diff -Nru node-static-eval-2.0.0/CHANGELOG.md node-static-eval-2.1.0/CHANGELOG.md --- node-static-eval-2.0.0/CHANGELOG.md 1970-01-01 00:00:00.000000000 +0000 +++ node-static-eval-2.1.0/CHANGELOG.md 2020-06-15 10:23:03.000000000 +0000 @@ -0,0 +1,15 @@ +# static-eval Change Log +All notable changes to this project will be documented in this file. +This project adheres to [Semantic Versioning](http://semver.org/). + +## 2.1.0 +* Add `allowAccessToMethodsOnFunctions` option to restore 1.x behaviour so that [cwise](https://github.com/scijs/cwise) can upgrade. ([@archmoj](https://github.com/archmoj) in [#31](https://github.com/browserify/static-eval/pull/31)) + + Do not use this option if you are not sure that you need it, as it had previously been removed for security reasons. There is a known exploit to execute arbitrary code. Only use it on trusted inputs, like the developer's JS files in a build system. + +## 2.0.5 +* Fix function bodies being invoked during declaration. ([@RoboPhred](https://github.com/RoboPhred) in [#30](https://github.com/browserify/static-eval/pull/30)) + +## 2.0.4 +* Short-circuit evaluation in `&&` and `||` expressions. ([@RoboPhred](https://github.com/RoboPhred) in [#28](https://github.com/browserify/static-eval/pull/28)) +* Start tracking changes. diff -Nru node-static-eval-2.0.0/debian/changelog node-static-eval-2.1.0/debian/changelog --- node-static-eval-2.0.0/debian/changelog 2018-06-06 14:58:20.000000000 +0000 +++ node-static-eval-2.1.0/debian/changelog 2020-12-19 12:14:58.000000000 +0000 @@ -1,3 +1,24 @@ +node-static-eval (2.1.0-1) unstable; urgency=medium + + * Team upload + + [ Debian Janitor ] + * Bump debhelper from old 11 to 12. + * Set debhelper-compat version in Build-Depends. + * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository, + Repository-Browse. + + [ Xavier Guimard ] + * Bump debhelper compatibility level to 13 + * Declare compliance with policy 4.5.1 + * Add "Rules-Requires-Root: no" + * Add debian/gbp.conf + * Use dh-sequence-nodejs auto test & install + * New upstream version 2.1.0 + * Update docs + + -- Xavier Guimard Sat, 19 Dec 2020 13:14:58 +0100 + node-static-eval (2.0.0-1) unstable; urgency=medium * New upstream version diff -Nru node-static-eval-2.0.0/debian/compat node-static-eval-2.1.0/debian/compat --- node-static-eval-2.0.0/debian/compat 2018-06-06 14:58:20.000000000 +0000 +++ node-static-eval-2.1.0/debian/compat 1970-01-01 00:00:00.000000000 +0000 @@ -1 +0,0 @@ -11 diff -Nru node-static-eval-2.0.0/debian/control node-static-eval-2.1.0/debian/control --- node-static-eval-2.0.0/debian/control 2018-06-06 14:58:20.000000000 +0000 +++ node-static-eval-2.1.0/debian/control 2020-12-19 12:10:11.000000000 +0000 @@ -1,27 +1,24 @@ Source: node-static-eval -Section: javascript -Priority: optional Maintainer: Debian Javascript Maintainers Uploaders: Bastien Roucariès -Build-Depends: - debhelper (>= 11) - , dh-buildinfo - , dpkg-dev (>= 1.17.14) - , nodejs (>= 4.7) - , node-tape (>= 0.1.5) - , node-escodegen (>= 1.8.1) +Section: javascript +Testsuite: autopkgtest-pkg-nodejs +Priority: optional +Build-Depends: debhelper-compat (= 13) + , dh-sequence-nodejs + , node-escodegen , node-tap (>= 10) -Standards-Version: 4.1.4 -Homepage: https://github.com/substack/static-eval -Vcs-Git: https://salsa.debian.org/js-team/node-static-eval.git + , node-tape +Standards-Version: 4.5.1 Vcs-Browser: https://salsa.debian.org/js-team/node-static-eval +Vcs-Git: https://salsa.debian.org/js-team/node-static-eval.git +Homepage: https://github.com/substack/static-eval +Rules-Requires-Root: no Package: node-static-eval Architecture: all -Depends: - ${misc:Depends} - , nodejs (>= 4.7) - , node-escodegen (>= 1.8.1) +Depends: ${misc:Depends} + , node-escodegen Description: evaluate statically-analyzable javascript expressions This javascript module decompose expression in abstract tree and try to evaluate static evaluable expressions. diff -Nru node-static-eval-2.0.0/debian/copyright node-static-eval-2.1.0/debian/copyright --- node-static-eval-2.0.0/debian/copyright 2018-06-06 14:58:20.000000000 +0000 +++ node-static-eval-2.1.0/debian/copyright 2020-12-19 12:07:48.000000000 +0000 @@ -31,4 +31,3 @@ ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - diff -Nru node-static-eval-2.0.0/debian/docs node-static-eval-2.1.0/debian/docs --- node-static-eval-2.0.0/debian/docs 2018-06-06 14:56:38.000000000 +0000 +++ node-static-eval-2.1.0/debian/docs 2020-12-19 12:12:55.000000000 +0000 @@ -1 +1,2 @@ readme.markdown +security.md diff -Nru node-static-eval-2.0.0/debian/examples node-static-eval-2.1.0/debian/examples --- node-static-eval-2.0.0/debian/examples 2018-06-06 14:56:38.000000000 +0000 +++ node-static-eval-2.1.0/debian/examples 2020-12-19 12:07:48.000000000 +0000 @@ -1 +1 @@ -example/* \ No newline at end of file +example/* diff -Nru node-static-eval-2.0.0/debian/gbp.conf node-static-eval-2.1.0/debian/gbp.conf --- node-static-eval-2.0.0/debian/gbp.conf 1970-01-01 00:00:00.000000000 +0000 +++ node-static-eval-2.1.0/debian/gbp.conf 2020-12-19 12:07:35.000000000 +0000 @@ -0,0 +1,5 @@ +[DEFAULT] +pristine-tar = True + +[import-orig] +filter = [ '.gitignore', '.travis.yml', '.git*' ] diff -Nru node-static-eval-2.0.0/debian/install node-static-eval-2.1.0/debian/install --- node-static-eval-2.0.0/debian/install 2018-06-06 14:56:38.000000000 +0000 +++ node-static-eval-2.1.0/debian/install 1970-01-01 00:00:00.000000000 +0000 @@ -1,2 +0,0 @@ -index.js usr/lib/nodejs/static-eval/ -package.json usr/lib/nodejs/static-eval/ diff -Nru node-static-eval-2.0.0/debian/rules node-static-eval-2.1.0/debian/rules --- node-static-eval-2.0.0/debian/rules 2018-06-06 14:58:20.000000000 +0000 +++ node-static-eval-2.1.0/debian/rules 2020-12-19 12:08:54.000000000 +0000 @@ -7,15 +7,6 @@ %: dh $@ -override_dh_auto_test: -ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS) $(DEB_BUILD_PROFILES))) - tap -R spec test/*.js -else - @echo '**********************************************************' - @echo 'Skip test suite ' - @echo '**********************************************************' -endif - override_dh_installexamples: ifeq (,$(filter nodoc,$(DEB_BUILD_OPTIONS) $(DEB_BUILD_PROFILES))) dh_installexamples diff -Nru node-static-eval-2.0.0/debian/salsa-ci.yml node-static-eval-2.1.0/debian/salsa-ci.yml --- node-static-eval-2.0.0/debian/salsa-ci.yml 1970-01-01 00:00:00.000000000 +0000 +++ node-static-eval-2.1.0/debian/salsa-ci.yml 2020-12-19 12:07:40.000000000 +0000 @@ -0,0 +1,4 @@ +--- +include: + - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml + - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml diff -Nru node-static-eval-2.0.0/debian/tests/control node-static-eval-2.1.0/debian/tests/control --- node-static-eval-2.0.0/debian/tests/control 2018-06-06 14:58:20.000000000 +0000 +++ node-static-eval-2.1.0/debian/tests/control 