Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

JSONata leaks internal references in expression when using lambdas #691

Closed
adamscybot opened this issue May 8, 2024 · 0 comments · Fixed by #692
Closed

JSONata leaks internal references in expression when using lambdas #691

adamscybot opened this issue May 8, 2024 · 0 comments · Fixed by #692
Labels

Comments

@adamscybot
Copy link
Contributor

I am creating this after corresponding with @andrew-coleman over email as it has some security implications.

Currently, one can use lambdas as a way to grab references to JSONata internals. For example:

$leak_env_refs := function() {1};
$leak_env_refs.environment.bind('whatever_you_want', false);

This seems unintentional and can potentially be used maliciously.

@adamscybot adamscybot changed the title JSONata leaks environment references in expression when using lambdas JSONata leaks internal references in expression when using lambdas May 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants