expr-eval

expr-eval copied to clipboard

Report security vulnerability

9

Bypass : https://github.com/silentmatt/expr-eval/pull/288 The patch introduced an "allow-list" security model and an `isAllowedFunc` function to validate callable functions. However, the `isAllowedFunc` function still permits functions that are members of objects...

huydoppaz

Security advisory GHSA-jc85-fpwf-qm7x - request mitigation option to block function calls

4

Hello maintainers and @silentmatt - after the advisory GHSA-jc85-fpwf-qm7x, our builds now fail on audit because expr-eval allows expressions to call any functions passed in via scope. We’re looking for...

notnull-bmiller

Security Patch.

11

Fixes a vulnerability in the `expr-eval` package. We are unable to reach the researcher @silentmatt and @jorenbroekema developers who have their versions in the npmjs repository. Vijay Sarvepalli on behalf...

sei-vsarvepalli

Updated the security policy to reflect supported versions and reporting process.

sei-vsarvepalli

The description says "does allow in" but example has it false, so unless I'm missing something this is a fix

mnbroatch

For example in normal JS, I can just do this to access it: ```JavaScript my_variable["my-property"] ``` I try with `expr-eval` something like this, it return `undefined` even though it should...

hashfiputra