{"action":"created","issue":{"url":"https://api.github.com/repos/RisingStack/nx-compile/issues/5","repository_url":"https://api.github.com/repos/RisingStack/nx-compile","labels_url":"https://api.github.com/repos/RisingStack/nx-compile/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/RisingStack/nx-compile/issues/5/comments","events_url":"https://api.github.com/repos/RisingStack/nx-compile/issues/5/events","html_url":"https://github.com/RisingStack/nx-compile/issues/5","id":174663005,"number":5,"title":"Bypass nx-compile 2.0 with hoisting","user":{"login":"matt-","id":453602,"avatar_url":"https://avatars.githubusercontent.com/u/453602?v=3","gravatar_id":"","url":"https://api.github.com/users/matt-","html_url":"https://github.com/matt-","followers_url":"https://api.github.com/users/matt-/followers","following_url":"https://api.github.com/users/matt-/following{/other_user}","gists_url":"https://api.github.com/users/matt-/gists{/gist_id}","starred_url":"https://api.github.com/users/matt-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matt-/subscriptions","organizations_url":"https://api.github.com/users/matt-/orgs","repos_url":"https://api.github.com/users/matt-/repos","events_url":"https://api.github.com/users/matt-/events{/privacy}","received_events_url":"https://api.github.com/users/matt-/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-09-02T01:40:23Z","updated_at":"2016-09-05T08:33:03Z","closed_at":null,"body":"In the proposal at: \r\nhttps://github.com/RisingStack/nx-compile/issues/2#issuecomment-241438171 and https://github.com/RisingStack/nx-compile/pull/3 you talk about \"Early closing the with block with a single '}' character is now not possible.\" \r\n\r\nIt looks like the idea for the fix was based on the fact that even if you break out of the \"with\" \r\nstatement you are after the return statement, and code after the return is assumed unreachable.  However a functions declared after the return statements are **hoisted** into scope(above the with statement).  If we name that function \"sandbox\" we replace the Proxy with our function bypassing the sandbox.\r\n\r\nresulting in the following code in the `new Function(`\r\n```javascript\r\n// this gets hoisted \r\nfunction sandbox(){}// }) }\r\n\r\nwith (sandbox) { \r\n\treturn (() => { \r\n\t\t'use strict'; global.isSecure=false\r\n\t})\r\n};\r\n\r\n```\r\n\r\nI created the following failing test as a POC: \r\n\r\n```javascript\r\nit('should protect against \"early mustache closing\" string manipulation and hoisting', () => {\r\n    const code = compiler.compileCode('global.isSecure=false})};function sandbox(){}//', {})\r\n    code()\r\n    expect(global.isSecure).to.be.true\r\n})\r\n```\r\n\r\nTested against https://github.com/RisingStack/nx-compile/pull/3"},"comment":{"url":"https://api.github.com/repos/RisingStack/nx-compile/issues/comments/244689319","html_url":"https://github.com/RisingStack/nx-compile/issues/5#issuecomment-244689319","issue_url":"https://api.github.com/repos/RisingStack/nx-compile/issues/5","id":244689319,"user":{"login":"solkimicreb","id":6956014,"avatar_url":"https://avatars.githubusercontent.com/u/6956014?v=3","gravatar_id":"","url":"https://api.github.com/users/solkimicreb","html_url":"https://github.com/solkimicreb","followers_url":"https://api.github.com/users/solkimicreb/followers","following_url":"https://api.github.com/users/solkimicreb/following{/other_user}","gists_url":"https://api.github.com/users/solkimicreb/gists{/gist_id}","starred_url":"https://api.github.com/users/solkimicreb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/solkimicreb/subscriptions","organizations_url":"https://api.github.com/users/solkimicreb/orgs","repos_url":"https://api.github.com/users/solkimicreb/repos","events_url":"https://api.github.com/users/solkimicreb/events{/privacy}","received_events_url":"https://api.github.com/users/solkimicreb/received_events","type":"User","site_admin":false},"created_at":"2016-09-05T08:33:03Z","updated_at":"2016-09-05T08:33:03Z","body":"Great (:\r\n\r\nI think the issues are fixed with the pre-compiling function. I am going to close this now.\r\n(I opened a few fresh issues for v2.0.0)"}}
{"actor":{"display_login":"solkimicreb"}}