Implemented basic script evaluation

1 files changed, 73 insertions, 50 deletions

diff --git a/eval_test.js b/eval_test.js
index 4e1dade..6a7b8d2 100644
--- a/eval_test.js
+++ b/eval_test.js
@@ -143,16 +143,20 @@ var licenses = {
 	}
 }
 
-// Objects which could be used with bracket suffix notation to do (very) nontrivial things
-// If this system is used, bracket suffix notation could still be exploited to 
-var reserved_objects = {
-	"window":true,
-	"fetch":true,
-	"XMLHttpRequest":true, // only on chrome
-	"chrome":true, // only on chrome
-	"browser":true, // only on firefox
-	"clientInformation":true // good idea?
-};
+// Objects which could be used to do nontrivial things
+// Bracket suffix notation could still be exploited to get some of these objects 
+var reserved_objects = [
+	"window",
+	"fetch",
+	"XMLHttpRequest",
+	"chrome", // only on chrome
+	"browser", // only on firefox
+	"eval"
+];
+
+// Objects that can only be used with dot notation
+var reserved_
+
 
 function get_final_page(html_string, callback){
 
@@ -162,20 +166,34 @@ function get_final_page(html_string, callback){
 	*	true = trivial, false = nontrivial	
 	*
 	*/
-	function evaluate(script){
+	function evaluate(script,name){
 
 		function reserved_object_regex(object){
-			return new RegExp('/[{}\]\[\(\)\.\s]'+object+'\s*\(/g');
-		}		
+			// Matches use of object as a variable	
+			
+			// This accounts for both unary, binary and assignment operators
+			var arith_operators = "\\+\\-\\*\\/\\%\\=";
+			
+			// These are allowed to preceed or trail a variable as in 'if(true){eval("thiscode")};'
+			// However, if you have 'function(){eval}' where the "}" char trails "eval", this can't
+			// be used to invoke member objects or pass arguments.
+			var scope_chars = "\{\}\]\[\(\)\,";
+		
+			// No property accessors are allowed to follow the string stored in "object"
+			// Whitespace is allowed to come between these property accessors 
+			var trailing_chars = "\s*"+"\(\.\[";
 
+			return new RegExp("(?:[^\\w\\d]|^|(?:"+arith_operators+"))"+object+'(?:\\s*?(?:[\\;\\,\\.\\(\\[])\\s*?)',"g");
+		}		
+		reserved_object_regex("window");
 		// Strings
-		var all_strings = new RegExp('/".*?"'+"|'.*?'/gm");
+		var all_strings = new RegExp('".*?"'+"|'.*?'","gm");
 		// multi-line "/*" "*/" comments
-		var ml_comment = new RegExp('/\/\*[\s\S]+?\*\/g');
+		var ml_comment = /\/\*([\s\S]+?)\*\//g;
 		// in-line "//" comments
-		var il_comment = new RegExp('/\/\/.+/g');
-		// Bracket suffix notation
-		var bracket_pairs = new RegExp('/\[.+?\]/g');
+		var il_comment = /\/\/.+/gm;
+		// The contents of bracket pairs
+		var bracket_pairs = /\[.+?\]/g;
 
 		// Replace string consts with values that won't interfere
 		var temp = script.replace(/'.+?'+/gm,"'string'");
@@ -184,14 +202,24 @@ function get_final_page(html_string, callback){
 		temp = temp.replace(ml_comment,"");
 		temp = temp.replace(il_comment,"");
 		// Now that there can't be any brackets inside of comments or strings,
-		// see if there are any variable assignments on 
-		var bracket_contents = temp.match(bracket_pairs);
-
-		for(var i = 0; i < bracket_contents.length; i++){
-			if(bracket_contents){}
+		//  
+
+		console.log("------evaluation results for "+ name +"------");
+		console.log("Script accesses reserved objects?");
+		var flag = true;
+		for(var i = 0; i < reserved_objects.length; i++){
+			var res = reserved_object_regex(reserved_objects[i]).exec(script);
+			if(res != null){
+				console.log("%c fail","color:red;");
+				console.log(res["input"].substr(res["index"]-15,res["index"]+15));
+				flag = false;		
+			}
+		}
+		if(flag){
+			console.log("%c pass","color:green;");
 		}
 
