[vulnerability][acl] By-value ACL is skipped for calls to non-with-scoped local functions

[t2ym]

[vulnerability][acl] By-value ACL is skipped for calls to non-with-scoped local functions

Root Cause

• In a with-clause, ACL is skipped for calls to non-with-scoped local functions due to the hooked __with__ object have the property value true for the non-with-scoped local variables
• true is not a function and cannot be tracked to the corresponding ACL

Reproducible Code

{
  let _parseInt = window.parseInt;
  let _Date = window.Date;
  with ({}) { // hooked as { _parseInt: true, _Date: true }
    _parseInt('1'); // ACL for window.parseInt is not applied
    new _Date(); // ACL for window.Date is not applied
  }
}

Fix

• Append the target variable in the hooked argument

__hook__('w()', __with__, ['_parseInt', [1], (...args) => _parseInt(...args), _parseInt], _c_[0]);
__hook__('wnew', __with__, ['_parseInt', [], (...args) => new _Date(...args), _Date], _c_[0], false);

• Pick up the target variable in Policy.defaultAcl() to get the object reference value and apply its ACL