From 7bb88e69194779d701e9927dd1edabaab082887d Mon Sep 17 00:00:00 2001 From: Lemmy Date: Tue, 10 Mar 2026 00:03:53 -0400 Subject: [PATCH] Revert "fix(launcher): prevent arbitrary js execution. fix #2115" This reverts commit 2f4b80d72f156d1ab19d6eced1c239abee5a648e. --- Helpers/AdvancedMath.js | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/Helpers/AdvancedMath.js b/Helpers/AdvancedMath.js index b4273cda6..bde5d2002 100644 --- a/Helpers/AdvancedMath.js +++ b/Helpers/AdvancedMath.js @@ -88,17 +88,6 @@ function evaluate(expression) { throw new Error("Invalid characters in expression"); } - // Block dangerous identifiers (prototype chain traversal, code execution) - if (/\b(constructor|prototype|__proto__|__defineGetter__|__defineSetter__|__lookupGetter__|__lookupSetter__|Function|eval|require|import|process|global|window|this|self|globalThis|String|Object|Array|RegExp|Proxy|Reflect|setTimeout|setInterval)\b/.test(processed)) { - throw new Error("Invalid expression"); - } - - // Only allow Math.method property access - block any other dot-property chains - var withoutMathCalls = processed.replace(/\bMath\.\w+/g, '0'); - if (/\./.test(withoutMathCalls)) { - throw new Error("Invalid expression"); - } - // Evaluate the processed expression var result = eval(processed);