Added scripting JPath restriction

src/core/operations/JPathExpression.mjs

@@ -49,6 +49,14 @@ class JPathExpression extends Operation {
         let results,
             obj;
 
+        // Split the string by literal quotes
+        const quoteSplit = query.split(/(?<=[^\\])"/);
+        for (let i = 0; i < quoteSplit.length; i++) {
+            // Only check the text that isn't surrounded by quotes.
+            if (i % 2 === 0 && quoteSplit[i].match(/\[\??\(/))
+                throw new OperationError("Query contains unsafe expression.");
+        }
+
         try {
             obj = JSON.parse(input);
         } catch (err) {

tests/operations/tests/Code.mjs

@@ -310,6 +310,17 @@ TestRegister.addTests([
             }
         ],
     },
+    {
+        name: "JPath Expression: Script-based expression",
+        input: "[{}]",
+        recipeConfig: [
+            {
+                "op": "JPath expression",
+                "args": ["$..[?(({__proto__:[].constructor}).constructor(\"self.postMessage({action:'bakeComplete',data:{bakeId:1,dish:{type:1,value:''},duration:1,error:false,id:undefined,inputNum:2,progress:1,result:'<iframe/onload=debugger>',type: 'html'}});\")();)]", "\n"]
+            }
+        ],
+        expectedOutput: "Query contains unsafe expression."
+    },
     {
         name: "CSS selector",
         input: '<div id="test">\n<p class="a">hello</p>\n<p>world</p>\n<p class="a">again</p>\n</div>',