New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vulnerability/ Bypass: Parser Errors Fail Open #4

Open

matt- opened this issue Sep 26, 2017 · 0 comments

matt- commented Sep 26, 2017 •

edited

Loading

When esprima fails to parse the input string is returned as is.

If we find bug in esprima like the one below that is actually valid javascript but fails to parse we can bypass any given policy.

Take this one for example... jquery/esprima#1785

var sanitiz = require("eval-sanitizer");
sanitiz.setPolicy(sanitiz.ONLY_LITERALS);
var userInput = "class a extends Object { constructor(c = super()){} };console.log('Injection Succeeded')";
var safeStr = sanitiz`var x = ${userInput}`; // removes console.log call
console.log(safeStr);
eval(safeStr);  // will log the string "Injection Succeeded"

see: https://github.com/cristianstaicu/eval-sanitizer/blob/master/lib/sanitizer.js#L86

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment