CVE-2020-7609: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2020-04-27T22:15Z
Repository: https://github.com/mithunsatheesh/node-rules
Language: JavaScript
Files changed: lib/node-rules.js
Commit date: 2020-03-16 19:13:37 +0530
Commit message: Remove fromJSON and toJSON from exposed APIs

Remove fromJSON and toJSON from exposed APIs in V5.0.0
Diff: diff --git a/lib/node-rules.js b/lib/node-rules.js
index 443a156..0f9eb6b 100644
--- a/lib/node-rules.js
+++ b/lib/node-rules.js
@@ -126,38 +126,7 @@
         for (var i = 0, j = rules.length; i < j; i++) {
             rules[i].priority = priority;
         }
         this.sync();
     }
-    RuleEngine.prototype.toJSON = function() {
-        var rules = this.rules;
-        if (rules instanceof Array) {
-            rules = rules.map(function(rule) {
-                rule.condition = rule.condition.toString();
-                rule.consequence = rule.consequence.toString();
-                return rule;
-            });
-        } else if (typeof(rules) != "undefined") {
-            rules.condition = rules.condition.toString();
-            rules.consequence = rules.consequence.toString();
-        }
-        return rules;
-    };
-    RuleEngine.prototype.fromJSON = function(rules) {
-        this.init();
-        if (typeof(rules) == "string") {
-            rules = JSON.parse(rules);
-        }
-        if (rules instanceof Array) {
-            rules = rules.map(function(rule) {
-                rule.condition = eval("(" + rule.condition + ")");
-                rule.consequence = eval("(" + rule.consequence + ")");
-                return rule;
-            });
-        } else if (rules !== null && typeof(rules) == "object") {
-            rules.condition = eval("(" + rules.condition + ")");
-            rules.consequence = eval("(" + rules.consequence + ")");
-        }
-        this.register(rules);
-    };
     module.exports = RuleEngine;
 }(module.exports));

Vulnerable code:     RuleEngine.prototype.toJSON = function() {
        var rules = this.rules;
        if (rules instanceof Array) {
            rules = rules.map(function(rule) {
                rule.condition = rule.condition.toString();
                rule.consequence = rule.consequence.toString();
                return rule;
            });
        } else if (typeof(rules) != "undefined") {
            rules.condition = rules.condition.toString();
            rules.consequence = rules.consequence.toString();
        }
        return rules;
    };
    RuleEngine.prototype.fromJSON = function(rules) {
        this.init();
        if (typeof(rules) == "string") {
            rules = JSON.parse(rules);
        }
        if (rules instanceof Array) {
            rules = rules.map(function(rule) {
                rule.condition = eval("(" + rule.condition + ")");
                rule.consequence = eval("(" + rule.consequence + ")");
                return rule;
            });
        } else if (rules !== null && typeof(rules) == "object") {
            rules.condition = eval("(" + rules.condition + ")");
            rules.consequence = eval("(" + rules.consequence + ")");
        }
        this.register(rules);
    };