oasisprotocol / oasisprotocol/oasis-sdk
protobufjs uses eval
Open
Nobody has claimed this yet.
c:client-sdk/typescript
- Dominant language
- Rust
- Stars
- 90
- Forks
- 35
- Avg merge
- 5d 9h
- Merged PRs (30d)
- 5
Description
This adds evil eval( call https://github.com/protobufjs/protobuf.js/blob/d13d5d5/lib/inquire/index.js#L12
we block it with CSP so this might result in bugs
Originally posted by @lukaw3d in https://github.com/oasisprotocol/oasis-wallet-web/pull/348#discussion_r742424658
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with protobufjs at lib/inquire/index.js#L12 in commit d13d5d5 and review how its eval call is reached. Reproduce the behavior with the project's CSP restrictions; done should mean the reported CSP-related bug is addressed without the eval usage causing a failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100