PerimeterX/restringer

safe.resolveProxyVariables issue when variable is reassigned

Closed this issue · 4 comments

const data = 'foo';
var proxyData = data;

console.log(proxyData);
proxyData = 'bar';
console.log(proxyData);

outputs

const data = 'foo';
console.log(proxyData);
proxyData = 'bar';
console.log(proxyData)

I intentionally left this case uncovered since REstringer does not analyze the running flow, and some values may be different under different circumstances.
Consider this simple example:

var a;
console.log('1 - ' + a);
a = 'first';
setTimeout(() => console.log('2 - ' + a), 0);
console.log('3 - ' + a);
a = 'second';
console.log('4 - ' + a);
a = 'third';

// Results will be:
// 1 - undefined
// 3 - first
// 4 - second
// 2 - third

If you believe there is a way to reliably replace the variables with their values I'll be more than happy to examine this further. As it stands, REstringer does not replace variables which are reassigned with their value.

Thanks for bringing this up! Let me know if you believe this can be improved, otherwise I'm closing this issue.

Wouldn't it make sense to replace the proxy variable with the main variable, without resolving the main variables value?

Proxying your example ->

var a;
var proxyA = a;
console.log('1 - ' + proxyA);
proxyA = 'first';
setTimeout(() => console.log('2 - ' + proxyA), 0);
console.log('3 - ' + proxyA);
proxyA = 'second';
console.log('4 - ' + proxyA);
proxyA = 'third';

resolveProxyVariables removes the proxyA definition but doesn't actually replace callers of proxyA to use their main value.

var a;
console.log('1 - ' + proxyA);
proxyA = 'first';
setTimeout(() => console.log('2 - ' + proxyA), 0);    
console.log('3 - ' + proxyA);
proxyA = 'second';
console.log('4 - ' + proxyA);
proxyA = 'third';

The only issue I see here is that var proxyA = a; is removed when it shouldn't be.
I'll fix that right away :)

Regarding the replacement of the proxy variable - in your proxified example, proxyA isn't referencing the a variable all the time, and therefore its references won't be replaced with the a variable. Since the value of proxyA cannot be resolved deterministically it won't be replaced.
Does that make sense to you?

Since the value of proxyA cannot be resolved deterministically it won't be replaced.

Mhm, it makes sense.