@enclave-vm/core - npm Package Compare versions

Comparing version 2.15.1 to 2.15.2

esm/worker.mjs

@@ -529,3 +529,7 @@ // libs/core/src/adapters/interpreter-adapter.ts
         if (prop.type === "RestElement") continue;
-        const key = prop.key.name;
+        if (prop.computed) throw new InterpreterError("Computed destructuring keys are not allowed");
+        let key;
+        if (prop.key.type === "Identifier") key = prop.key.name;
+        else if (prop.key.type === "Literal") key = String(prop.key.value);
+        else throw new InterpreterError("Unsupported destructuring key");
         if (BLOCKED_KEYS.has(key)) throw new InterpreterError(`Forbidden destructured key: ${key}`);
@@ -532,0 +536,0 @@ this.bindPattern(prop.value, obj[key], scope, mutable);

package.json

 {
   "name": "@enclave-vm/core",
-  "version": "2.15.1",
+  "version": "2.15.2",
   "description": "Sandbox runtime for secure JavaScript code execution",
@@ -47,4 +47,4 @@ "author": "AgentFront <[e-mail]>",
     "@babel/standalone": "^7.29.0",
-    "@enclave-vm/ast": "2.15.1",
-    "@enclave-vm/types": "2.15.1",
+    "@enclave-vm/ast": "2.15.2",
+    "@enclave-vm/types": "2.15.2",
     "@types/estree": "1.0.8",
@@ -51,0 +51,0 @@ "acorn": "8.15.0",

secure-proxy.d.ts

@@ -46,2 +46,13 @@ /**
     /**
+     * Property-descriptor and prototype MUTATION gadgets. These are the primitives behind the
+     * GHSA-3279 membrane self-leak (`Object.defineProperty(Object, 'getOwnPropertyDescriptor', hook)`
+     * to intercept the trap's raw target) and classic prototype pollution (`setPrototypeOf`). They
+     * are never needed by AgentScript and are already refused by the single-VM SafeObject
+     * (`DANGEROUS_OBJECT_STATIC_METHODS`), so they are blocked at every level that blocks the
+     * constructor (all except PERMISSIVE). Read-only reflection (getPrototypeOf, keys, entries,
+     * getOwnPropertyNames) is intentionally NOT here: the membrane's own getPrototypeOf/ownKeys traps
+     * already neutralize it for proxied values, and it has legitimate uses.
+     */
+    readonly DESCRIPTOR_MUTATION: Set<string>;
+    /**
      * Node.js 24 Iterator helper method names
@@ -48,0 +59,0 @@ * Blocked at STRICT/SECURE to prevent prototype chain access via iterators

src/adapters/worker-pool/package.json

 {
   "name": "@enclave-vm/core",
-  "version": "2.15.1",
+  "version": "2.15.2",
   "description": "Sandbox runtime for secure JavaScript code execution",
@@ -49,4 +49,4 @@ "author": "AgentFront <[e-mail]>",
     "@babel/standalone": "^7.29.0",
-    "@enclave-vm/ast": "2.15.1",
-    "@enclave-vm/types": "2.15.1",
+    "@enclave-vm/ast": "2.15.2",
+    "@enclave-vm/types": "2.15.2",
     "@types/estree": "1.0.8",
@@ -53,0 +53,0 @@ "acorn": "8.15.0",

worker.js

@@ -568,3 +568,7 @@ "use strict";
         if (prop.type === "RestElement") continue;
-        const key = prop.key.name;
+        if (prop.computed) throw new InterpreterError("Computed destructuring keys are not allowed");
+        let key;
+        if (prop.key.type === "Identifier") key = prop.key.name;
+        else if (prop.key.type === "Literal") key = String(prop.key.value);
+        else throw new InterpreterError("Unsupported destructuring key");
         if (BLOCKED_KEYS.has(key)) throw new InterpreterError(`Forbidden destructured key: ${key}`);
@@ -571,0 +575,0 @@ this.bindPattern(prop.value, obj[key], scope, mutable);

New alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Fixed alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Improved metrics

Total package byte prevSize

1205696

0.93%

Lines of code

32793

0.56%

Dependency changes

• + Added

  @enclave-vm/ast@2.15.2
  (transitive)

• + Added

  @enclave-vm/types@2.15.2
  (transitive)

• - Removed

  @enclave-vm/ast@2.15.1
  (transitive)

• - Removed

  @enclave-vm/types@2.15.1
  (transitive)

• Updated

  @enclave-vm/ast@2.15.2

• Updated

  @enclave-vm/types@2.15.2