localeval

v15.3.0

Published

3 years ago

A sandboxed eval().

Downloads

0High
0Medium
0Low

espadrine

Local Eval

Evaluate a string of JS code without access to the global object.

In Node.js, always use that instead of eval(). Always.

In the browser, do not expect it to be able to safely execute untrusted code yet.

API:

localeval(code :: String, sandbox :: Object) :: Object.

localeval(code :: String, sandbox :: Object,
          options :: Object, cb :: Function)

code: string of JS code.
sandbox: object whose values will be in the global object in the sandbox.
options: object containing the following optional fields:
- timeout: number of milliseconds that the child process has to run the code, beyond which it will be killed.
- uid: user id under which the child process must be set, if any.
- gid: group id under which the child process must be set, if any.

It returns the last evaluated piece of JS code in code, if no timeout is given. Otherwise, after at most timeout milliseconds, the callback gives that result as a parameter: function(error, result) {…}.

Node.js example:

var localeval = require('localeval');
localeval('console.log("Do I have access to the console?")');  // Throws.
localeval.clear();  // Kills processes used internally.

Browser example (experimental):

<!doctype html><title></title>
<script src='localeval.js'></script>
<!-- Alerts "32". -->
<script> alert(localeval('a + b', {a: 14, b: 18})) </script>

You may find an example of use in browser code in main.html.

Security

In Node.js, the following barriers are in place:

The code executes in a process-separated environment, benefitting from OS-level security protections such as memory separation. That is true for both the asynchronous and the synchronous version.
The code can be put on a timeout, to ensure it cannot loop indefinitely to cause a denial of service.
The code can be set to a zero-access user ID, ensuring that even if there was a vulnerability that allowed file system access, the OS would prevent reading confidential information, overwriting it, or executing sensitive code.
The code executes inside of a V8 isolate, which ensures the execution is separated from the process' code (which after all needs enough access to send the result back to the main process). Thus the code has a separate object graph and cannot affect that of the process it runs in. The environment is destroyed afterwards, as the whole process is exited.
On top of that, the isolate sandbox is crippled: only whitelisted globals are accessible. The others are not just syntactically shadowed, but outright garbage-collected.

Warning

In Node.js

We strongly recommend to set a timeout, and to set a uid and gid.

In the browser

The following inputs leak:

({}).constructor.getOwnPropertyNames = function(){return 'leak';}
Function("this.foo = 'leak'")()

If a timeout is given, an attacker can still use XHR:

Function("this.XMLHttpRequest(…); …")()

That said, it strives to achieve the following:

All local and global variables are inaccessible.
Variables defined while evaluating code don't pollute any scope.
Evaluated code cannot fiddle with global object's properties. Think localeval('([]).__proto__.push = function(a) { return "nope"; }').

Things to try

In comments are what should be executed outside the sandbox.

String.prototype.slice = function() { return 'leaked'; };
// 'nice'.slice(1) === 'ice'
String.fromCharCode = function() { return 'leaked'; };
// String.fromCharCode(42) === '*'
// var foo = 1
foo = 7
this.foo = 7
window.foo = 7
eval('foo = 7')
// foo === 1
delete Number.parseInt
// Number.parseInt('1337') === 1337
String.prototype.leak = function() { return 'leak'; }
// try { ''.leak() } catch(e) { /not a function/.test(e.message) }

This work is licensed under the Creative Commons Attribution 3.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/3.0/.

Published

Vulnerabilities

Links

Maintainers

Keywords

Readme