Socket
Socket
Sign inDemoInstall

acorn-csp

Package Overview
Dependencies
Maintainers
1
Versions
4
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

acorn-csp - npm Package Compare versions

Comparing version 0.0.2 to 0.0.3

70

index.js

@@ -5,3 +5,6 @@ #!/usr/bin/env node

if (process.argv.length < 3) {
var srcPath = process.argv[3] || require.resolve('acorn');
var destPath = process.argv[2];
if (!destPath) {
console.log('Usage: acorn-csp <path to acorn> <destination filename>');

@@ -11,15 +14,14 @@ process.exit(1);

Error.stackTraceLimit = 100;
var fs = require('fs');
var vm = require('vm');
var srcPath = process.argv[3] || require.resolve('acorn');
var destPath = process.argv[2];
var esprima = require('esprima');
var recast = require('recast');
var fs = require('fs');
var b = recast.types.builders;
// Read original Acorn's source with conservative parser (recast).
var source = fs.readFileSync(srcPath, 'utf-8');
var ast = recast.parse(source, {esprima: esprima});
var makePredicatePath;
// Instrument code with predicate collector.
var makePredicatePath, makePredicateCache = {};

@@ -30,5 +32,7 @@ recast.visit(ast, {

if (node.id.name === 'makePredicate') {
// Found makePredicate function, instrument it with postMessage to sandbox.
// Found makePredicate function.
makePredicatePath = path;
// Rename it temporarily.
node.id.name = '_makePredicate';
// And provide wrapper that collects all the possible results.
var wrapperNode = esprima.parse(

@@ -49,4 +53,3 @@ 'function makePredicate(words) {' +

var makePredicateCache = {};
// Execute instrumented code and collect possible predicates.
vm.runInNewContext(

@@ -57,28 +60,27 @@ recast.prettyPrint(ast).code,

makePredicatePath.get("id").node.name = 'makePredicate';
// Remove wrapper.
makePredicatePath.parentPath.get(makePredicatePath.name + 1).replace();
makePredicatePath.get("body", "body").replace([{
type: 'ReturnStatement',
argument: {
type: 'MemberExpression',
object: {
type: 'ObjectExpression',
properties: Object.keys(makePredicateCache).map(function (key) {
var fnNode = esprima.parse('(' + this[key] + ')').body[0].expression;
fnNode.id = null;
return {
type: 'Property',
kind: 'init',
key: {type: 'Literal', value: key},
value: fnNode
};
}, makePredicateCache)
},
computed: true,
property: makePredicatePath.get("params", 0).node
}
}]);
// Rename original function back.
makePredicatePath.get('id').node.name = 'makePredicate';
makePredicatePath.parentPath.get(makePredicatePath.name + 1).replace();
// And generate it's body as hash of collected inputs/outputs.
makePredicatePath.get('body', 'body').replace([b.returnStatement(
b.memberExpression(
b.objectExpression(Object.keys(makePredicateCache).map(function (key) {
var funcNode = esprima.parse(makePredicateCache[key]).body[0];
return b.property('init', b.literal(key), b.functionExpression(
null,
funcNode.params,
funcNode.body
));
})),
makePredicatePath.get('params', 0).node,
true
)
)]);
fs.writeFileSync(destPath, recast.print(ast).code);
// Finally, save transformed AST to file with preserved formatting.
fs.writeFileSync(destPath, recast.print(ast).code);
console.log('Generated successfully!');
{
"name": "acorn-csp",
"version": "0.0.2",
"version": "0.0.3",
"description": "Builder for Acorn that precompiles predicates in order to satisfy CSP.",

@@ -5,0 +5,0 @@ "main": "index.js",

acorn-csp
=========
Builder for Acorn that precompiles predicates in order to satisfy CSP.
Builder for Acorn that precompiles and inlines predicates in order to satisfy Content Security Policy (CSP).

@@ -14,4 +14,4 @@ This workaround addresses [acorn#90](https://github.com/marijnh/acorn/issues/90) and [acorn#123](https://github.com/marijnh/acorn/issues/123) issues.

And use generated file instead of original one Acorn.
And use generated file instead of original Acorn's `acorn.js`.
When path to acorn is not specified, it's assumed to be available as `require('acorn')` from current directory.
SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc