Issue 6819 - Shadow globals in snippets

test/snippets.js

Index: test/snippets.js
===================================================================
--- a/test/snippets.js
+++ b/test/snippets.js
@@ -189,23 +189,60 @@
           throw new Error("Value mismatch");
       };
     `
   ];
 
   let template = `
     "use strict";
     {
+      let globals = {};

[Manish Jethani, 2018/07/31 14:17:08]

This is copied and pasted from lib/snippets.js (it's getting a bit ridiculous
but I'd still keep it this way for now).

+
+      for (let name of typeof window != "undefined" ? Object.keys(window) : [])
+        globals[name] = null;
+
+      for (let name of typeof global != "undefined" ? Object.keys(global) : [])
+        globals[name] = null;
+
+      if (typeof browser != "undefined")
+      {
+        globals.browser = {
+          runtime: {
+            getURL: browser.runtime.getURL
+          }
+        };
+      }
+
+      if (typeof document != "undefined")
+      {
+        globals.document = new Proxy(document, {
+          get(target, property)
+          {
+            if (property == "defaultView")
+              return null;
+
+            let value = target[property];
+            if (typeof value == "function")
+              return value.bind(target);
+
+            return value;
+          }
+        });
+      }
+
       const libraries = ${JSON.stringify(libraries)};
 
       const script = {{{script}}};
 
       let imports = Object.create(null);
       for (let library of libraries)
-        new Function("exports", library)(imports);
+      {
+        let func = new Function("exports", ...Object.keys(globals), library);
+        func(imports, ...Object.keys(globals).map(key => globals[key]));
+      }
 
       for (let [name, ...args] of script)
       {
         if (Object.prototype.hasOwnProperty.call(imports, name))
         {
           let value = imports[name];
           if (typeof value == "function")
             value(...args);
@@ -234,10 +271,23 @@
   // between executions. In the example below, assertFoo does not find 456 but
   // it doesn't find 123 either. It's the initial value 0.
   new Function(
     compileScript("setFoo 456; assertFoo 0", [
       ...libraries, "let foo = 1; exports.setFoo = value => { foo = value; };"
     ])
   )();
 
+  // Test sandboxing.

[Manish Jethani, 2018/07/31 14:17:08]

This is where we test the sandboxing. The process object should be set to null
in the snippet so it cannot do anything evil.

+  test.throws(
+    new Function(
+      compileScript("do-evil", [
+        // The global process object is shadowed to null so this snippet throws
+        // an error.
+        "exports['do-evil'] = function() { process.pid; };"
+      ])
+    ),
+    TypeError,
+    "Cannot read property 'pid' of null"
+  );
+
   test.done();
 };