diff options
| author | Rayan Salhab <r.salhab@aiyexpertsolutions.com> | 2026-03-29 19:27:05 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-03-29 18:27:05 +0200 |
| commit | eb66e03f0e67c3b04c863c2b5540c65495bf621d (patch) | |
| tree | 2e1efc1a63cd2504b9ecbb37895bf4f43933c5ca /docker-compose.yml | |
| parent | a2418751e6e28dfd4e59a1bb4a0c8e14f0989b47 (diff) | |
| download | opencut-eb66e03f0e67c3b04c863c2b5540c65495bf621d.tar.gz | |
fix(security): replace new Function() with safe math expression parser (#753)
* fix(security): replace new Function() with safe math expression parser
Replace the dangerous new Function() constructor in evaluateMathExpression()
with a recursive descent parser that safely evaluates basic arithmetic
expressions.
The Function constructor is a security anti-pattern that could enable
arbitrary code execution if the validation regex is ever bypassed or
relaxed. The new parser:
- Only supports numbers, +, -, *, /, parentheses, and whitespace
- Has no eval-like functionality that could execute arbitrary code
- Maintains backward compatibility with existing expressions
- Handles operator precedence and parentheses correctly
Fixes #725
* Apply suggestion from @coderabbitai[bot]
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---------
Co-authored-by: Maze <167211895+mazeincoding@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Diffstat (limited to 'docker-compose.yml')
0 files changed, 0 insertions, 0 deletions