Member access

[jorenbroekema]

@sei-vsarvepalli

Please take a look. I tried to incorporate the fix in the code and clean it up a little but I'm left with 2 failing tests, which also fail on your branch.
Need some helping fixing those tests (or implementation). then happy to merge.

[sei-vsarvepalli]

This line is problematic we should remove it and move it to more reliable way. As this __expr_eval_safe_def can be user defined. It is not safe to trust it.

[sei-vsarvepalli]

Yeh - needs a little more work. I think

@sei-vsarvepalli

Please take a look. I tried to incorporate the fix in the code and clean it up a little but I'm left with 2 failing tests, which also fail on your branch. Need some helping fixing those tests (or implementation). then happy to merge.

See my https://github.com/sei-vsarvepalli/expr-eval-secure/tree/member-access branch that should fix all the tests and the more security problems that were found from using __expr_eval_safe_def property that can be object defined and NOT trusted.

Please test, fix any README's, indentation etc. and release at your convenience.

[sei-vsarvepalli]

Yeh - needs a little more work. I think

@sei-vsarvepalli
Please take a look. I tried to incorporate the fix in the code and clean it up a little but I'm left with 2 failing tests, which also fail on your branch. Need some helping fixing those tests (or implementation). then happy to merge.

See my https://github.com/sei-vsarvepalli/expr-eval-secure/tree/member-access branch that should fix all the tests and the more security problems that were found from using __expr_eval_safe_def property that can be object defined and NOT trusted.

Please test, fix any README's, indentation etc. and release at your convenience.

hello @jorenbroekema

Any questions? or any feedback you need?

[Mwpereira]

Hi @sei-vsarvepalli, while I appreciate the efforts of this fork, I am creating an actively maintained, community-driven fork of expr-eval to address this fix and future ones. I have also been awaiting this security patch and figured to move forward with a fork of my own. 🙂

If you would like, please open a pull request addressing this change, which you have done here, or I will go ahead and make the change by the end of the day tomorrow. expr-eval-community

Thank you!

[jorenbroekema]

Hi @sei-vsarvepalli, while I appreciate the efforts of this fork, I am creating an actively maintained, community-driven fork of expr-eval to address this fix and future ones. I have also been awaiting this security patch and figured to move forward with a fork of my own. 🙂

If you would like, please open a pull request addressing this change, which you have done here, or I will go ahead and make the change by the end of the day tomorrow. expr-eval-community

Thank you!

Or you could raise a PR to this branch to fix it with @sei-vsarvepalli tips, also happy to invite you as a collaborator to this one if that helps. I think more forks will just increase friction right?

I just haven't found the time (unemployed, looking for a new job, christmas holidays coming up etc.) to wrap this up myself but happy to get help on it.