fix(security): prevent call/apply invocation of Function

Author: brettz9

CHANGES.md

@@ -1,5 +1,9 @@
 # CHANGES for jsonpath-plus
 
+## 10.0.6
+
+- fix(security): prevent `call`/`apply` invocation of `Function`
+
 ## 10.0.5
 
 - fix: remove overly aggressive disabling of native functions but

badges/coverage-badge.svg

@@ -1299,6 +1299,9 @@ const SafeEval = {
       if (obj === Function && prop === 'bind') {
         throw new Error('Function.prototype.bind is disabled');
       }
+      if (obj === Function && (prop === 'call' || prop === 'apply')) {
+        throw new Error('Function.prototype.call and ' + 'Function.prototype.apply are disabled');
+      }
       if (result === Function) {
         return result; // Don't bind so can identify and throw later
       }

dist/index-browser-esm.js

@@ -1305,6 +1305,9 @@
 	      if (obj === Function && prop === 'bind') {
 	        throw new Error('Function.prototype.bind is disabled');
 	      }
+	      if (obj === Function && (prop === 'call' || prop === 'apply')) {
+	        throw new Error('Function.prototype.call and ' + 'Function.prototype.apply are disabled');
+	      }
 	      if (result === Function) {
 	        return result; // Don't bind so can identify and throw later
 	      }

dist/index-browser-esm.min.js

@@ -1300,6 +1300,9 @@ const SafeEval = {
       if (obj === Function && prop === 'bind') {
         throw new Error('Function.prototype.bind is disabled');
       }
+      if (obj === Function && (prop === 'call' || prop === 'apply')) {
+        throw new Error('Function.prototype.call and ' + 'Function.prototype.apply are disabled');
+      }
       if (result === Function) {
         return result; // Don't bind so can identify and throw later
       }

dist/index-browser-esm.min.js.map

@@ -1298,6 +1298,9 @@ const SafeEval = {
       if (obj === Function && prop === 'bind') {
         throw new Error('Function.prototype.bind is disabled');
       }
+      if (obj === Function && (prop === 'call' || prop === 'apply')) {
+        throw new Error('Function.prototype.call and ' + 'Function.prototype.apply are disabled');
+      }
       if (result === Function) {
         return result; // Don't bind so can identify and throw later
       }

dist/index-browser-umd.cjs

@@ -1,7 +1,7 @@
 {
   "author": "Stefan Goessner",
   "name": "jsonpath-plus",
-  "version": "10.0.5",
+  "version": "10.0.6",
   "type": "module",
   "bin": {
     "jsonpath": "./bin/jsonpath-cli.js",

dist/index-browser-umd.min.cjs

@@ -114,6 +114,12 @@ const SafeEval = {
             if (obj === Function && prop === 'bind') {
                 throw new Error('Function.prototype.bind is disabled');
             }
+            if (obj === Function && (prop === 'call' || prop === 'apply')) {
+                throw new Error(
+                    'Function.prototype.call and ' +
+                    'Function.prototype.apply are disabled'
+                );
+            }
             if (result === Function) {
                 return result; // Don't bind so can identify and throw later
             }