fix($parse): block assigning to fields of a constructor prototype

Fixes #14939

Author: gkalpak

src/ng/parse.js

@@ -113,10 +113,28 @@ function ensureSafeFunction(obj, fullExpression) {
 
 function ensureSafeAssignContext(obj, fullExpression) {
   if (obj) {
-    if (obj === (0).constructor || obj === (false).constructor || obj === ''.constructor ||
-        obj === {}.constructor || obj === [].constructor || obj === Function.constructor) {
+    var booleanConstructor = (false).constructor;
+    var numberConstructor = (0).constructor;
+    var stringConstructor = ''.constructor;
+    var objectConstructor = {}.constructor;
+    var arrayConstructor = [].constructor;
+    var functionConstructor = Function.constructor;
+
+    if (obj === booleanConstructor ||
+        obj === numberConstructor ||
+        obj === stringConstructor ||
+        obj === objectConstructor ||
+        obj === arrayConstructor ||
+        obj === functionConstructor ||
+        obj === booleanConstructor.prototype ||
+        obj === numberConstructor.prototype ||
+        obj === stringConstructor.prototype ||
+        obj === objectConstructor.prototype ||
+        obj === arrayConstructor.prototype ||
+        obj === functionConstructor.prototype) {
       throw $parseMinErr('isecaf',
-        'Assigning to a constructor is disallowed! Expression: {0}', fullExpression);
+        'Assigning to a constructor or it\'s prototype is disallowed! Expression: {0}',
+        fullExpression);
     }
   }
 }

test/ng/parseSpec.js

@@ -3059,6 +3059,112 @@ describe('parser', function() {
             scope.$eval('"a".constructor.prototype.charCodeAt = [].concat');
           }).toThrowMinErr('$parse', 'isecaf');
         });
+
+        it('should prevent assigning in the context of a constructor prototype', function() {
+          forEach({
+            '(true)': true,
+            '(1)': 1,
+            '"string"': 'string',
+            '[]': []
+          }, function(thing, expr) {
+            var constructorExpr = expr + '.constructor';
+            var prototypeExpr = constructorExpr + '.prototype';
+
+            expect(function() {
+              scope.$eval(prototypeExpr + '.boin');
+            }).not.toThrow();
+            expect(function() {
+              delete scope.foo;
+              scope.$eval('foo = ' + prototypeExpr + '.boin');
+            }).not.toThrow();
+            expect(function() {
+              scope.$eval(prototypeExpr + '.boin = ""');
+            }).toThrowMinErr('$parse', 'isecaf');
+            expect(function() {
+              scope.$eval(prototypeExpr + '[0] = ""');
+            }).toThrowMinErr('$parse', 'isecaf');
+            expect(function() {
+              delete scope.foo;
+              scope.$eval('foo = ' + constructorExpr + '; foo.prototype.boin = ""');
+            }).toThrowMinErr('$parse', 'isecaf');
+            expect(function() {
+              delete scope.foo;
+              scope.$eval('foo = ' + prototypeExpr + '; foo.boin = ""');
+            }).toThrowMinErr('$parse', 'isecaf');
+
+            expect(function() {
+              scope.foo = thing.constructor;
+              scope.$eval('foo.prototype[0] = ""');
+            }).toThrowMinErr('$parse', 'isecaf');
+            expect(function() {
+              delete scope.foo;
+              scope.$eval('foo.prototype[0] = ""', {foo: thing.constructor});
+            }).toThrowMinErr('$parse', 'isecaf');
+            expect(function() {
+              scope.foo = thing.constructor.prototype;
+              scope.$eval('foo[0] = ""');
+            }).toThrowMinErr('$parse', 'isecaf');
+            expect(function() {
+              delete scope.foo;
+              scope.$eval('foo[0] = ""', {foo: thing.constructor.prototype});
+            }).toThrowMinErr('$parse', 'isecaf');
+          });
+
+          // These might throw different error (e.g. isecobj, isecfn),
+          // but still having them here for good measure
+          forEach({
+            '{}': {},
+            '$eval': scope.$eval
+          }, function(thing, expr) {
+            var constructorExpr = expr + '.constructor';
+            var prototypeExpr = constructorExpr + '.prototype';
+
+            expect(function() {
+              scope.$eval(prototypeExpr + '.boin');
+            }).not.toThrowMinErr('$parse', 'isecaf');
+            expect(function() {
+              delete scope.foo;
+              scope.$eval('foo = ' + prototypeExpr + '.boin');
+            }).not.toThrowMinErr('$parse', 'isecaf');
+            expect(function() {
+              scope.$eval(prototypeExpr + '.boin = ""');
+            }).toThrow();
+            expect(function() {
+              scope.$eval(prototypeExpr + '[0] = ""');
+            }).toThrow();
+            expect(function() {
+              delete scope.foo;
+              scope.$eval('foo = ' + constructorExpr + '; foo.prototype.boin = ""');
+            }).toThrow();
+            expect(function() {
+              delete scope.foo;
+              scope.$eval('foo = ' + prototypeExpr + '; foo.boin = ""');
+            }).toThrow();
+
+            expect(function() {
+              scope.foo = thing.constructor;
+              scope.$eval('foo.prototype[0] = ""');
+            }).toThrowMinErr('$parse', 'isecaf');
+            expect(function() {
+              delete scope.foo;
+              scope.$eval('foo.prototype[0] = ""', {foo: thing.constructor});
+            }).toThrowMinErr('$parse', 'isecaf');
+            expect(function() {
+              scope.foo = thing.constructor.prototype;
+              scope.$eval('foo[0] = ""');
+            }).toThrowMinErr('$parse', 'isecaf');
+            expect(function() {
+              delete scope.foo;
+              scope.$eval('foo[0] = ""', {foo: thing.constructor.prototype});
+            }).toThrowMinErr('$parse', 'isecaf');
+          });
+
+          // foo.constructor.prototype is not a constructor prototype.
+          expect(function() {
+            delete scope.foo;
+            scope.$eval('foo.constructor.prototype[0] = ""', {foo: {constructor: {prototype: ''}}});
+          }).not.toThrow();
+        });
       });
 
       it('should call the function from the received instance and not from a new one', function() {