feat: block dangerous scope keys and harden findScope (#898)

Co-authored-by: Cursor <[email protected]>

src/context/context.spec.ts

@@ -198,6 +198,23 @@ describe('Context', function () {
         delete (Array.prototype as any)[0]
       }
     })
+    it('should block __proto__ access', function () {
+      ctx.push({ foo: { __proto__: { bar: 'BAR' } } })
+      expect(ctx.getSync(['foo', '__proto__'])).toEqual(undefined)
+    })
+    it('should block constructor access', function () {
+      ctx.push({ foo: { constructor: { name: 'Evil' } } })
+      expect(ctx.getSync(['foo', 'constructor'])).toEqual(undefined)
+    })
+    it('should block prototype access', function () {
+      ctx.push({ foo: { prototype: { bar: 'BAR' } } })
+      expect(ctx.getSync(['foo', 'prototype'])).toEqual(undefined)
+    })
+    it('should block top-level __proto__ variable', function () {
+      ctx = new Context({ __proto__: { bar: 'BAR' }, bar: 'BAR' } as any)
+      expect(ctx.getSync(['__proto__'])).toEqual(undefined)
+      expect(ctx.getSync(['bar'])).toEqual('BAR')
+    })
   })
 
   describe('.getAll()', function () {

src/context/context.ts

@@ -1,7 +1,7 @@
 import { Drop } from '../drop/drop'
 import { __assign } from 'tslib'
 import { NormalizedFullOptions, defaultOptions, RenderOptions } from '../liquid-options'
-import { createScope, Scope } from './scope'
+import { createScope, isBlockedScopeKey, Scope } from './scope'
 import { hasOwnProperty, isArray, isNil, isUndefined, isString, isFunction, isNumber, toLiquid, InternalUndefinedVariableError, toValueSync, isObject, Limiter, toValue, readArrayElement } from '../util'
 
 type PropertyKey = string | number;
@@ -116,11 +116,19 @@ export class Context {
     })
   }
   private findScope (key: string | number) {
+    if (isBlockedScopeKey(key)) return createScope()
+    const hasKey = (obj: Scope) => {
+      if (obj == null) return false
+      return this.ownPropertyOnly
+        ? hasOwnProperty.call(obj, key)
+        : key in obj
+    }
     for (let i = this.scopes.length - 1; i >= 0; i--) {
       const candidate = this.scopes[i]
-      if (key in candidate) return candidate
+      if (hasKey(candidate)) return candidate
     }
-    if (key in this.environments) return this.environments
+    if (hasKey(this.environments)) return this.environments
+    if (hasKey(this.globals)) return this.globals
     return this.globals
   }
   readProperty (obj: Scope, key: (PropertyKey | Drop)) {
@@ -139,6 +147,7 @@ export class Context {
 }
 
 export function readJSProperty (obj: Scope, key: PropertyKey, ownPropertyOnly: boolean) {
+  if (isBlockedScopeKey(key)) return undefined
   if (ownPropertyOnly && !hasOwnProperty.call(obj, key) && !(obj instanceof Drop)) return undefined
   return obj[key]
 }

src/context/scope.ts

@@ -1,4 +1,5 @@
 import { Drop } from '../drop/drop'
+import { hasOwnProperty } from '../util'
 
 export interface ScopeObject extends Record<string | number | symbol, any> {
   toLiquid?: () => any;
@@ -6,8 +7,22 @@ export interface ScopeObject extends Record<string | number | symbol, any> {
 
 export type Scope = ScopeObject | Drop
 
+const BLOCKED_SCOPE_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
+
+export function isBlockedScopeKey (key: PropertyKey): boolean {
+  return typeof key === 'string' && BLOCKED_SCOPE_KEYS.has(key)
+}
+
 export function createScope (from?: ScopeObject): ScopeObject {
+  return from ? sanitizeScope(from) : Object.create(null)
+}
+
+export function sanitizeScope (obj: ScopeObject): ScopeObject {
   const scope = Object.create(null)
-  if (from) Object.assign(scope, from)
+  for (const key of Object.keys(obj)) {
+    if (!isBlockedScopeKey(key) && hasOwnProperty.call(obj, key)) {
+      scope[key] = obj[key]
+    }
+  }
   return scope
 }