This repository was archived by the owner on May 5, 2023. It is now read-only.
File tree Expand file tree Collapse file tree 3 files changed +26
-3
lines changed Expand file tree Collapse file tree 3 files changed +26
-3
lines changed Original file line number Diff line number Diff line change 8
8
" dist"
9
9
],
10
10
"dependencies" : {
11
- "degenerator" : " ^2.2.0 " ,
11
+ "degenerator" : " ^3.0.1 " ,
12
12
"ip" : " ^1.1.5" ,
13
13
"netmask" : " ^2.0.1"
14
14
},
Original file line number Diff line number Diff line change @@ -48,7 +48,7 @@ function createPacResolver(
48
48
const names = Object . keys ( sandbox ) . filter ( k => isAsyncFunction ( sandbox [ k ] ) ) ;
49
49
50
50
// Compile the JS `FindProxyForURL()` function into an async function.
51
- const resolver = compile < ( url : string , host : string ) => Promise < string > > (
51
+ const resolver = compile < string , [ url : string , host : string ] > (
52
52
str ,
53
53
'FindProxyForURL' ,
54
54
names ,
Original file line number Diff line number Diff line change @@ -28,7 +28,7 @@ describe('FindProxyForURL', function() {
28
28
} ) ;
29
29
} ) ;
30
30
31
- it ( 'should not modify the passed-in options object ' , function ( done ) {
31
+ it ( 'should not modify the passed-in options object' , function ( done ) {
32
32
function foo ( ) { }
33
33
const opts = { sandbox : { foo } } ;
34
34
const FindProxyForURL = pac (
@@ -43,6 +43,29 @@ describe('FindProxyForURL', function() {
43
43
} ) ;
44
44
} ) ;
45
45
46
+ it ( 'should prevent untrusted code from escaping the sandbox' , function ( ) {
47
+ let err ;
48
+ try {
49
+ pac (
50
+ `// Real PAC config:
51
+ function FindProxyForURL(url, host) {
52
+ return "DIRECT";
53
+ }
54
+
55
+ // But also run arbitrary code:
56
+ var f = this.constructor.constructor(\`
57
+ process.exit(1);
58
+ \`);
59
+
60
+ f();
61
+ `
62
+ ) ;
63
+ } catch ( _err ) {
64
+ err = _err ;
65
+ }
66
+ assert . strictEqual ( err . message , 'process is not defined' )
67
+ } ) ;
68
+
46
69
describe ( 'official docs Example #1' , function ( ) {
47
70
var FindProxyForURL = pac (
48
71
'function FindProxyForURL(url, host) {' +
You can’t perform that action at this time.
0 commit comments