fix(this): fix 'this' exposing the global object inside sandboxed code

Author: solkimicreb

README.md

@@ -132,6 +132,37 @@ const code = compiler.compileCode('console.log(localVariable)')
 code({}, ['console', 'localVariable'])
 ```
 
+#### 'this' inside the sandboxed code
+
+`this` points to the sandbox inside the sandboxed code.
+
+```js
+const compiler = require('@risingstack/nx-compile')
+
+const message = 'local message'
+const code = compiler.compileCode('console.log(this.message)')
+
+// outputs 'sandboxed message' to the console
+code({message: 'sandboxed message'}, ['console'])
+```
+
+#### functions defined inside the sandboxed code
+
+Functions defined inside the sandboxed code are also sandboxed.
+
+```js
+const compiler = require('@risingstack/nx-compile')
+
+const message = 'local message'
+const rawCode = '({}).__proto__.func = function() { return message }'
+const code = compiler.compileCode(rawCode)
+
+code({message: 'sandboxed message'})
+
+// outputs 'sandboxed message' to the console
+console.log(({}).func())
+```
+
 ## Contributions
 
 This library has the very specific purpose of supporting the [NX framework](https://github.com/RisingStack/nx-framework). Features should only be added, if they are used by the framework. Otherwise please fork.

compiler.js

@@ -31,13 +31,14 @@ function compileCode (src) {
     }
 
     if (!sandboxProxies.has(sandbox)) {
-      sandboxProxies.set(sandbox, new Proxy(sandbox, {has: has, get: get}))
+      sandboxProxies.set(sandbox, new Proxy(sandbox, {has, get}))
     }
     currentAllowedGlobals = allowedGlobals
+    const sandboxProxy = sandboxProxies.get(sandbox)
 
     let result
     try {
-      result = code(sandboxProxies.get(sandbox))
+      result = code.call(sandboxProxy, sandboxProxy)
     } finally {
       currentAllowedGlobals = undefined
     }

compiler.test.js

@@ -9,12 +9,6 @@ const localProp = 1
 
 describe('nx-compile', () => {
   describe('compileCode', () => {
-    it('should execute code in a sandbox', () => {
-      const code = compiler.compileCode('return prop1 + prop2')
-      const value = code({prop1: 1, prop2: 2})
-      expect(value).to.equal(3)
-    })
-
     it('should throw TypeError on invalid source argument', () => {
       expect(() => compiler.compileCode({})).to.throw(TypeError)
       expect(() => compiler.compileCode()).to.throw(TypeError)
@@ -23,12 +17,6 @@ describe('nx-compile', () => {
   })
 
   describe('compileExpression', () => {
-    it('should execute expression in a sandbox', () => {
-      const expression = compiler.compileExpression('prop1 + prop2')
-      const value = expression({prop1: 1, prop2: 2})
-      expect(value).to.equal(3)
-    })
-
     it('should throw TypeError on invalid source argument', () => {
       expect(() => compiler.compileExpression({})).to.throw(TypeError)
       expect(() => compiler.compileExpression()).to.throw(TypeError)
@@ -37,6 +25,31 @@ describe('nx-compile', () => {
   })
 
   describe('returned function (compiled code or expression)', () => {
+    it('should execute in a sandbox', () => {
+      const expression = compiler.compileExpression('prop1 + prop2')
+      const value = expression({prop1: 1, prop2: 2})
+      expect(value).to.equal(3)
+    })
+
+    it('should not expose globals to the sandbox', () => {
+      const expression = compiler.compileExpression('prop1')
+      const value = expression({})
+      expect(value).to.equal(undefined)
+    })
+
+    it('should not expose globals inside functions defined in the passed code', () => {
+      const rawCode = '({}).__proto__.evil = function() { return prop1 + prop2 }'
+      const code = compiler.compileCode(rawCode)
+      code({prop1: 1, prop2: 2})
+      expect(({}).evil()).to.equal(3)
+    })
+
+    it('"this" should be the sandbox instead of the global object', () => {
+      const expression = compiler.compileExpression('this.prop1 + this.prop2')
+      const value = expression({prop1: 1, prop2: 2}, [])
+      expect(value).to.equal(3)
+    })
+
     it('should expose specified globals to the sandbox', () => {
       const expression = compiler.compileExpression('prop1 + prop2')
       const value = expression({}, ['prop1', 'prop2'])

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@risingstack/nx-compile",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Execution of strings as code in a secure, sandboxed environment.",
   "main": "compiler.js",
   "scripts": {