Security fix for CVE-2025-12735, CVE-2025-13204, and member function bypass

[Copilot]

Security Fix for CVE-2025-12735, CVE-2025-13204, and member function bypass

Addresses security vulnerabilities from silentmatt/expr-eval#288 and #290 that affect this fork.

Changes

• Prototype pollution protection: Block access to __proto__, prototype, constructor in variable names and member expressions
• Function call restriction: Only allow functions registered in parser.functions, safe Math builtins, or inline-defined functions
• IFUNCALL validation: Add validateAllowedFunction check before function invocation
• Inline function registration: Use counter-based keys to prevent collision attacks
• Version bump to 5.0.0: Major version bump per semantic versioning for breaking changes

Breaking Change (v5.0.0)

Functions must be registered explicitly instead of passed via context. See BREAKING_CHANGES.md for migration guide.

// Before (vulnerable)
parser.evaluate('fn()', { fn: () => 'pwned' });

// After (secure)
parser.functions.fn = () => 'safe';
parser.evaluate('fn()');

Test Coverage

• Updated all tests to use secure function registration pattern
• Added 25 security tests covering:
  • Direct function call blocking
  • Nested member function call blocking
  • Prototype property access blocking
  • PoC attacks from VU#263614 and Issue Report security vulnerability silentmatt/expr-eval#289

Verification

• All 959 tests pass
• npm run type-check passes with no errors

Original prompt

Analyse the following PRs:

• Security Patch. silentmatt/expr-eval#288
• Security advisory GHSA-jc85-fpwf-qm7x - request mitigation option to block function calls silentmatt/expr-eval#290

Are these security issues also impacting this library? If so create a PR with a patch fixing the security issues.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Sander-Toonen]

@copilot Please update the tests accordingly and document breaking changes in BREAKING_CHANGES.md

[Copilot]

@copilot Please update the tests accordingly and document breaking changes in BREAKING_CHANGES.md

Done in fb3ddbb. Updated all tests to use the secure function registration pattern and added BREAKING_CHANGES.md with documentation and migration guide. Also verified npm run type-check passes with no errors (fixed in f4473e6).

[Sander-Toonen]

@copilot Breaking changes mentions Version 4.3.0 → 4.4.0, but I want the version to become 5.0.0 (according to semantic versioning) Also make sure the version number is updated in packages.json and that the lock file is updated accordingly.

[Copilot]

@copilot Breaking changes mentions Version 4.3.0 → 4.4.0, but I want the version to become 5.0.0 (according to semantic versioning) Also make sure the version number is updated in packages.json and ...

Done in 580430c. Updated version to 5.0.0 in package.json, BREAKING_CHANGES.md, and package-lock.json.