From 2081aedc814f345238edb94ab8b504e48acf8d64 Mon Sep 17 00:00:00 2001 From: Jan Oberhauser Date: Fri, 3 Dec 2021 15:08:38 +0100 Subject: [PATCH] :bug: Improve expression security --- packages/workflow/src/Expression.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/workflow/src/Expression.ts b/packages/workflow/src/Expression.ts index e955df4170..370e5b0341 100644 --- a/packages/workflow/src/Expression.ts +++ b/packages/workflow/src/Expression.ts @@ -114,11 +114,11 @@ export class Expression { // @ts-ignore data.document = {}; + // @ts-ignore + data.constructor = {}; // Execute the expression try { - // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call - // tmpl.tmpl('{{this.Promise=global.Promise;global=this;}}', data); // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call const returnValue = tmpl.tmpl(parameterValue, data); if (typeof returnValue === 'function') {