JDK-8074021 : Indirect eval fails when used as an element of an array or as a property of an object
Type:Bug
Component:core-libs
Sub-Component:jdk.nashorn
Affected Version:8u60,9
Priority:P3
Status:Resolved
Resolution:Fixed
OS:generic
CPU:generic
Submitted:2015-02-27
Updated:2015-09-29
Resolved:2015-02-27
The Version table provides details related to the release that this issue/RFE will be addressed.
Unresolved : Release in which this issue/RFE will be addressed. Resolved: Release in which this issue/RFE has been resolved. Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.
var args = [ eval ];
args[0]("print('hello')"); // TypeError thrown here
var obj = { foo: eval };
obj.foo("print('hello')"); // // TypeError thrown here
Bug reported by Marcus Lagergren.
Comments
hg diff
diff -r 7477f3456800 src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/objects/Global.java
--- a/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/objects/Global.java Fri Feb 20 17:18:47 2015 +0100
+++ b/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/objects/Global.java Fri Feb 27 15:52:22 2015 +0530
@@ -951,7 +951,7 @@
return str;
}
final Global global = Global.instanceFrom(self);
- final ScriptObject scope = self instanceof ScriptObject ? (ScriptObject)self : global;
+ final ScriptObject scope = (self instanceof ScriptObject)&& ((ScriptObject)self).isScope()? (ScriptObject)self : global;
return global.getContext().eval(scope, str.toString(), callThis, location, strict, true);
}
Fixes the issue. The scope object should be a ScriptObject as well as "isScope()" should return true.