fix(security): vulnerability with safe script

Author: brettz9

src/Safe-Script.js

@@ -40,6 +40,32 @@ const BLOCKED_PROTO_PROPERTIES = new Set([
     '__lookupSetter__'
 ]);
 
+// Every function-constructor variant, along with the invocation helpers which
+//   could otherwise reach them indirectly, e.g., `Function.call(0, 'code')()`
+/** @type {WeakSet<object>} */
+const BLOCKED_FUNCTIONS = new WeakSet([
+    Function,
+    // eslint-disable-next-line no-empty-function -- Only need the constructor
+    function *() {}.constructor,
+    // eslint-disable-next-line no-empty-function -- Only need the constructor
+    async function () {}.constructor,
+    // eslint-disable-next-line no-empty-function -- Only need the constructor
+    async function *() {}.constructor,
+    Function.prototype.call,
+    Function.prototype.apply,
+    Function.prototype.bind,
+    Reflect.apply,
+    Reflect.construct
+]);
+
+/**
+ * @param {UnknownResult} value
+ * @returns {boolean}
+ */
+const isBlockedFunction = (value) => {
+    return typeof value === 'function' && BLOCKED_FUNCTIONS.has(value);
+};
+
 /**
  * @typedef {Record<
  *   string,
@@ -256,7 +282,10 @@ const SafeEval = {
             );
         }
         const result = /** @type {Record<string, UnknownResult>} */ (obj)[prop];
-        if (typeof result === 'function' && result !== Function) {
+        if (isBlockedFunction(result)) {
+            throw new TypeError('Function constructor is disabled');
+        }
+        if (typeof result === 'function') {
             return result.bind(obj); // arrow functions aren't affected by bind.
         }
         return result;
@@ -297,7 +326,10 @@ const SafeEval = {
     evalCallExpression (ast, subs) {
         const args = ast.arguments.map((arg) => SafeEval.evalAst(arg, subs));
         const func = SafeEval.evalAst(ast.callee, subs);
-        if (func === Function) {
+        if (
+            isBlockedFunction(func) ||
+            args.some((arg) => isBlockedFunction(arg))
+        ) {
             throw new Error('Function constructor is disabled');
         }
         return (/** @type {(...args: AnyParameter[]) => UnknownResult} */ (

test/test.safe-eval.js

@@ -328,6 +328,53 @@ checkBuiltInVMAndNodeVM(function (vmType, setBuiltInState) {
                 }, "Function constructor is disabled");
             });
 
+            it("10.4.1 RCE via call/apply/bind", () => {
+                // @ts-expect-error VM testing
+                // eslint-disable-next-line unicorn/no-global-object-property-assignment -- Exploit test
+                globalThis.TEST_10_4_1_RCE_INDIRECT = 'not exploited';
+
+                const payload =
+                    'globalThis.TEST_10_4_1_RCE_INDIRECT="RCE";0';
+                for (const invocation of [
+                    `constructor.call(0,'${payload}')()`,
+                    `constructor.apply(0,['${payload}'])()`,
+                    `constructor.bind(0)('${payload}')()`
+                ]) {
+                    assert.throws(() => {
+                        const path =
+                            `$..[?(@.constructor[( @.getPrototypeOf(@).${invocation} )])]`;
+                        jsonpath({path, json: {a: {}}});
+                    }, "Function constructor is disabled");
+                }
+
+                assert.equal(
+                    // @ts-expect-error VM testing
+                    globalThis.TEST_10_4_1_RCE_INDIRECT,
+                    'not exploited'
+                );
+            });
+
+            it("async/generator function constructors blocked", () => {
+                const fnJson = {
+                    a: {
+                        // eslint-disable-next-line no-empty-function -- Only need the constructor
+                        af: async function () {}.constructor,
+                        // eslint-disable-next-line no-empty-function -- Only need the constructor
+                        gf: function *() {}.constructor,
+                        // eslint-disable-next-line no-empty-function -- Only need the constructor
+                        agf: async function *() {}.constructor
+                    }
+                };
+                for (const prop of ['af', 'gf', 'agf']) {
+                    assert.throws(() => {
+                        jsonpath({
+                            json: fnJson,
+                            path: `$[?(@.${prop}('return 1')())]`
+                        });
+                    }, "Function constructor is disabled");
+                }
+            });
+
             it("bind() escape guard: function.prototype.constructor blocked", () => {
                 // Regression: bound functions (with no .prototype) are returned to
                 // prevent @.f.prototype.constructor → Function constructor escape.