[CVE-2017-16088] Sandbox Breakout (Critical Security Fix) - context clear

[kaue]

No description provided.

[ChrisCinelli]

Why is this not merged and released? I reported to the npm team.

[hacksparrow]

@ChrisCinelli Function = undefined. We can't overwrite a global object.

[ChrisCinelli]

@kauegimenes :
You could also add this test to verify that #12 is fixed:

  it("should not modify Object's constructor", function () {
    var evaluatedBefore = Object.getOwnPropertyDescriptor(Object, 'constructor')
    console.log(evaluatedBefore)
    assert(evaluatedBefore === undefined)
    safeEval('42')
    var evaluatedAfter = Object.getOwnPropertyDescriptor(Object, 'constructor')
    console.log(evaluatedBefore)
    assert(evaluatedAfter === undefined)
  })

[ChrisCinelli]

Just added comments on #16. This only fixes one tiny vulnerability.