From 24c724daa7c09f003e556d7cd1c7a8381cb985d7 Mon Sep 17 00:00:00 2001
From: XmiliaH <xmilia.hermit@gmail.com>
Date: Tue, 11 Apr 2023 10:44:44 +0200
Subject: [PATCH] Release 3.9.16

---
 CHANGELOG.md       |  4 ++++
 lib/transformer.js | 14 +++++++-------
 package.json       |  2 +-
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3214085..0fbc31b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,7 @@
+v3.9.16 (2023-04-11)
+--------------------
+[fix] Security fix (see https://github.com/patriksimek/vm2/issues/516).
+
 v3.9.15 (2023-04-06)
 --------------------
 [fix] Security fix (see https://github.com/patriksimek/vm2/issues/515).
diff --git a/lib/transformer.js b/lib/transformer.js
index f20a248..9919453 100644
--- a/lib/transformer.js
+++ b/lib/transformer.js
@@ -118,13 +118,13 @@ function transformer(args, body, isAsync, isGenerator, filename) {
 						__proto__: null,
 						pos: node.start,
 						order: TO_RIGHT,
-						code: `catch($tmpname){try{throw ${INTERNAL_STATE_NAME}.handleException($tmpname);}`
+						coder: () => `catch(${tmpname}){try{throw(${tmpname}=${INTERNAL_STATE_NAME}.handleException(${tmpname}));}`
 					});
 					insertions.push({
 						__proto__: null,
 						pos: node.body.end,
 						order: TO_LEFT,
-						code: `}`
+						coder: () => `}`
 					});
 				} else {
 					const name = assertType(param, 'Identifier').name;
@@ -134,7 +134,7 @@ function transformer(args, body, isAsync, isGenerator, filename) {
 							__proto__: null,
 							pos: cBody.body[0].start,
 							order: TO_LEFT,
-							code: `${name}=${INTERNAL_STATE_NAME}.handleException(${name});`
+							coder: () => `${name}=${INTERNAL_STATE_NAME}.handleException(${name});`
 						});
 					}
 				}
@@ -144,13 +144,13 @@ function transformer(args, body, isAsync, isGenerator, filename) {
 				__proto__: null,
 				pos: node.object.start,
 				order: TO_LEFT,
-				code: INTERNAL_STATE_NAME + '.wrapWith('
+				coder: () => INTERNAL_STATE_NAME + '.wrapWith('
 			});
 			insertions.push({
 				__proto__: null,
 				pos: node.object.end,
 				order: TO_RIGHT,
-				code: ')'
+				coder: () => ')'
 			});
 		} else if (nodeType === 'Identifier') {
 			if (node.name === INTERNAL_STATE_NAME) {
@@ -165,7 +165,7 @@ function transformer(args, body, isAsync, isGenerator, filename) {
 				__proto__: null,
 				pos: node.start,
 				order: TO_RIGHT,
-				code: INTERNAL_STATE_NAME + '.'
+				coder: () => INTERNAL_STATE_NAME + '.'
 			});
 		}
 	});
@@ -186,7 +186,7 @@ function transformer(args, body, isAsync, isGenerator, filename) {
 	let curr = 0;
 	for (let i = 0; i < insertions.length; i++) {
 		const change = insertions[i];
-		ncode += code.substring(curr, change.pos) + change.code.replace(/\$tmpname/g, tmpname);
+		ncode += code.substring(curr, change.pos) + change.coder();
 		curr = change.pos;
 	}
 	ncode += code.substring(curr);
diff --git a/package.json b/package.json
index 232d8af..685d41b 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "alcatraz",
     "contextify"
   ],
-  "version": "3.9.15",
+  "version": "3.9.16",
   "main": "index.js",
   "sideEffects": false,
   "repository": "github:patriksimek/vm2",