opened
SecSamDev
username_0
In theory, this works, not many libraries need to modify the constructor.
```
Function.prototype.constructor = function (data) {
    console.log('Trying to use constructor...')
    console.log(data)
    return function(dat){
        return null;
    }
}
```
Protect VM from using construct function
issue
created
XmiliaH
username_1
I don't see a reason to do this. If you want to do so you can execute code in the VM that hides all the Function constructors. But don't forget the global Function object and also GeneratorFunction, AsyncFunction & AsyncGeneratorFunctions.
comment
closed
SecSamDev
username_0
issue
created
SecSamDev
username_0
I just tested it:
```
const sandbox = {test : async function(){return 1}}
try{
    let result = vm.runInNewContext(`
try{
    test.constructor('return process')().then(dat=>{
        console.log(dat)
    })
}catch(e){console.log(e)}
`, sandbox,{timeout : 10000})
```
Outputs `process {version: "v12.10.0", versions: Object, arch: "x64", platform: "linux", release: Object, …}`

But I suppose that it can be helpful in some cases to disallow the creation of objects using the constructor functions.
comment