nocobase-prototype-repro

The code is primarily a filter-card UI, but it contains a high-severity capability: it evaluates option-provided JavaScript via new Function(...) when o.mode === 'js'. That is effectively arbitrary code execution using configuration data, which is a common mechanism for supply-chain or configuration-based sabotage. If attacker control of $p.options is possible (e.g., via compromised dependency/templates), this could enable malicious behavior. Otherwise, in a trusted/internal configuration scenario, risk may be reduced. Based on static analysis alone, the malicious probability is medium-to-high due to the explicit eval-like sink.

This module is primarily high-risk because it supports mode==='js' filter options that are executed via new Function with access to ctx, and the results are then used to construct filters that drive backend/api count queries and downstream target refreshes. While no explicit exfiltration or destructive actions are shown in this snippet, the presence of an arbitrary code execution primitive combined with query/filter manipulation makes it unsuitable for untrusted configuration and elevates supply-chain sabotage potential. Treat as requiring strict input trust controls and preferably removal/sandboxing of the dynamic execution capability.

No explicit malware/backdoor logic or external exfiltration destinations are visible in this fragment. However, the module includes high-impact, supply-chain-relevant capability: arbitrary async JavaScript execution via new Function($p.jsExpr) with full ctx access, and configurable SQL execution (optionally persisted via ctx.sql.save). These features make malicious behavior feasible if configuration inputs are attacker-influenced or if a compromised upstream package/provider sets them. Popup functionality further increases the chance of unintended data exposure by fetching and displaying records via configuration-derived endpoints. Strict allowlisting/authorization, immutability of jsExpr/sql in untrusted contexts, and environment isolation are strongly recommended.

This code fragment is primarily a UI filter controller, but it contains a critical high-risk capability: in mode==='js' it executes arbitrary, configuration-provided JavaScript via new Function with access to the full ctx object. It also supports configuration-driven SQL-derived filtering via ctx.sql.runById. If an attacker can influence $p.options (or the component configuration path), they can run code and/or change filters in a way that can lead to data exposure or other malicious effects. Treat this as a serious supply-chain/configuration integrity risk unless the js mode is removed or strictly allowlisted/sandboxed and option inputs are strongly integrity-protected.