shellyln / liyad Goto Github PK

Hi! This looks like a really awesome library, and I'm hoping I can try it out. I was especially interested by the claim in the readme:

Secure execution for untrusted contents
No host environment's symbols are accessible from evaluated user contents by default.
Malicious codes can not make a serious attack

However, using the example from https://github.com/shellyln/liyad#build-your-new-dsl , and even after removing all presets other than defaultConfig and installCore() , I can still access a lot:

const {	SExpression,
		defaultConfig,
		installCore,
	} = require('liyad')

let config = Object.assign({}, defaultConfig)
config = installCore(config)
let parse = SExpression(config)
let obj = {}

let fn1 = parse(`( -> (match) 
		(::match:constructor:prototype:foo= 1)
	)`)
fn1({})
console.log(obj.foo) //1

let fn2 = parse(`( -> (match) 
		(::match:constructor@assign ::match:constructor:prototype (# ("bar" 2)) )
	)`)
fn2({})
console.log(obj.bar) //2

Is there another way you would recommend using this to accept user-defined functions/predicates to apply to some data? Perhaps overriding the $get/$call functions to only access/call object properties that are "ownProperties" of the object in question?