coope/lst/ctor-factory-priv-exploit.js

30 lines
426 B
JavaScript

var Database = Class(
{
// ...
forEachRow: function( callback )
{
for ( row in this._rows )
{
callback( row );
}
},
_getPassword: function()
{
return 'secret';
}
);
var db = Database( '...' ),
passwd = '';
// ...
db.forEachRow( function( row )
{
passwd = db.__priv._getPassword();
} );
// oops
unauthorizedDbOperation( 'user', passwd );