2020-12-19 12:09:02.000000000 +0000 @@ -1,8 +1,4 @@ -Tests: require -Depends: node-static-eval, nodejs (>= 6) - -Tests: runtestsuite -Depends: node-static-eval, node-tape, node-tap (>= 10) - Tests: runexamples -Depends: node-static-eval, nodejs (>= 6) +Depends: + node-static-eval + , nodejs (>= 6) diff -Nru node-static-eval-2.0.0/debian/tests/pkg-js/test node-static-eval-2.1.0/debian/tests/pkg-js/test --- node-static-eval-2.0.0/debian/tests/pkg-js/test 1970-01-01 00:00:00.000000000 +0000 +++ node-static-eval-2.1.0/debian/tests/pkg-js/test 2020-12-19 12:08:45.000000000 +0000 @@ -0,0 +1 @@ +tap test/*.js diff -Nru node-static-eval-2.0.0/debian/tests/require node-static-eval-2.1.0/debian/tests/require --- node-static-eval-2.0.0/debian/tests/require 2018-06-06 14:58:20.000000000 +0000 +++ node-static-eval-2.1.0/debian/tests/require 1970-01-01 00:00:00.000000000 +0000 @@ -1,3 +0,0 @@ -#!/bin/sh -set -e -node -e "require('static-eval');" diff -Nru node-static-eval-2.0.0/debian/tests/runtestsuite node-static-eval-2.1.0/debian/tests/runtestsuite --- node-static-eval-2.0.0/debian/tests/runtestsuite 2018-06-06 14:58:20.000000000 +0000 +++ node-static-eval-2.1.0/debian/tests/runtestsuite 1970-01-01 00:00:00.000000000 +0000 @@ -1,4 +0,0 @@ -#!/bin/sh -set -e - -tap -R spec test/*.js diff -Nru node-static-eval-2.0.0/debian/TODO node-static-eval-2.1.0/debian/TODO --- node-static-eval-2.0.0/debian/TODO 2018-06-06 14:56:38.000000000 +0000 +++ node-static-eval-2.1.0/debian/TODO 1970-01-01 00:00:00.000000000 +0000 @@ -1 +0,0 @@ -+ check why example eval fail diff -Nru node-static-eval-2.0.0/debian/upstream/metadata node-static-eval-2.1.0/debian/upstream/metadata --- node-static-eval-2.0.0/debian/upstream/metadata 1970-01-01 00:00:00.000000000 +0000 +++ node-static-eval-2.1.0/debian/upstream/metadata 2020-12-19 12:07:32.000000000 +0000 @@ -0,0 +1,5 @@ +--- +Bug-Database: https://github.com/substack/static-eval/issues +Bug-Submit: https://github.com/substack/static-eval/issues/new +Repository: https://github.com/substack/static-eval.git +Repository-Browse: https://github.com/substack/static-eval diff -Nru node-static-eval-2.0.0/index.js node-static-eval-2.1.0/index.js --- node-static-eval-2.0.0/index.js 2017-10-05 08:58:45.000000000 +0000 +++ node-static-eval-2.1.0/index.js 2020-06-15 10:23:03.000000000 +0000 @@ -1,15 +1,18 @@ var unparse = require('escodegen').generate; -module.exports = function (ast, vars) { +module.exports = function (ast, vars, opts) { + if(!opts) opts = {}; + var rejectAccessToMethodsOnFunctions = !opts.allowAccessToMethodsOnFunctions; + if (!vars) vars = {}; var FAIL = {}; - - var result = (function walk (node, scopeVars) { + + var result = (function walk (node, noExecute) { if (node.type === 'Literal') { return node.value; } else if (node.type === 'UnaryExpression'){ - var val = walk(node.argument) + var val = walk(node.argument, noExecute) if (node.operator === '+') return +val if (node.operator === '-') return -val if (node.operator === '~') return ~val @@ -19,7 +22,7 @@ else if (node.type === 'ArrayExpression') { var xs = []; for (var i = 0, l = node.elements.length; i < l; i++) { - var x = walk(node.elements[i]); + var x = walk(node.elements[i], noExecute); if (x === FAIL) return FAIL; xs.push(x); } @@ -31,7 +34,7 @@ var prop = node.properties[i]; var value = prop.value === null ? prop.value - : walk(prop.value) + : walk(prop.value, noExecute) ; if (value === FAIL) return FAIL; obj[prop.key.value || prop.key.name] = value; @@ -40,12 +43,30 @@ } else if (node.type === 'BinaryExpression' || node.type === 'LogicalExpression') { - var l = walk(node.left); + var op = node.operator; + + if (op === '&&') { + var l = walk(node.left); + if (l === FAIL) return FAIL; + if (!l) return l; + var r = walk(node.right); + if (r === FAIL) return FAIL; + return r; + } + else if (op === '||') { + var l = walk(node.left); + if (l === FAIL) return FAIL; + if (l) return l; + var r = walk(node.right); + if (r === FAIL) return FAIL; + return r; + } + + var l = walk(node.left, noExecute); if (l === FAIL) return FAIL; - var r = walk(node.right); + var r = walk(node.right, noExecute); if (r === FAIL) return FAIL; - - var op = node.operator; + if (op === '==') return l == r; if (op === '===') return l === r; if (op === '!=') return l != r; @@ -62,9 +83,7 @@ if (op === '|') return l | r; if (op === '&') return l & r; if (op === '^') return l ^ r; - if (op === '&&') return l && r; - if (op === '||') return l || r; - + return FAIL; } else if (node.type === 'Identifier') { @@ -80,70 +99,80 @@ else return FAIL; } else if (node.type === 'CallExpression') { - var callee = walk(node.callee); + var callee = walk(node.callee, noExecute); if (callee === FAIL) return FAIL; if (typeof callee !== 'function') return FAIL; - - var ctx = node.callee.object ? walk(node.callee.object) : FAIL; + + + var ctx = node.callee.object ? walk(node.callee.object, noExecute) : FAIL; if (ctx === FAIL) ctx = null; var args = []; for (var i = 0, l = node.arguments.length; i < l; i++) { - var x = walk(node.arguments[i]); + var x = walk(node.arguments[i], noExecute); if (x === FAIL) return FAIL; args.push(x); } + + if (noExecute) { + return undefined; + } + return callee.apply(ctx, args); } else if (node.type === 'MemberExpression') { - var obj = walk(node.object); - // do not allow access to methods on Function - if((obj === FAIL) || (typeof obj == 'function')){ + var obj = walk(node.object, noExecute); + if((obj === FAIL) || ( + (typeof obj == 'function') && rejectAccessToMethodsOnFunctions + )){ return FAIL; } - if (node.property.type === 'Identifier') { + if (node.property.type === 'Identifier' && !node.computed) { + if (isUnsafeProperty(node.property.name)) return FAIL; return obj[node.property.name]; } - var prop = walk(node.property); - if (prop === FAIL) return FAIL; + var prop = walk(node.property, noExecute); + if (prop === null || prop === FAIL) return FAIL; + if (isUnsafeProperty(prop)) return FAIL; return obj[prop]; } else if (node.type === 'ConditionalExpression') { - var val = walk(node.test) + var val = walk(node.test, noExecute) if (val === FAIL) return FAIL; - return val ? walk(node.consequent) : walk(node.alternate) + return val ? walk(node.consequent) : walk(node.alternate, noExecute) } else if (node.type === 'ExpressionStatement') { - var val = walk(node.expression) + var val = walk(node.expression, noExecute) if (val === FAIL) return FAIL; return val; } else if (node.type === 'ReturnStatement') { - return walk(node.argument) + return walk(node.argument, noExecute) } else if (node.type === 'FunctionExpression') { - var bodies = node.body.body; - + // Create a "scope" for our arguments var oldVars = {}; Object.keys(vars).forEach(function(element){ oldVars[element] = vars[element]; }) - node.params.forEach(function(key) { + for(var i=0; i