use initSafeStandardObjects() instead of initStandardObjects() to avo…

…id execution of arbitrary (java) code
HtmlUnit · Jan 24, 2020 · 0ffc3f7 · 0ffc3f7
1 parent dfa6ffc
commit 0ffc3f7
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/src/main/java/com/gargoylesoftware/htmlunit/ProxyAutoConfig.java b/src/main/java/com/gargoylesoftware/htmlunit/ProxyAutoConfig.java
@@ -55,7 +55,7 @@ public static String evaluate(final String content, final URL url) {
         final Context cx = Context.enter();
         try {
             final ProxyAutoConfig config = new ProxyAutoConfig();
-            final Scriptable scope = cx.initStandardObjects();
+            final Scriptable scope = cx.initSafeStandardObjects();
 
             config.defineMethod("isPlainHostName", scope);
             config.defineMethod("dnsDomainIs", scope);

diff --git a/src/main/java/com/gargoylesoftware/htmlunit/javascript/JavaScriptEngine.java b/src/main/java/com/gargoylesoftware/htmlunit/javascript/JavaScriptEngine.java
@@ -202,7 +202,7 @@ private void init(final WebWindow webWindow, final Context context) throws Excep
 
         final Window window = new Window();
         ((SimpleScriptable) window).setClassName("Window");
-        context.initStandardObjects(window);
+        context.initSafeStandardObjects(window);
 
         final ClassConfiguration windowConfig = jsConfig_.getClassConfiguration("Window");
         if (windowConfig.getJsConstructor() != null) {

diff --git a/...java/com/gargoylesoftware/htmlunit/javascript/host/worker/DedicatedWorkerGlobalScope.java b/...java/com/gargoylesoftware/htmlunit/javascript/host/worker/DedicatedWorkerGlobalScope.java
@@ -82,7 +82,7 @@ public DedicatedWorkerGlobalScope() {
      */
     DedicatedWorkerGlobalScope(final Window owningWindow, final Context context, final BrowserVersion browserVersion,
             final Worker worker) throws Exception {
-        context.initStandardObjects(this);
+        context.initSafeStandardObjects(this);
 
         final ClassConfiguration config = AbstractJavaScriptConfiguration.getClassConfiguration(
                 DedicatedWorkerGlobalScope.class, browserVersion);