fix(eval): CVE: RCE in safe-eval

dist/index-browser-esm.js

@@ -1310,7 +1310,7 @@ const SafeEval = {
       throw TypeError(`Cannot read properties of ${obj} (reading '${prop}')`);
     }
     const result = obj[prop];
-    if (typeof result === 'function') {
+    if (typeof result === 'function' && result !== Function) {
       return result.bind(obj); // arrow functions aren't affected by bind.
     }
     return result;
@@ -1334,12 +1334,9 @@ const SafeEval = {
   evalCallExpression(ast, subs) {
     const args = ast.arguments.map(arg => SafeEval.evalAst(arg, subs));
     const func = SafeEval.evalAst(ast.callee, subs);
-    /* c8 ignore start  */
     if (func === Function) {
-      // unreachable since BLOCKED_PROTO_PROPERTIES includes 'constructor'
       throw new Error('Function constructor is disabled');
     }
-    /* c8 ignore end  */
     return func(...args);
   },
   evalAssignmentExpression(ast, subs) {

dist/index-browser-umd.cjs

@@ -1316,7 +1316,7 @@
 	      throw TypeError(`Cannot read properties of ${obj} (reading '${prop}')`);
 	    }
 	    const result = obj[prop];
-	    if (typeof result === 'function') {
+	    if (typeof result === 'function' && result !== Function) {
 	      return result.bind(obj); // arrow functions aren't affected by bind.
 	    }
 	    return result;
@@ -1340,12 +1340,9 @@
 	  evalCallExpression(ast, subs) {
 	    const args = ast.arguments.map(arg => SafeEval.evalAst(arg, subs));
 	    const func = SafeEval.evalAst(ast.callee, subs);
-	    /* c8 ignore start  */
 	    if (func === Function) {
-	      // unreachable since BLOCKED_PROTO_PROPERTIES includes 'constructor'
 	      throw new Error('Function constructor is disabled');
 	    }
-	    /* c8 ignore end  */
 	    return func(...args);
 	  },
 	  evalAssignmentExpression(ast, subs) {

dist/index-node-cjs.cjs

@@ -1314,7 +1314,7 @@ const SafeEval = {
       throw TypeError(`Cannot read properties of ${obj} (reading '${prop}')`);
     }
     const result = obj[prop];
-    if (typeof result === 'function') {
+    if (typeof result === 'function' && result !== Function) {
       return result.bind(obj); // arrow functions aren't affected by bind.
     }
     return result;
@@ -1338,12 +1338,9 @@ const SafeEval = {
   evalCallExpression(ast, subs) {
     const args = ast.arguments.map(arg => SafeEval.evalAst(arg, subs));
     const func = SafeEval.evalAst(ast.callee, subs);
-    /* c8 ignore start  */
     if (func === Function) {
-      // unreachable since BLOCKED_PROTO_PROPERTIES includes 'constructor'
       throw new Error('Function constructor is disabled');
     }
-    /* c8 ignore end  */
     return func(...args);
   },
   evalAssignmentExpression(ast, subs) {

dist/index-node-esm.js

@@ -1312,7 +1312,7 @@ const SafeEval = {
       throw TypeError(`Cannot read properties of ${obj} (reading '${prop}')`);
     }
     const result = obj[prop];
-    if (typeof result === 'function') {
+    if (typeof result === 'function' && result !== Function) {
       return result.bind(obj); // arrow functions aren't affected by bind.
     }
     return result;
@@ -1336,12 +1336,9 @@ const SafeEval = {
   evalCallExpression(ast, subs) {
     const args = ast.arguments.map(arg => SafeEval.evalAst(arg, subs));
     const func = SafeEval.evalAst(ast.callee, subs);
-    /* c8 ignore start  */
     if (func === Function) {
-      // unreachable since BLOCKED_PROTO_PROPERTIES includes 'constructor'
       throw new Error('Function constructor is disabled');
     }
-    /* c8 ignore end  */
     return func(...args);
   },
   evalAssignmentExpression(ast, subs) {

src/Safe-Script.js

@@ -138,7 +138,7 @@ const SafeEval = {
             );
         }
         const result = obj[prop];
-        if (typeof result === 'function') {
+        if (typeof result === 'function' && result !== Function) {
             return result.bind(obj); // arrow functions aren't affected by bind.
         }
         return result;
@@ -162,12 +162,9 @@ const SafeEval = {
     evalCallExpression (ast, subs) {
         const args = ast.arguments.map((arg) => SafeEval.evalAst(arg, subs));
         const func = SafeEval.evalAst(ast.callee, subs);
-        /* c8 ignore start  */
         if (func === Function) {
-            // unreachable since BLOCKED_PROTO_PROPERTIES includes 'constructor'
             throw new Error('Function constructor is disabled');
         }
-        /* c8 ignore end  */
         return func(...args);
     },
     evalAssignmentExpression (ast, subs) {

test/test.safe-eval.js

@@ -300,6 +300,15 @@ checkBuiltInVMAndNodeVM(function (vmType, setBuiltInState) {
                     jsonpath({json: exampleObj, path: userControlledPath});
                 }, "Cannot read properties of  (reading 'constructor')");
             });
+            it("10.4.1 RCE", () => {
+                assert.throws(() => {
+                    globalThis.TEST_10_4_1_RCE = 'not exploited';
+
+                    const path = "$..[?(@.constructor[( @.getPrototypeOf(@).constructor('globalThis.TEST_10_4_1_RCE=\"RCE\";0')() )])]";
+
+                    jsonpath({path, json: {a: {}}});
+                }, "Function constructor is disabled");
+            });
         });
     });
 });