fix(view): shadow dangerous globals in with-scoped evaluator - #188

Summary

Fixes #168 (Medium hardening).

evaluate/evaluateRaw run new Function('$ctx', 'with($ctx){ return (expr); }'). The proxy has trap returned prop in target, so inherited Object.prototype members resolved from the context and constructor.constructor('…')() reached the Function constructor — arbitrary code execution wherever bq-* attributes carry untrusted content.

Fix

The issue's suggested own-keys-only has trap is necessary but not sufficient: once the proxy declines constructor, with resolution falls through to the enclosing global scope, where the global object inherits constructor from Object.prototype and exposes Function/eval/globalThis. A bare Function('…')() escapes the same way.

So the evaluator now shadows a denylist (constructor, __proto__, prototype, Function, eval, globalThis, global, window, self, top, parent): has reports them present (so they never fall through to the global scope) and get resolves them to undefined unless the context legitimately owns that property. Member access on the resulting undefined throws → undefined. Both the lazy (evaluate) and raw (evaluateRaw) paths are covered.

Legitimate templates are unaffected: own context props (including ones shadowing a dangerous name), arithmetic, and method calls on context values (e.g. name.toUpperCase()) all still work.

Verification

• Tests: constructor.constructor(…)() on both evaluate and evaluateRaw, bare Function(…)() and eval(…), plus positive cases (own props, method calls, own-prop shadowing a global name). The exploit tests fail on the pre-fix code.
• Full suite: 2993 pass / 0 fail. tsc --noEmit + eslint clean.

🤖 Generated with Claude Code