor is disabled');
     }
+    if (func.toString() === 'function () { [native code] }') {
+      throw new Error('Native functions are disabled');
+    }
     return func(...args);
   },
   evalAssignmentExpression(ast, subs) {

package.json

@@ -1,7 +1,7 @@
 {
   "author": "Stefan Goessner",
   "name": "jsonpath-plus",
-  "version": "10.0.3",
+  "version": "10.0.4",
   "type": "module",
   "bin": {
     "jsonpath": "./bin/jsonpath-cli.js",

src/Safe-Script.js

@@ -140,6 +140,9 @@ const SafeEval = {
         if (func === Function) {
             throw new Error('Function constructor is disabled');
         }
+        if (func.toString() === 'function () { [native code] }') {
+            throw new Error('Native functions are disabled');
+        }
         return func(...args);
     },
     evalAssignmentExpression (ast, subs) {