[vulnerability][acl] Any properties can be read via ObjectPattern assignments

[t2ym]

[vulnerability][acl] Any properties can be read via ObjectPattern assignments

Root Cause

• Hooking for all property access is missing for RHS value of ObjectPattern

Reproducible Code

let { caches, ...rest } = window;
let [ ...elements ] = [ 1, 2, 3 ];
({ caches } = window); // [S_ALL] for window must not be allowed
// caches.open() throws even without the below fix

Fix

• Hook each RHS value of ObjectPattern and ArrayPattern in VariableDeclarator and AssignmentExpression with "*" operation for checking iteration over all properties of the target object

Notes

• All RHS values for ObjectPattern and ArrayPattern whose all properties can be POTENTIALLY read are hooked even if no RestProperty({...rest}) nor RestElement([...elements]) are specified at their LHS expressions.
  • It might be ideal to list up all the specified target property names for ACL, which would be too much complicated.
• [S_ALL] policy must be properly configured to limit access to the target object properties.