fix(eval): rce using non-string prop names

ref: https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456

Author: 80avin

badges/tests-badge.svg

@@ -1297,8 +1297,13 @@ const SafeEval = {
     return ast.value;
   },
   evalMemberExpression(ast, subs) {
-    const prop = ast.computed ? SafeEval.evalAst(ast.property) // `object[property]`
-    : ast.property.name; // `object.property` property is Identifier
+    const prop = String(
+    // NOTE: `String(value)` throws error when
+    // value has overwritten the toString method to return non-string
+    // i.e. `value = {toString: () => []}`
+    ast.computed ? SafeEval.evalAst(ast.property) // `object[property]`
+    : ast.property.name // `object.property` property is Identifier
+    );
     const obj = SafeEval.evalAst(ast.object, subs);
     if (obj === undefined || obj === null) {
       throw TypeError(`Cannot read properties of ${obj} (reading '${prop}')`);

dist/index-browser-esm.js

@@ -1303,8 +1303,13 @@
 	    return ast.value;
 	  },
 	  evalMemberExpression(ast, subs) {
-	    const prop = ast.computed ? SafeEval.evalAst(ast.property) // `object[property]`
-	    : ast.property.name; // `object.property` property is Identifier
+	    const prop = String(
+	    // NOTE: `String(value)` throws error when
+	    // value has overwritten the toString method to return non-string
+	    // i.e. `value = {toString: () => []}`
+	    ast.computed ? SafeEval.evalAst(ast.property) // `object[property]`
+	    : ast.property.name // `object.property` property is Identifier
+	    );
 	    const obj = SafeEval.evalAst(ast.object, subs);
 	    if (obj === undefined || obj === null) {
 	      throw TypeError(`Cannot read properties of ${obj} (reading '${prop}')`);

dist/index-browser-esm.min.js

@@ -1298,8 +1298,13 @@ const SafeEval = {
     return ast.value;
   },
   evalMemberExpression(ast, subs) {
-    const prop = ast.computed ? SafeEval.evalAst(ast.property) // `object[property]`
-    : ast.property.name; // `object.property` property is Identifier
+    const prop = String(
+    // NOTE: `String(value)` throws error when
+    // value has overwritten the toString method to return non-string
+    // i.e. `value = {toString: () => []}`
+    ast.computed ? SafeEval.evalAst(ast.property) // `object[property]`
+    : ast.property.name // `object.property` property is Identifier
+    );
     const obj = SafeEval.evalAst(ast.object, subs);
     if (obj === undefined || obj === null) {
       throw TypeError(`Cannot read properties of ${obj} (reading '${prop}')`);

dist/index-browser-esm.min.js.map

@@ -1296,8 +1296,13 @@ const SafeEval = {
     return ast.value;
   },
   evalMemberExpression(ast, subs) {
-    const prop = ast.computed ? SafeEval.evalAst(ast.property) // `object[property]`
-    : ast.property.name; // `object.property` property is Identifier
+    const prop = String(
+    // NOTE: `String(value)` throws error when
+    // value has overwritten the toString method to return non-string
+    // i.e. `value = {toString: () => []}`
+    ast.computed ? SafeEval.evalAst(ast.property) // `object[property]`
+    : ast.property.name // `object.property` property is Identifier
+    );
     const obj = SafeEval.evalAst(ast.object, subs);
     if (obj === undefined || obj === null) {
       throw TypeError(`Cannot read properties of ${obj} (reading '${prop}')`);