Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

v1.2.4 change PyExecJS to node_vm2 #31

Merged
merged 1 commit into from Apr 21, 2021
Merged

v1.2.4 change PyExecJS to node_vm2 #31

merged 1 commit into from Apr 21, 2021

Conversation

leommxj
Copy link
Contributor

@leommxj leommxj commented Apr 11, 2021

032f343 中针对可能的部分危险函数做了过滤,但像 @rtcatc 评论的一样nodejs中还有许多危险函数可能导致rce。比如Function关键字

document.createElement("script");
q.p+"";new Function(String.fromCharCode(恶意代码ascii))();//"{114514:;[s].js 

同时更多的过滤限制会导致其起到的作用减少。将pyexecjs换成node_vm2可以更安全的处理js,并且可以依赖vm2的更新。同时能执行合理的危险函数如简单的eval。
不清楚是否代码保持作者原本的预期功能。

@rtcatc
Copy link
Owner

rtcatc commented Apr 21, 2021

感谢提交以及支持!我们会在本地测试完兼容性之后合并分支

@rtcatc rtcatc merged commit 2853c62 into rtcatc:master Apr 21, 2021
@rtcatc
Copy link
Owner

rtcatc commented Apr 21, 2021

本地兼容性测试完毕,运行完美现已合并请求,感谢大佬的建议
Merci

@rtcatc rtcatc changed the title change PyExecJS to node_vm2 v1.2.4 change PyExecJS to node_vm2 Sep 6, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants