Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[vulnerability][acl] ACL is not applied for properties of primitive values #347

Closed
t2ym opened this issue Mar 6, 2020 · 0 comments
Closed

Comments

@t2ym
Copy link
Owner

t2ym commented Mar 6, 2020

[vulnerability][acl] ACL is not applied for properties of primitive values

Root Cause

  • Described in the issue title

Reproducible Code

's'.hasOwnProperty; // acl.Object[S_PROTOTYPE][S_INSTANCE].$hasOwnProperty$ is not applied

Fix

  • Define and apply ACL for primitive values
    • types: string, number, boolean, symbol, bigint
    • classes: String, Number, Boolean, Symbol, BigInt
  • Handle primitive values in Policy.defaultAcl()

Note

  • bigint literal values cannot be parsed by the current version of hook() but bigint values can be created via BigInt() function
t2ym added a commit that referenced this issue Mar 6, 2020
@t2ym t2ym closed this as completed in cf659e4 Mar 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant