🔒 Use vm instead of Function in Node.js (#1509)

packages/bot-engine/blocks/integrations/webhook/resumeWebhookExecution.ts

@@ -11,6 +11,7 @@ import { SessionState } from '@typebot.io/schemas/features/chat/sessionState'
 import { ExecuteIntegrationResponse } from '../../../types'
 import { parseVariables } from '@typebot.io/variables/parseVariables'
 import { updateVariablesInSession } from '@typebot.io/variables/updateVariablesInSession'
+import vm from 'vm'
 
 type Props = {
   state: SessionState
@@ -55,12 +56,14 @@ export const resumeWebhookExecution = ({
     if (!varMapping?.bodyPath || !varMapping.variableId) return newVariables
     const existingVariable = typebot.variables.find(byId(varMapping.variableId))
     if (!existingVariable) return newVariables
-    const func = Function(
-      'data',
-      `return data.${parseVariables(typebot.variables)(varMapping?.bodyPath)}`
-    )
+    const sandbox = vm.createContext({
+      data: response.data,
+    })
     try {
-      const value: unknown = func(response)
+      const value: unknown = vm.runInContext(
+        parseVariables(typebot.variables)(varMapping?.bodyPath),
+        sandbox
+      )
       return [...newVariables, { ...existingVariable, value }]
     } catch (err) {
       return newVariables