Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Securize: Increase isolation by stripping away prototypes #350

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Securize: Increase isolation by stripping away prototypes #350

wants to merge 1 commit into from

Commits on Sep 25, 2019

  1. Securize: Increase isolation by stripping away prototypes 

    When we assign our new `(secured-eval)` we've been allowing the `window`
property to bleed through as `this`. Additionally we have been setting
our forbidden symbols as the empty object `{}` which also exposes the
`Object` prototype.

In this patch we're replacing both of those in an attempt to further
limit the extent to which scripts can access global data.

The downside to this approach is that we've lost all prototypes that we
want, such as `Array.prototype.map`. The severity of this limitation is
so high that it's probably unmergable, but I'm hoping there might still
be a way to resolve that.
    @dmsnell
    dmsnell committed Sep 25, 2019
    Configuration menu
    Copy the full SHA
    70980c8 View commit details
    Browse the repository at this point in the history