CVE-2020-7640: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2020-04-27T22:15Z
Repository: https://github.com/jhuckaby/pixl-class
Language: JSON
Files changed: class.js, package.json
Commit date: 2020-03-10 20:15:23 -0700
Commit message: Version 1.0.3

Fixes code injection vulnerability reported by Synk.io.
No longer uses eval (which is evil anyway).

Diff: diff --git a/class.js b/class.js
index 28476eb..21644e4 100644
--- a/class.js
+++ b/class.js
@@ -18,14 +18,15 @@ exports.create = function create(members) {
 			// explicit constructor passed in
 			constructor = members.__construct;
 		}
 		else {
 			// inherit parent's constructor
-			var code = members.__parent.toString();
-			var args = code.substring( code.indexOf("(")+1, code.indexOf(")") );
-			var inner_code = code.substring( code.indexOf("{")+1, code.lastIndexOf("}") );
-			eval('constructor = function ('+args+') {'+inner_code+'};');
+			var parent = members.__parent;
+			constructor = function() {
+				var args = Array.prototype.slice.call(arguments);
+				parent.apply( this, args );
+			};
 		}
 		
 		// inherit rest of parent members
 		util.inherits(constructor, members.__parent);
 		delete members.__parent;
diff --git a/package.json b/package.json
index d0465d7..d716353 100644
--- a/package.json
+++ b/package.json
@@ -1,22 +1,22 @@
 {
-  "name": "pixl-class",
-  "version": "1.0.2",
-  "description": "A simple module for creating classes, with inheritance and mixins.",
-  "author": "Joseph Huckaby <jhuckaby@gmail.com>",
-  "homepage": "https://github.com/jhuckaby/pixl-class",
-  "license": "MIT",
-  "main": "class.js",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/jhuckaby/pixl-class"
-  },
-  "bugs": {
-    "url": "https://github.com/jhuckaby/pixl-class/issues"
-  },
-  "keywords": [
-    "oop",
-    "class"
-  ],
-  "dependencies": {},
-  "devDependencies": {}
+	"name": "pixl-class",
+	"version": "1.0.3",
+	"description": "A simple module for creating classes, with inheritance and mixins.",
+	"author": "Joseph Huckaby <jhuckaby@gmail.com>",
+	"homepage": "https://github.com/jhuckaby/pixl-class",
+	"license": "MIT",
+	"main": "class.js",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/jhuckaby/pixl-class"
+	},
+	"bugs": {
+		"url": "https://github.com/jhuckaby/pixl-class/issues"
+	},
+	"keywords": [
+		"oop",
+		"class"
+	],
+	"dependencies": {},
+	"devDependencies": {}
 }

Vulnerable code: 			var code = members.__parent.toString();
			var args = code.substring( code.indexOf("(")+1, code.indexOf(")") );
			var inner_code = code.substring( code.indexOf("{")+1, code.lastIndexOf("}") );
			eval('constructor = function ('+args+') {'+inner_code+'};');
  "name": "pixl-class",
  "version": "1.0.2",
  "description": "A simple module for creating classes, with inheritance and mixins.",
  "author": "Joseph Huckaby <jhuckaby@gmail.com>",
  "homepage": "https://github.com/jhuckaby/pixl-class",
  "license": "MIT",
  "main": "class.js",
  "repository": {
    "type": "git",
    "url": "https://github.com/jhuckaby/pixl-class"
  },
  "bugs": {
    "url": "https://github.com/jhuckaby/pixl-class/issues"
  },
  "keywords": [
    "oop",
    "class"
  ],
  "dependencies": {},
  "devDependencies": {}
Fixed code: 			var parent = members.__parent;
			constructor = function() {
				var args = Array.prototype.slice.call(arguments);
				parent.apply( this, args );
			};
	"name": "pixl-class",
	"version": "1.0.3",
	"description": "A simple module for creating classes, with inheritance and mixins.",
	"author": "Joseph Huckaby <jhuckaby@gmail.com>",
	"homepage": "https://github.com/jhuckaby/pixl-class",
	"license": "MIT",
	"main": "class.js",
	"repository": {
		"type": "git",
		"url": "https://github.com/jhuckaby/pixl-class"
	},
	"bugs": {
		"url": "https://github.com/jhuckaby/pixl-class/issues"
	},
	"keywords": [
		"oop",
		"class"
	],
	"dependencies": {},
	"devDependencies": {}