From 186288cdf02da3b05f7bd12452f5ea58453f2a01 Mon Sep 17 00:00:00 2001 From: Phil Pluckthun Date: Sat, 16 Jul 2022 02:48:43 +0100 Subject: [PATCH] Use Function constructor from iframe global object --- src/index.ts | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/index.ts b/src/index.ts index 04a6a3e..5e42424 100644 --- a/src/index.ts +++ b/src/index.ts @@ -81,6 +81,7 @@ function mask(target: any) { } let safeGlobal: Record | void; +let vmGlobals: Record = {}; function makeSafeGlobal() { if (safeGlobal) { @@ -101,7 +102,7 @@ function makeSafeGlobal() { // When we're in the browser, we can go a step further and try to create a // new JS context and globals in a separate iframe - let vmGlobals = trueGlobal; + vmGlobals = trueGlobal; let iframe: HTMLIFrameElement | void; if (typeof document !== 'undefined') { try { @@ -176,10 +177,15 @@ function SafeFunction(...args: string[]): Function { const safeGlobal = makeSafeGlobal(); const code = args.pop(); + // Retrieve Function constructor from vm globals + const Function = vmGlobals.Function as FunctionConstructor | void; + const Object = vmGlobals.Object as ObjectConstructor; + const createFunction = (Function || Object.constructor.constructor) as FunctionConstructor; + // We pass in our safe global and use it using `with` (ikr...) // We then add a wrapper function for strict-mode and a few closing // statements to prevent the code from escaping the `with` block; - const fn = new Function( + const fn = createFunction( 'globalThis', ...args, 'with (globalThis) {\n"use strict";\nreturn (function () {\n' + -- knotmirror 0.0.1