fix: remove overly aggressive disabling of native functions but disallow __proto__

Author: brettz9

CHANGES.md

@@ -1,5 +1,10 @@
 # CHANGES for jsonpath-plus
 
+## 10.0.5
+
+- fix: remove overly aggressive disabling of native functions but
+    disallow `__proto__`
+
 ## 10.0.4
 
 - fix(security): further prevent binding of Function calls which may evade detection

badges/coverage-badge.svg

@@ -1325,16 +1325,16 @@ const SafeEval = {
     if (func === Function) {
       throw new Error('Function constructor is disabled');
     }
-    if (func.toString() === 'function () { [native code] }') {
-      throw new Error('Native functions are disabled');
-    }
     return func(...args);
   },
   evalAssignmentExpression(ast, subs) {
     if (ast.left.type !== 'Identifier') {
       throw SyntaxError('Invalid left-hand side in assignment');
     }
     const id = ast.left.name;
+    if (id === '__proto__') {
+      throw new Error('Assignment to __proto__ is disabled');
+    }
     const value = SafeEval.evalAst(ast.right, subs);
     subs[id] = value;
     return subs[id];

dist/index-browser-esm.js

@@ -1331,16 +1331,16 @@
 	    if (func === Function) {
 	      throw new Error('Function constructor is disabled');
 	    }
-	    if (func.toString() === 'function () { [native code] }') {
-	      throw new Error('Native functions are disabled');
-	    }
 	    return func(...args);
 	  },
 	  evalAssignmentExpression(ast, subs) {
 	    if (ast.left.type !== 'Identifier') {
 	      throw SyntaxError('Invalid left-hand side in assignment');
 	    }
 	    const id = ast.left.name;
+	    if (id === '__proto__') {
+	      throw new Error('Assignment to __proto__ is disabled');
+	    }
 	    const value = SafeEval.evalAst(ast.right, subs);
 	    subs[id] = value;
 	    return subs[id];

dist/index-browser-esm.min.js

@@ -1326,16 +1326,16 @@ const SafeEval = {
     if (func === Function) {
       throw new Error('Function constructor is disabled');
     }
-    if (func.toString() === 'function () { [native code] }') {
-      throw new Error('Native functions are disabled');
-    }
     return func(...args);
   },
   evalAssignmentExpression(ast, subs) {
     if (ast.left.type !== 'Identifier') {
       throw SyntaxError('Invalid left-hand side in assignment');
     }
     const id = ast.left.name;
+    if (id === '__proto__') {
+      throw new Error('Assignment to __proto__ is disabled');
+    }
     const value = SafeEval.evalAst(ast.right, subs);
     subs[id] = value;
     return subs[id];

dist/index-browser-esm.min.js.map

@@ -1324,16 +1324,16 @@ const SafeEval = {
     if (func === Function) {
       throw new Error('Function constructor is disabled');
     }
-    if (func.toString() === 'function () { [native code] }') {
-      throw new Error('Native functions are disabled');
-    }
     return func(...args);
   },
   evalAssignmentExpression(ast, subs) {
     if (ast.left.type !== 'Identifier') {
       throw SyntaxError('Invalid left-hand side in assignment');
     }
     const id = ast.left.name;
+    if (id === '__proto__') {
+      throw new Error('Assignment to __proto__ is disabled');
+    }
     const value = SafeEval.evalAst(ast.right, subs);
     subs[id] = value;
     return subs[id];

dist/index-browser-umd.cjs

@@ -1,7 +1,7 @@
 {
   "author": "Stefan Goessner",
   "name": "jsonpath-plus",
-  "version": "10.0.4",
+  "version": "10.0.5",
   "type": "module",
   "bin": {
     "jsonpath": "./bin/jsonpath-cli.js",

dist/index-browser-umd.min.cjs

@@ -140,16 +140,16 @@ const SafeEval = {
         if (func === Function) {
             throw new Error('Function constructor is disabled');
         }
-        if (func.toString() === 'function () { [native code] }') {
-            throw new Error('Native functions are disabled');
-        }
         return func(...args);
     },
     evalAssignmentExpression (ast, subs) {
         if (ast.left.type !== 'Identifier') {
             throw SyntaxError('Invalid left-hand side in assignment');
         }
         const id = ast.left.name;
+        if (id === '__proto__') {
+            throw new Error('Assignment to __proto__ is disabled');
+        }
         const value = SafeEval.evalAst(ast.right, subs);
         subs[id] = value;
         return subs[id];