Skip to content

fix: use Reflect.apply instead of .call() in Promise handlers#549

Merged
patriksimek merged 1 commit intomainfrom
fix-sandbox-escape-2
Jan 17, 2026
Merged

fix: use Reflect.apply instead of .call() in Promise handlers#549
patriksimek merged 1 commit intomainfrom
fix-sandbox-escape-2

Conversation

@patriksimek
Copy link
Owner

Replace unsafe .call() usage with Reflect.apply in globalPromise.prototype.then and globalPromise.prototype.catch to prevent potential interception via Function.prototype.call override.

@patriksimek patriksimek merged commit 4b009c2 into main Jan 17, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant