fix(security): prevent call/apply invocation of Function

Author: brettz9

CHANGES.md

@@ -1,5 +1,9 @@
 # CHANGES for jsonpath-plus
 
+## 10.0.6
+
+- fix(security): prevent `call`/`apply` invocation of `Function`
+
 ## 10.0.5
 
 - fix: remove overly aggressive disabling of native functions but

badges/coverage-badge.svg

@@ -1299,6 +1299,9 @@ const SafeEval = {
       if (obj === Function && prop === 'bind') {
         throw new Error('Function.prototype.bind is disabled');
       }
+      if (obj === Function && (prop === 'call' || prop === 'apply')) {
+        throw new Error('Function.prototype.call and ' + 'Function.prototype.apply are disabled');
+      }
       if (result === Function) {
         return result; // Don't bind so can identify and throw later
       }

dist/index-browser-esm.js

@@ -1305,6 +1305,9 @@
 	      if (obj === Function && prop === 'bind') {
 	        throw new Error('Function.prototype.bind is disabled');
 	      }
+	      if (obj === Function && (prop === 'call' || prop === 'apply')) {
+	        throw new Error('Function.prototype.call and ' + 'Function.prototype.apply are disabled');
+	      }
 	      if (result === Function) {
 	        return result; // Don't bind so can identify and throw later
 	      }

dist/index-browser-esm.min.js

@@ -1300,6 +1300,9 @@ const SafeEval = {
       if (obj === Function && prop === 'bind') {
         throw new Error('Function.prototype.bind is disabled');
       }
+      if (obj === Function && (prop === 'call' || prop === 'apply')) {
+        throw new Error('Function.prototype.call and ' + 'Function.prototype.apply are disabled');
+      }
       if (result === Function) {
         return result; // Don't bind so can identify and throw later
       }

dist/index-browser-esm.min.js.map

@@ -1298,6 +1298,9 @@ const SafeEval = {
       if (obj === Function && prop === 'bind') {
         throw new Error('Function.prototype.bind is disabled');
       }
+      if (obj === Function && (prop === 'call' || prop === 'apply')) {
+        throw new Error('Function.prototype.call and ' + 'Function.prototype.apply are disabled');
+      }
       if (result === Function) {
         return result; // Don't bind so can identify and throw later
       }