Security Fix for CVE-2025-12735, CVE-2025-13204, and member function bypass

Addresses security vulnerabilities from silentmatt/expr-eval#288 and #290 that affect this fork.

Changes

• Prototype pollution protection: Block access to __proto__, prototype, constructor in variable names and member expressions
• Function call restriction: Only allow functions registered in parser.functions, safe Math builtins, or inline-defined functions
• IFUNCALL validation: Add validateAllowedFunction check before function invocation
• Inline function registration: Use counter-based keys to prevent collision attacks
• Version bump to 5.0.0: Major version bump per semantic versioning for breaking changes

Breaking Change (v5.0.0)

Functions must be registered explicitly instead of passed via context. See BREAKING_CHANGES.md for migration guide.

// Before (vulnerable)
parser.evaluate('fn()', { fn: () => 'pwned' });

// After (secure)
parser.functions.fn = () => 'safe';
parser.evaluate('fn()');

Test Coverage

• Updated all tests to use secure function registration pattern
• Added 25 security tests covering:
  • Direct function call blocking
  • Nested member function call blocking
  • Prototype property access blocking
  • PoC attacks from VU#263614 and Issue Report security vulnerability silentmatt/expr-eval#289

Verification

• All 959 tests pass
• npm run type-check passes with no errors

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.