User can escape the sandbox language

[jcubic]

echo "${await gaiman.ask('? ')}"

This is valid and it's interpreted by gaiman, and it's executed. This is potential XSS.

Reported upstream estools/escodegen#448

[jcubic]

Another example is using constructor (after adding methods):

x = location.constructor.constructor("alert('x')")
x()

[jcubic]

Here is hacked eval function:

def eval(str)
    let fn = location.constructor.constructor("return $str")
    return fn()
end

let factorial = eval("(function(n) {
    return Array.from({length: n}, (_, i) => i + 1).reduce((a,b) => a * b, 1);
})")

echo factorial(10)

[jcubic]

I think that it will be not possible to protect the language, constructor can't be blacklisted because user can get the property dynamically:

def eval(str)
    let constructor = location["constructor"]["constructor"]
    let fn = constructor("return $str")
    return fn()
end

I think that if someone wants to hack the language it's ok, but with the original issue of the template literal, the user can inject the code into the developer game. Which can be a problem and security.

[jcubic]

Actually previous example will not work, because Gaiman don't support mutlline strings:

This code that currently works:

let code = <<<CODE
(function(n) {
   return Array.from({length: n}, (_, i) => i + 1).reduce((a,b) => a * b, 1);
})
CODE

let factorial = eval(code)

echo factorial(10)