Skip to content

Unsafe use of eval #82

@cristianstaicu

Description

@cristianstaicu

In file lib/utils/sea.js, the following use of eval is dangerous:

    if (configSource) {
        configData = eval('(' + configSource + ')');
    }

The config file can be used to inject arbitrary commands. Either validate the content of the file, use JSON.parse or use a more advanced sanitization package like:
https://www.npmjs.com/package/eval-sanitizer

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions