swoops / eval_villain Goto Github PK

This is more of an fyi since I have no suggested fix.

applyEvalVillain("eval") turns direct eval into indirect eval

Since eval !== %eval%, all eval becomes direct eval.

You can see the difference in

const x = 'indirect';
(() => {
  const x = 'direct';
  console.log(`eval(x) => ${ eval('x') }`);  // -> indirect
  console.log(`(0, eval)(x) => ${ (0, eval)('x') }`);  // -> direct
})();

This happens because of step 6.a in 12.3.4.1

6. If Type(ref) is Reference and IsPropertyReference(ref) is false and GetReferencedName(ref) is "eval", then
   a. If SameValue(func, %eval%) is true, then

when evaluating function calls where the function is the identifier eval.

It'd be amazing if this had chromium support, as most other hacking add-ons are made for chromium

Hiya 😁
We've had a bug complaining that Eval Villain is no longer loaded when ZAP launches Firefox: zaproxy/zaproxy#7878

Thanks to @willdurand we've found out its a bug in Selenium, which we're following up on.

But there is a work around: "it looks like the source manifest.json doesn't include browser_specific_settings, which means AMO sets it (yes, AMO slightly updates manifest.json files these days). I think the workaround is to update the manifest.json file and add applications.gecko.id, and then get that new version signed by AMO."

You ok doing this until selenium gets fixed?