@@ -83,8 +83,9 @@ describe('#saferEval', function () {
8383 } )
8484
8585 it ( 'setInterval passing a function' , function ( done ) {
86- var res = saferEval ( '(function (){var id = setInterval(function () {Array._test = 111; console.log("intervall"); clearInterval(id)}, 5)}())' )
87- assert . strictEqual ( res )
86+ var res = saferEval ( '(function (){var id = setInterval(function () {Array._test = 111; console.log("interval"); clearInterval(id)}, 5)})' )
87+ assert . strictEqual ( typeof res , 'function' )
88+ res ( )
8889 setTimeout ( function ( ) {
8990 assert . strictEqual ( Array . _test , undefined )
9091 done ( )
@@ -270,6 +271,22 @@ describe('#saferEval', function () {
270271 }
271272 assert . strictEqual ( res , undefined )
272273 } )
274+ it ( 'should not allow using console.constructor.constructor' , function ( ) {
275+ let res
276+ try {
277+ res = saferEval ( "console.constructor.constructor('return process')().env" )
278+ } catch ( e ) {
279+ }
280+ assert . strictEqual ( res , undefined )
281+ } )
282+ it ( 'should not allow using JSON.constructor.constructor' , function ( ) {
283+ let res
284+ try {
285+ res = saferEval ( "JSON.constructor.constructor('return process')().env" )
286+ } catch ( e ) {
287+ }
288+ assert . strictEqual ( res , undefined )
289+ } )
273290 it ( 'should prevent a breakout using Object.constructor' , function ( ) {
274291 let res
275292 try {
@@ -301,7 +318,15 @@ describe('#saferEval', function () {
301318 it ( 'should not allow using Object.constructor.constructor' , function ( ) {
302319 let res
303320 try {
304- res = saferEval ( "Object.constructor.constructor('return localStorage')()" )
321+ res = saferEval ( "Object.constructor.constructor('return window')()" )
322+ } catch ( e ) {
323+ }
324+ assert . strictEqual ( res , undefined )
325+ } )
326+ it ( 'should not allow using console.constructor.constructor' , function ( ) {
327+ let res
328+ try {
329+ res = saferEval ( "console.constructor.constructor('return window')()" )
305330 } catch ( e ) {
306331 }
307332 assert . strictEqual ( res , undefined )
0 commit comments