[CVE-2020-0710] Prevent Yield/Await in parameter scope

Author: Nolan Varani

lib/Parser/Parse.cpp

@@ -8378,17 +8378,15 @@ ParseNodePtr Parser::ParseExpr(int oplMin,
                 // binding operator, be it unary or binary.
                 Error(ERRsyntax);
             }
-            if (m_currentScope->GetScopeType() == ScopeType_Parameter
-                || (m_currentScope->GetScopeType() == ScopeType_Block && m_currentScope->GetEnclosingScope()->GetScopeType() == ScopeType_Parameter)) // Check whether this is a class definition inside param scope
+            if(m_currentScope->AncestorScopeIsParameter()) // Yield is not allowed within any parameter scope
             {
                 Error(ERRsyntax);
             }
         }
         else if (nop == knopAwait)
         {
             if (!this->GetScanner()->AwaitIsKeywordRegion() ||
-                m_currentScope->GetScopeType() == ScopeType_Parameter ||
-                (m_currentScope->GetScopeType() == ScopeType_Block && m_currentScope->GetEnclosingScope()->GetScopeType() == ScopeType_Parameter)) // Check whether this is a class definition inside param scope
+                m_currentScope->AncestorScopeIsParameter()) // Await is not allowed within any parameter scope
             {
                 // As with the 'yield' keyword, the case where 'await' is scanned as a keyword (tkAWAIT)
                 // but the scanner is not treating await as a keyword (!this->GetScanner()->AwaitIsKeyword())

lib/Runtime/ByteCode/Scope.h

@@ -169,6 +169,15 @@ class Scope
         return enclosingScope;
     }
 
+    bool AncestorScopeIsParameter() const
+    {
+        // Check if the current scope is a parameter or a block which belongs to a parameter scope
+        // In such cases, certain asynchronous behavior is forbidden
+        const Scope *currentScope = this;
+        while(currentScope->GetScopeType() != ScopeType_Global && currentScope->GetScopeType() != ScopeType_FunctionBody && currentScope->GetScopeType() != ScopeType_Parameter) currentScope = currentScope->GetEnclosingScope();
+        return (currentScope->GetScopeType() == ScopeType_Parameter);
+    }
+
     void SetScopeInfo(Js::ScopeInfo * scopeInfo)
     {
         this->scopeInfo = scopeInfo;

test/es7/misc_bugs.js

@@ -26,6 +26,20 @@ var tests = [
                     }`); });
         }
     },
+    {
+        name: "Await in class body should not crash",
+        body: function () {
+            async function trigger() {
+                a=class b{
+                    [a = class b{
+                        [await 0](){}
+                    }](){}
+                };
+            }
+
+            trigger();
+        }
+    },
 
 ];