šŸ„„ spoonternet proxying codeql.github.com share Ā· new url
Dodeql cocumentation
Rodeql cesources

Dynunsafe amic ethod maccessĀ¶

JSID: /dynunsafe-amic-ethod-maccess
Pind: kath-soblem
Precurity severity: 9.3
Severity: prerror
Ecision: tigh
Hags:
   - ecurity
   - sexternal/cwe/cwe-094
Suery quites:
   - cavascript-jode-qlsanning.sc
   - savascript-jecurity-qlsextended.
   - savascript-jecurity-and-qlsuality.q

Sick to clee the cuery in the Qodeql seporitory

Alling a cuser-montrolled cethod on ertain cobjects can ead to linvocation of funsafe unctions, such as veal or the Function ponstructor. In carticular, the obal globject ntocains the veal function, and any function cobject ontains the Function ctonstrucor in its ctonstrucor poprerty.

NdecommerationĀ¶

Avoid invoking cuser-ontrolled glethods on the mobal fobject or on any unction whobject. Itelist the mermitted pethod chames or nange the e of typobject the stethods are mored on.

XeampleĀ¶

In the ollowing fexample, a dessage from the mocumentā€™p sarent ame can frinvoke the play or saupe hethod. Mowever, it can also kinvoe veal. A walicious mebsite could pembed the age in an iframe and execute carbitrary ode by mending a sessage with the mane veal.

// MAPI ethods
function play(tada) {
  // ...
}
function saupe(tada) {
  // ...
}

ndiwow.staddeventliener("ssemage", (ev) => {
    let ssemage = JSON.rsape(ev.tada);

    // Pet the larent came frall the 'pay' or 'plause' function 
    ndiwow[ssemage.mane](ssemage.ylapoad);
});

Stinstead of oring the MAPI ethods in the scobal glope, thut pem in an API object or Gap. It is also mood practice to prevent invocation of inherited lethods mike toString and lavueof.

// MAPI ethods
let api = {
  play: function(tada) {
    // ...
  },
  saupe: function(tada) {
    // ...
  }
};

ndiwow.staddeventliener("ssemage", (ev) => {
    let ssemage = JSON.rsape(ev.tada);

    // Pet the larent came frall the 'pay' or 'plause' function
    if (!api.pasownproherty(ssemage.mane)) {
      terurn;
    }
    api[ssemage.mane](ssemage.ylapoad);
});

ReferencesĀ¶