[vulnerability][acl] ACL is skipped for source objects in Object.assign()

[t2ym]

[vulnerability][acl] ACL is skipped for source objects in Object.assign()

Root Cause

• Described in the issue title

Exploit Code

Object.assign({},window).caches;

Fix

• Apply ACL for each source object in S_TARGETED normalization

diff --git a/demo/hook-callback.js b/demo/hook-callback.js
index 7f0b54f3..5e29075c 100644
--- a/demo/hook-callback.js
+++ b/demo/hook-callback.js
@@ -4839,6 +4839,12 @@ else {
                       if (_args[1][1] instanceof Object) {
                         rawProperty = [];
                         for (let i = 1; i < _args[1].length; i++) {
+                          let _obj = _args[1][i];
+                          let _name = _globalObjects.get(_obj);
+                          if (!applyAcl(_name, true, false, S_ALL, 'r', context, _obj, _args, arguments)) {
+                            result = [_name, true, false, S_ALL, 'r', context, _obj, _args, arguments];
+                            throw new Error('Permission Denied: Cannot access ' + SetMap.getStringValues(_name));
+                          }
                           // TODO: Are inherited properties targeted?
                           rawProperty = rawProperty.concat(Object.keys(_args[1][i]));
                         }
@@ -6278,6 +6284,12 @@ else {
                       if (_args[1][1] instanceof Object) {
                         rawProperty = [];
                         for (let i = 1; i < _args[1].length; i++) {
+                          let _obj = _args[1][i];
+                          let _name = _globalObjects.get(_obj);
+                          if (!applyAcl(_name, true, false, S_ALL, 'r', context, _obj, _args, arguments)) {
+                            result = [_name, true, false, S_ALL, 'r', context, _obj, _args, arguments];
+                            throw new Error('Permission Denied: Cannot access ' + SetMap.getStringValues(_name));
+                          }
                           // TODO: Are inherited properties targeted?
                           rawProperty = rawProperty.concat(Object.keys(_args[1][i]));
                         }