fix: fixing SSTI by removing eval style format string

Author: nom4dv3

packages/orap/task/storable.ts

@@ -18,7 +18,7 @@ export abstract class TaskStorable extends TaskBase {
   static async _load<T extends TaskStorable>(this: Constructor<T>, sm: StoreManager): Promise<T> {
     const instance = new this()
     // get all task keys
-    const keys = await sm.keys(`${instance.getTaskPrefix()}*`, true)
+    const keys = await sm.keys(instance.getTaskPrefix() + '*', true)
     // get the first task (del when finish)
     const serializedTask: string = (await sm.get(keys[0]))! // never undefined ensured by keys isWait=true
 

packages/utils/common/logger.ts

@@ -44,7 +44,7 @@ export class Logger {
       const method = type === 'info' ? 'log' : type
       const format = () => {
         const tag = this.tagMap[type]
-        return `${colors.dim(this.timeFormatter.format(new Date()))} ${tag} ${msg}`
+        return colors.dim(this.timeFormatter.format(new Date())) + ' ' + tag + ' ' + msg;
       }
       console[method](format())
     }

packages/utils/w3/event.ts

@@ -8,7 +8,7 @@ export function getEventSignature(abi: any[], eventName: string): string {
   const eventFragment = iface.getEvent(eventName)
 
   if (!eventFragment)
-    throw new Error(`event ${eventName} not found.`)
+    throw new Error("event " + eventName + " not found.")
 
   // Return the event topic (which is the event signature)
   return eventFragment.topicHash