git.kaiwu.me - njs.git/commit

]> git.kaiwu.me - njs.git/commit

projects / njs.git / commit

summary | shortlog | log | commit | commitdiff | tree
(parent: f1aa752) | patch

author	Dmitry Volyntsev <xeioex@nginx.com>
	Tue, 3 Jun 2025 00:18:22 +0000 (17:18 -0700)
committer	Dmitry Volyntsev <xeioexception@gmail.com>
	Wed, 4 Jun 2025 05:21:03 +0000 (22:21 -0700)
commit	aa358e16337e535240d7976c9232dd06fe0ef5d8
tree	1479fd427e151a0c4c93410b8bfe52c8f7badc43	tree \| snapshot
parent	f1aa75247a1fc95ca46ce07d4d05288247c9bda8	commit \| diff

Fixed Function constructor template injection.

The Function constructor uses a `(function(<args>) {<body>})` template
to construct new functions. This approach was vulnerable to template
injection where malicious code could close the function body early.

This fixes issue #921.

src/njs_function.c		diff \| blob \| history
src/test/njs_unit_test.c		diff \| blob \| history

njs upstream