-		return false;
+		return flag;
 	}
 
 	/**
@@ -227,7 +255,7 @@ function get_final_page(html_string, callback){
 	*
 	*/
 	// TODO: Known bug: extra \n chars thrown in at some splices 
-	function license_read(script_src){
+	function license_read(script_src,name){
 		if(typeof(script_src) != "string"){
 			return "fail"
 		}
@@ -246,7 +274,7 @@ function get_final_page(html_string, callback){
 			var matches = /^(@license)\s([\S]+)\s([\S]+$)/gm.exec(unedited_src);
 			if(matches == null){
 				//console.log("No more matches, almost done");
-				if(evaluate(unedited_src)){
+				if(evaluate(unedited_src,name)){
 					edited_src += unedited_src;
 				}
 				return edited_src;
@@ -255,7 +283,7 @@ function get_final_page(html_string, callback){
 			//console.log("Everything before the next match");
 			var before = unedited_src.substr(0,matches["index"]);
 			//console.log(before);
-			if(evaluate(before)){
+			if(evaluate(before,name)){
 				edited_src += before;
 			}
 			// This should remove the substring "before"
@@ -284,7 +312,7 @@ function get_final_page(html_string, callback){
 			// TODO: this is here to prevent infinite loops, should be removed eventually		
 			watchdog++;
 			if(watchdog > 20){
-				console.log("%c Watchdog > 20.","color:red");
+				console.log("%c !!!!!WARNING!!!!! Watchdog > 20.","color:red");
 				return false;
 			}
 		}
@@ -362,14 +390,15 @@ function get_final_page(html_string, callback){
 
 		var done = false;
 		var amt_done = 0;
+		var amt_remote_scripts = 0;
 		var amt_todo = html_doc.scripts.length + has_intrinsic_events.length;
 
 		function check_done(){
-			console.log(amt_done + "/" + amt_todo);
+			console.log(amt_done + "/" + (amt_todo - amt_remote_scripts) );
 			if(amt_done > amt_todo){
 				console.warn("Not supposed to happen");
 			}
-			if(done == false && amt_done >= amt_todo){
+			if(done == false && amt_done >= (amt_todo - amt_remote_scripts) ){
 				console.log("%c DONE.","color:red;");
 				callback(html_doc);
 				done = true;
@@ -379,7 +408,7 @@ function get_final_page(html_string, callback){
 		}
 		// "i" is an index in html_doc.scripts
 		function edit_src(src, i, name){
-			var edited = license_read(src);
+			var edited = license_read(src,name);
 			if(edited == "string"){
 				html_doc.scripts[i].outerHTML = "<script name='librejs-accepted'>"+edited+"</script>";
 			} else{
@@ -389,8 +418,8 @@ function get_final_page(html_string, callback){
 		}
 		// "i" is an index in html_doc.all
 		// "j" is an index in intrinsicEvents
-		function edit_event(src,i,j){
-			var edited = license_read(src);
+		function edit_event(src,i,j,name){
+			var edited = license_read(src,name);
 
 			if(edited == "string"){
 				html_doc.all[i].attributes[intrinsicEvents[j]].value = edited;
@@ -416,31 +445,22 @@ function get_final_page(html_string, callback){
 			}
 
 			if(html_doc.scripts[i].src != ""){
-				// it is a remote script ("<script src='/script.js'></script>")
-				// this function is here because otherwise there would be async issues
-				function remote_script(i){
-					var name = html_doc.scripts[i].src;
-					var xml = new XMLHttpRequest();			
-					xml.open("get", html_doc.scripts[i].src);
-					xml.onload = function(response){
-						console.log("%c Script " + i + ":","color:red;");
-						console.log(name);
-						edit_src(this.responseText, i, name);
-						check_done();
-					}
-					xml.send();
-				};
-				remote_script(i);
+				// this is a remote script ("<script src='script.js'></script>")
+				var name = html_doc.scripts[i].src;
+				console.log("%c Will evaluate script '" + name + "' when it arrives. Document.scripts index: "+i,"color:blue;");	
+				amt_remote_scripts++;
+
 			} else{
 				// it is an inline script ("<script>console.log('test');</script>")
-				console.log("%c Script " + i + ": (src: inline)","color:red;");
+				console.log("%c Evaluating inline script. Document.scripts index: "+i,"color:blue;");
 				//console.log(html_doc.scripts[i].innerText);
 				edit_src(html_doc.scripts[i].innerText, i, "src: inline (index "+i+")");
 			}	
 		}
 		// Find all the document's elements with intrinsic events
 		for(var i = 0; i < has_intrinsic_events.length; i++){
-			edit_event(html_doc.all[has_intrinsic_events[i][0]].attributes[intrinsicEvents[has_intrinsic_events[i][1]]].value,has_intrinsic_events[i][0],has_intrinsic_events[i][1]);
+			var s_name = "html_doc.all["+has_intrinsic_events[i][0]+"]";
+			edit_event(html_doc.all[has_intrinsic_events[i][0]].attributes[intrinsicEvents[has_intrinsic_events[i][1]]].value,has_intrinsic_events[i][0],has_intrinsic_events[i][1],s_name);
 		}
 
 		check_done();
@@ -517,6 +537,9 @@ function get_final_page(html_string, callback){
 
 get_final_page(document.documentElement.outerHTML,function(a){
 	console.log("returned");
+	if(typeof(a) == "boolean"){
+		return;
+	}
 	document.documentElement.innerHTML = a.documentElement.innerHTML;
 });