@locker/sandbox - npm Package Compare versions

Comparing version 0.12.2 to 0.12.3

package.json

 {
     "name": "@locker/sandbox",
-    "version": "0.12.2",
+    "version": "0.12.3",
     "license": "Salesforce Developer Agreement",
@@ -11,3 +11,3 @@ "author": "Salesforce UI Security Team",
     "scripts": {
-        "build": "tsc --emitDeclarationOnly && rollup -c .rolluprc.cjs",
+        "build": "tsc --project tsconfig.types.json && rollup --config .rolluprc.cjs",
         "clean": "locker-trash dist/ types/"
@@ -24,9 +24,6 @@ },
         "@caridy/sjs": "0.3.4",
-        "@locker/distortion": "0.12.2",
-        "@locker/shared": "0.12.2"
+        "@locker/distortion": "0.12.3",
+        "@locker/shared": "0.12.3"
     },
-    "devDependencies": {
-        "typescript": "3.8.3"
-    },
-    "gitHead": "738fe1b33d349d389394370359044c1d5ee968c4"
+    "gitHead": "04a89b8ef9516c8ebc5f38a1bb2d93b04deba348"
 }

README.md

@@ -13,21 +13,38 @@ # @locker/sandbox
 
-<!-- eslint-disable import/no-extraneous-dependencies, no-unused-vars, prettier/prettier -->
+The `evaluateInSandbox()` function:
+<!-- eslint-disable import/no-extraneous-dependencies, no-console, no-undef, no-unused-vars, prettier/prettier -->
 ```js
 import { evaluateInSandbox } from '@locker/sandbox';
 
-function sandboxFunction(namespace, func) {
-    let out;
-    evaluateInSandbox(
-        namespace,
-        `$lockerEvalContext$(${func.toString()})`,
-        def => {
-            out = def;
+let sandboxed;
+// Evaluate source text in a sandbox using
+// `evaluateInSandbox(key, sourceText, context, endowments)`. The function has
+// no return value.
+evaluateInSandbox(
+    // The key of the sandbox to evaluate source text in. One sandbox is created
+    // per key regardless of the number of calls to `evaluateInSandbox()`.
+    'sandbox',
+    // The source text to evaluate in the sandbox.
+    `$lockerEvalContext$(${
+        // Function body to coerce to a string. Using a function and coercing
+        // it to a string has the benefit of working with minifiers.
+        function() {
+            // Call to a provided endowment value.
+            logger('inside sandbox');
+            // Other code to sandbox...
         }
-    );
-    return out;
-}
-
-const sandboxed = sandboxFunction('ns1', function() {
-    // Put code here...
-});
+    })`,
+    // The value of the optional sandbox context binding `$lockerEvalContext$`
+    // that may be used to initialize sandboxed code. The binding can be an object,
+    // function, or anything else. The `$lockerEvalContext$` binding can only be
+    // accessed a once per sandbox evaluation and is set to `undefined` after
+    // the synchronous sandbox evaluation.
+    def => {
+        sandboxed = def;
+    },
+    // The optional endowments object whose property descriptors are used to
+    // define properties on the sandboxed global object. Behind the scenes the
+    // `$lockerEvalContext$` is defined using the same endowments feature.
+    { logger: console.log.bind(console) }
+);
 ```

types/index.d.ts

@@ -0,1 +1,2 @@
+import { SandboxKey } from '@locker/distortion';
 interface EvalContext {
@@ -5,3 +6,4 @@ set?: (name: string | symbol, value: any) => void;
 }
-export declare function evaluateInSandbox(namespace: string, sourceText: string, context?: EvalContext, endowments?: object): void;
+export declare function evaluateInSandbox(key: SandboxKey, sourceText: string, context?: EvalContext, endowments?: object): void;
 export {};
+//# sourceMappingURL=index.d.ts.map

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

143455

increased by1.13%

Dev dependency count

0

decreased by-100%

Number of package files

7

increased by16.67%

Lines of code

3037

increased by0.16%

Number of lines in readme file

50

increased by51.52%

Number of medium supply chain risk alerts

0

decreased by-100%

Dependency changes

• + Added@locker/distortion@0.12.3(transitive)

• + Added@locker/html-sanitizer@0.12.3(transitive)

• + Added@locker/shared@0.12.3(transitive)

• + Added@locker/shared-dom@0.12.3(transitive)

• + Added@locker/shared-url@0.12.3(transitive)

• + Addeddompurify@2.2.2(transitive)

• - Removed@locker/distortion@0.12.2(transitive)

• - Removed@locker/html-sanitizer@0.12.2(transitive)

• - Removed@locker/shared@0.12.2(transitive)

• - Removed@locker/shared-dom@0.12.2(transitive)

• - Removed@locker/shared-url@0.12.2(transitive)

• - Removeddompurify@2.0.8(transitive)

• Updated@locker/distortion@0.12.3

• Updated@locker/shared@0.12.3