fix($parse): block assigning to fields of a constructor #12860
Conversation
Throw when assigning to a field of a constructor.
| throw $parseMinErr('isecaf', | ||
| 'Assigning to a constructor is disallowed! Expression: {0}', fullExpression); | ||
| } | ||
| } |
There was a problem hiding this comment.
So we only care about built-in constructors?
There was a problem hiding this comment.
we care the ones an expression can invoke and can be used to break the sandbox... the only other I can think about is Scope, but I really have no idea if it can be maliciously used. The alternative would be blocking to any property named constructor, but it might be just too much and there might be valid uses.
There was a problem hiding this comment.
So I guess we can't protect against developers putting stuff on the scope via a controller, such as the window object, for instance?
There was a problem hiding this comment.
there are other protections in place that prevent any form of access to several objects. Eg. DOM nodes and window
Throw when assigning to a field of a constructor. Closes #12860
|
I merged this into master and 1.4.x. |
|
@petebacondarwin sure, will do so later this week |
Throw when assigning to a field of a constructor. Closes #12860
Throw when assigning to a field of a constructor. Closes #12860
|
Magic! |
Throw when assigning to a field of a constructor.