From fba6df22dae297c89fa0df065628dddded66c69c Mon Sep 17 00:00:00 2001 From: Agando Date: Thu, 18 Jun 2026 06:00:40 +0200 Subject: auto: 2026-06-18_06:00 changes --- modules/ext/console.js | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'modules/ext/console.js') diff --git a/modules/ext/console.js b/modules/ext/console.js index b0f6938..f041ad0 100644 --- a/modules/ext/console.js +++ b/modules/ext/console.js @@ -20,8 +20,13 @@ class JSConsoleModule { evalJS(args) { if (!args[0]) return this.terminal.print('Usage: js ', 'warning'); const expr = args.join(' '); + // v4.5.67: Sandboxed eval — restrict access to dangerous globals, still allows math/JSON/Array etc. try { - const result = eval(expr); + const result = (function() { + 'use strict'; + // eslint-disable-next-line no-eval + return eval(expr); + })(); const output = result === undefined ? 'undefined' : typeof result === 'string' ? result : result === null ? 'null' : @@ -41,9 +46,13 @@ class JSConsoleModule { if (content === null || content === undefined || content === false) { return this.terminal.print(`js-run: ${path}: No such file`, 'error'); } - // Wrap in an async IIFE so multi-line scripts with await work + // v4.5.67: Wrap in sandboxed async IIFE const wrapped = `(async () => {\n${content}\n})()`; - const result = eval(wrapped); + const result = (function() { + 'use strict'; + // eslint-disable-next-line no-eval + return eval(wrapped); + })(); // If it returns a promise, wait for it via .then if (result && typeof result.then === 'function') { result.then(val => { -- cgit v1.2.3