angular/angular.js — pull request #3043 by chirayuk (2013-06-24 22:45:41+00:00)
Title: fix($parse): disallow access to Function constructor.

Sandboxing Angular Expressions
------------------------------
Angular expressions are generally considered safe because these
expressions only have direct access to $scope and locals. However, one
can obtain the ability to execute arbitrary JS code by obtaining a
reference to native JS functions such as the Function constructor.

As an example, consider the following Angular expression:

{}.toString.constructor(alert("evil JS code"))

We want to prevent this type of access. We do this by disallowing
access to native functions. It's not easy to distinguish a native
function from a user defined function - especially since iframe and such
contexts have an independant copy of Object. So we check to see if a
function, func, satisfies the condition "func.constructor == func".
Native functions satisfy this test while the typical user defined
function doesn't. This provides a good balance between allowing most
accesses while disallowing unsafe ones.