Repository: jsonata-js/jsonata (js)

Issue:
JSONata leaks internal references in expression when using lambdas
I am creating this after corresponding with @andrew-coleman over email as it has some security implications.

Currently, one can use lambdas as a way to grab references to JSONata internals. For example:

```
$leak_env_refs := function() {1};
$leak_env_refs.environment.bind('whatever_you_want', false);
```

This seems unintentional and can potentially be used maliciously.

Pull request:
Prevent lookup of function object properties
A lambda function is represented internally as a javascript object.  A check needs to be added to the `lookup` function to only expose properties if they are a non-function object.  Similar to the check that already exists in the `keys` function.

Resolves #691 

Patch:
diff --git a/src/functions.js b/src/functions.js
index 219a390..d493c94 100644
--- a/src/functions.js
+++ b/src/functions.js
@@ -1658,7 +1658,7 @@ const functions = (() => {
                 });
             });
             result = keys(merge);
-        } else if (arg !== null && typeof arg === 'object' && !(isLambda(arg))) {
+        } else if (arg !== null && typeof arg === 'object' && !isFunction(arg)) {
             Object.keys(arg).forEach(key => result.push(key));
         }
         return result;
@@ -1685,7 +1685,7 @@ const functions = (() => {
                     }
                 }
             }
-        } else if (input !== null && typeof input === 'object') {
+        } else if (input !== null && typeof input === 'object' && !isFunction(input)) {
             result = input[key];
         }
         return result;


Test patch:
diff --git a/test/test-suite/groups/lambdas/case013.json b/test/test-suite/groups/lambdas/case013.json
new file mode 100644
index 0000000..01ef867
--- /dev/null
+++ b/test/test-suite/groups/lambdas/case013.json
@@ -0,0 +1,6 @@
+{
+    "expr": "( $f := function(){1}; $f.environment )",
+    "dataset": null,
+    "bindings": {},
+    "undefinedResult": true
+}
\ No newline at end of file