fix(security): prevent binding of Function calls which may evade detection

Author: brettz9

CHANGES.md

@@ -1,5 +1,9 @@
 # CHANGES for jsonpath-plus
 
+## 10.0.3
+
+- fix(security): prevent binding of Function calls which may evade detection
+
 ## 10.0.2
 
 - fix(security): prevent Function calls outside of member expressions

dist/index-browser-esm.js

@@ -1296,6 +1296,9 @@ const SafeEval = {
     const obj = SafeEval.evalAst(ast.object, subs);
     const result = obj[prop];
     if (typeof result === 'function') {
+      if (obj === Function && prop === 'bind') {
+        throw new Error('Function.prototype.bind is disabled');
+      }
       if (result === Function) {
         return result; // Don't bind so can identify and throw later
       }

dist/index-browser-esm.min.js

@@ -1302,6 +1302,9 @@
 	    const obj = SafeEval.evalAst(ast.object, subs);
 	    const result = obj[prop];
 	    if (typeof result === 'function') {
+	      if (obj === Function && prop === 'bind') {
+	        throw new Error('Function.prototype.bind is disabled');
+	      }
 	      if (result === Function) {
 	        return result; // Don't bind so can identify and throw later
 	      }

dist/index-browser-esm.min.js.map

@@ -1297,6 +1297,9 @@ const SafeEval = {
     const obj = SafeEval.evalAst(ast.object, subs);
     const result = obj[prop];
     if (typeof result === 'function') {
+      if (obj === Function && prop === 'bind') {
+        throw new Error('Function.prototype.bind is disabled');
+      }
       if (result === Function) {
         return result; // Don't bind so can identify and throw later
       }

dist/index-browser-umd.cjs

@@ -1295,6 +1295,9 @@ const SafeEval = {
     const obj = SafeEval.evalAst(ast.object, subs);
     const result = obj[prop];
     if (typeof result === 'function') {
+      if (obj === Function && prop === 'bind') {
+        throw new Error('Function.prototype.bind is disabled');
+      }
       if (result === Function) {
         return result; // Don't bind so can identify and throw later
       }

dist/index-browser-umd.min.cjs

@@ -1,7 +1,7 @@
 {
   "author": "Stefan Goessner",
   "name": "jsonpath-plus",
-  "version": "10.0.2",
+  "version": "10.0.3",
   "type": "module",
   "bin": {
     "jsonpath": "./bin/jsonpath-cli.js",

dist/index-browser-umd.min.cjs.map

@@ -111,6 +111,9 @@ const SafeEval = {
         const obj = SafeEval.evalAst(ast.object, subs);
         const result = obj[prop];
         if (typeof result === 'function') {
+            if (obj === Function && prop === 'bind') {
+                throw new Error('Function.prototype.bind is disabled');
+            }
             if (result === Function) {
                 return result; // Don't bind so can identify and throw later
             }