Vulnerability: DOM-based XSS in gmail-js Affected versions of `gmail-js` are vulnerable to cross-site scripting in the `tools.parse_response`, `helper.get.visible_emails_post`, and `helper.get.email_data_post` functions, which pass user input directly into the Function constructor.



## Recommendation

Update to version 0.6.5 or later.
Vulnerability ID: GHSA-c7pp-g2v2-2766
CWE: CWE-79
Severity score: 0
Project: https://github.com/KartikTalwar/gmail.js
Published: 2020-09-01
File: src/gmail.js
Commit message: Replace new Function() with JSON.parse()
Commit author: Jostein Kjønigsen

Vulnerable version (before fix):
 var Gmail_ = function(localJQuery) {                 endIndex = (parseInt(dataLength, 10) - 2) + response.indexOf("[");                 data = response.substring(response.indexOf("["), endIndex);                  var get_data = new Function("\"use strict\"; return " + data);                 realData = get_data();                  parsedResponse.push(realData);                  // prepare response for next loop                 response = response.substring(response.indexOf("["), response.length); var Gmail_ = function(localJQuery) {             return emails;         }          get_data = get_data.substring(get_data.indexOf("["), get_data.length);         get_data = "\"use strict\"; return " + get_data;         get_data = new Function(get_data);          api.tracker.view_data = get_data();          for(var i in api.tracker.view_data) {             if (typeof(api.tracker.view_data[i]) === "function") { var Gmail_ = function(localJQuery) {         if (!get_data) {             return {};         }         get_data = get_data.substring(get_data.indexOf("["), get_data.length);         get_data = "\"use strict\"; return " + get_data;         get_data = new Function(get_data);          var cdata = get_data();          api.tracker.email_data = cdata[0];         return api.tools.parse_email_data(api.tracker.email_data);     }; 

Fixed version (after fix):
 var Gmail_ = function(localJQuery) {                 endIndex = (parseInt(dataLength, 10) - 2) + response.indexOf("[");                 data = response.substring(response.indexOf("["), endIndex);                  var json = JSON.parse(data);                 parsedResponse.push(json);                  // prepare response for next loop                 response = response.substring(response.indexOf("["), response.length); var Gmail_ = function(localJQuery) {             return emails;         }          var data = get_data.substring(get_data.indexOf("["), get_data.length);         var json = JSON.parse(data);         api.tracker.view_data = json;          for(var i in api.tracker.view_data) {             if (typeof(api.tracker.view_data[i]) === "function") { var Gmail_ = function(localJQuery) {         if (!get_data) {             return {};         }         var data = get_data.substring(get_data.indexOf("["), get_data.length);         var json = JSON.parse(data);          api.tracker.email_data = json[0];         return api.tools.parse_email_data(api.tracker.email_data);     }; 

Patch:
patch: @@ -891,10 +891,8 @@ var Gmail_ = function(localJQuery) {
                 endIndex = (parseInt(dataLength, 10) - 2) + response.indexOf("[");
                 data = response.substring(response.indexOf("["), endIndex);
 
-                var get_data = new Function("\"use strict\"; return " + data);
-                realData = get_data();
-
-                parsedResponse.push(realData);
+                var json = JSON.parse(data);
+                parsedResponse.push(json);
 
                 // prepare response for next loop
                 response = response.substring(response.indexOf("["), response.length);
@@ -1684,11 +1682,9 @@ var Gmail_ = function(localJQuery) {
             return emails;
         }
 
-        get_data = get_data.substring(get_data.indexOf("["), get_data.length);
-        get_data = "\"use strict\"; return " + get_data;
-        get_data = new Function(get_data);
-
-        api.tracker.view_data = get_data();
+        var data = get_data.substring(get_data.indexOf("["), get_data.length);
+        var json = JSON.parse(data);
+        api.tracker.view_data = json;
 
         for(var i in api.tracker.view_data) {
             if (typeof(api.tracker.view_data[i]) === "function") {
@@ -1934,13 +1930,10 @@ var Gmail_ = function(localJQuery) {
         if (!get_data) {
             return {};
         }
-        get_data = get_data.substring(get_data.indexOf("["), get_data.length);
-        get_data = "\"use strict\"; return " + get_data;
-        get_data = new Function(get_data);
-
-        var cdata = get_data();
+        var data = get_data.substring(get_data.indexOf("["), get_data.length);
+        var json = JSON.parse(data);
 
-        api.tracker.email_data = cdata[0];
+        api.tracker.email_data = json[0];
         return api.tools.parse_email_data(api.tracker.email_data);
     };
path: src/gmail.js