XSS in transform filter

This was found during the hxp ctf.

Credit

@cgvwzq and his writeup

• Describe how to reproduce the bug / the goal of the feature request: Paste the below JSON in the Vega Editor. Working demo. You will see a ‘1’ alert dialog. To my understanding you should not be able to run arbitrary JS using vega-lite json, should you?
• Provide an example spec in JSON, wrapped by triple backticks like this:

{
  "data": {
    "values": [{}]
  },
  "transform": [
    {"filter": "(0//1/)-'\\\n,alert(1))))//'"}
  ],
  "mark": "bar"
}

[jheer]

The error stemmed from the removal of comments from our parser, which opened the door to seeing “division by a regexp” instead. PR #3019 updates the parser to instead throw when a single-line comment // is encountered, which is the intended design.

[domoritz]

The issue also exists in Vega 2.

{
  "data": [
    {
      "name": "data",
      "values": [{}],
      "transform": [
        {"type": "filter", "test": "(0//1/)-'\\\n,alert(1))))//'"}
      ]
    }
  ]
}

(try at https://vega.github.io/vega-editor/?mode=vega)