bitburner-official / bitburner-src

Bitburner source code.
Other
847 stars 274 forks source link

MISC: Use indirect eval for terminal expr and corporation sell prices/amounts #1599

Closed yichizhng closed 3 months ago

yichizhng commented 3 months ago

This closes off an exploit which allows you to break into the game's lexical context.

Demo: https://yichizhng.github.io/bitburner-src/

Sample exploit script:

const EXPLOIT_STRING = 
"globalThis.webpack_require=__webpack_require__";
/** @param {NS} ns */
export async function main(ns) {
  let o = String.prototype.replace;
  String.prototype.replace = function(p, r) {
    if (this === EXPLOIT_STRING) {
      return this;
    }
    return o.apply(this, [p, r]);
  }

  ns.atExit(() => {
    String.prototype.replace = o;
  })

  return new Promise(() => 0);
}

Enter expr globalThis.webpack_require=__webpack_require__ into the terminal while the script is running.