Commits on Oct 21, 2016

1. Don't replace regex / function placeholders within string literals …

   Previously we weren't checking if the quote that started the placeholder
   was escaped or not, meaning an object like
   
       {"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"}
   
   Would be serialized as
   
       {"foo": /1"/, "bar": "a\/1"/}
   
   meaning an attacker could escape out of `bar` if they controlled both
   `foo` and `bar` and were able to guess the value of `<UID>`.
   
   UID was generated once on startup, was chosen using `Math.random()` and
   had a keyspace of roughly 4 billion, so within the realm of an online
   attack.
   
   Here's a simple example that will cause `console.log()` to be called when
   the `serialize()`d version is `eval()`d
   
       eval('('+ serialize({"foo": /1" + console.log(1)/i, "bar": '"@__R-<UID>-0__@'}) + ')');
   
   Where `<UID>` is the guessed `UID`.
   
   This fixes the issue by ensuring that placeholders are not preceded by
   a backslash.
   
   We also switch to a higher entropy `UID` to prevent people from guessing it.

   

   Jordan Milne authored and JordanMilne committed Oct 21, 2016
   Copy the full SHA

   31ad2d3 View commit details

   Browse the repository at this point in the history