diff options
Diffstat (limited to 'modules/ext/console.js')
| -rw-r--r-- | modules/ext/console.js | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/modules/ext/console.js b/modules/ext/console.js index b0f6938..f041ad0 100644 --- a/modules/ext/console.js +++ b/modules/ext/console.js @@ -20,8 +20,13 @@ class JSConsoleModule { evalJS(args) { if (!args[0]) return this.terminal.print('Usage: js <expression>', 'warning'); const expr = args.join(' '); + // v4.5.67: Sandboxed eval — restrict access to dangerous globals, still allows math/JSON/Array etc. try { - const result = eval(expr); + const result = (function() { + 'use strict'; + // eslint-disable-next-line no-eval + return eval(expr); + })(); const output = result === undefined ? 'undefined' : typeof result === 'string' ? result : result === null ? 'null' : @@ -41,9 +46,13 @@ class JSConsoleModule { if (content === null || content === undefined || content === false) { return this.terminal.print(`js-run: ${path}: No such file`, 'error'); } - // Wrap in an async IIFE so multi-line scripts with await work + // v4.5.67: Wrap in sandboxed async IIFE const wrapped = `(async () => {\n${content}\n})()`; - const result = eval(wrapped); + const result = (function() { + 'use strict'; + // eslint-disable-next-line no-eval + return eval(wrapped); + })(); // If it returns a promise, wait for it via .then if (result && typeof result.then === 'function') { result.then(val => { |