ses - npm Package Compare versions

Comparing version 0.18.3 to 0.18.4

NEWS.md

 User-visible changes in SES:
 
+# v0.18.4 (2023-04-20)
+
+- Pass through the start compartment's `globalThis.harden` if defined.
+
 # v0.18.3 (2023-04-14)
@@ -4,0 +8,0 @@

package.json

 {
   "name": "ses",
-  "version": "0.18.3",
+  "version": "0.18.4",
   "description": "Hardened JavaScript for Fearless Cooperation",
@@ -63,4 +63,4 @@ "keywords": [
   "devDependencies": {
-    "@endo/compartment-mapper": "^0.8.3",
-    "@endo/static-module-record": "^0.7.18",
+    "@endo/compartment-mapper": "^0.8.4",
+    "@endo/static-module-record": "^0.7.19",
     "@endo/test262-runner": "^0.1.31",
@@ -179,3 +179,3 @@ "ava": "^5.2.0",
   },
-  "gitHead": "8141f58debaec420cbc2a7cb698e888566d430ba"
+  "gitHead": "38c2c59d6ae8c53f84cd333e6c7828e2d37604e2"
 }

src/commons.js

@@ -138,2 +138,3 @@ /* global globalThis */
 const { bind } = functionPrototype;
+
 /**
@@ -158,4 +159,4 @@ * uncurryThis()
 export const arrayJoin = uncurryThis(arrayPrototype.join);
-/** @type {<T, U>(thisArg: readonly T[], callbackfn: (value: T, index: number, array: T[]) => U, thisArg?: any) => U[]} */
-export const arrayMap = uncurryThis(arrayPrototype.map);
+/** @type {<T, U>(thisArg: readonly T[], callbackfn: (value: T, index: number, array: T[]) => U, cbThisArg?: any) => U[]} */
+export const arrayMap = /** @type {any} */ (uncurryThis(arrayPrototype.map));
 export const arrayPop = uncurryThis(arrayPrototype.pop);
@@ -191,8 +192,10 @@ /** @type {<T>(thisArg: T[], ...items: T[]) => number} */
 /**
- * @type {
- *   ((thisArg: string, searchValue: { [Symbol.replace](string: string, replaceValue: string): string; }, replaceValue: string) => string) |
+ * @type { &
+ *   ((thisArg: string, searchValue: { [Symbol.replace](string: string, replaceValue: string): string; }, replaceValue: string) => string) &
  *   ((thisArg: string, searchValue: { [Symbol.replace](string: string, replacer: (substring: string, ...args: any[]) => string): string; }, replacer: (substring: string, ...args: any[]) => string) => string)
  * }
  */
-export const stringReplace = uncurryThis(stringPrototype.replace);
+export const stringReplace = /** @type {any} */ (
+  uncurryThis(stringPrototype.replace)
+);
 export const stringSearch = uncurryThis(stringPrototype.search);
@@ -206,3 +209,3 @@ export const stringSlice = uncurryThis(stringPrototype.slice);
 export const weakmapDelete = uncurryThis(weakmapPrototype.delete);
-/** @type {<K, V>(thisArg: WeakMap<K, V>, ...args: Parameters<WeakMap<K,V>['get']>) => ReturnType<WeakMap<K,V>['get']>} */
+/** @type {<K extends {}, V>(thisArg: WeakMap<K, V>, ...args: Parameters<WeakMap<K,V>['get']>) => ReturnType<WeakMap<K,V>['get']>} */
 export const weakmapGet = uncurryThis(weakmapPrototype.get);
@@ -213,3 +216,2 @@ export const weakmapHas = uncurryThis(weakmapPrototype.has);
 export const weaksetAdd = uncurryThis(weaksetPrototype.add);
-export const weaksetGet = uncurryThis(weaksetPrototype.get);
 export const weaksetHas = uncurryThis(weaksetPrototype.has);
@@ -223,3 +225,5 @@ //
 /** @type {<T, TResult1 = T, TResult2 = never>(thisArg: T, onfulfilled?: ((value: T) => TResult1 | PromiseLike<TResult1>) | undefined | null, onrejected?: ((reason: any) => TResult2 | PromiseLike<TResult2>) | undefined | null) => Promise<TResult1 | TResult2>} */
-export const promiseThen = uncurryThis(promisePrototype.then);
+export const promiseThen = /** @type {any} */ (
+  uncurryThis(promisePrototype.then)
+);
 //
@@ -226,0 +230,0 @@ export const finalizationRegistryRegister =

src/compartment-shim.js

@@ -44,6 +44,2 @@ // @ts-check
 
-/**
- * @typedef {(source: string) => string} Transform
- */
-
 // Compartments do not need an importHook or resolveHook to be useful
@@ -101,3 +97,3 @@ // as a vessel for evaluating programs.
    * @param {object} [options]
-   * @param {Array<Transform>} [options.transforms]
+   * @param {Array<import('./lockdown-shim').Transform>} [options.transforms]
    * @param {boolean} [options.sloppyGlobalsMode]
@@ -104,0 +100,0 @@ * @param {object} [options.__moduleShimLexicals__]

src/error/tame-v8-error-constructor.js

@@ -210,3 +210,3 @@ import {
   // or the generated tamed stack string
-  /** @type {WeakMap<Error, ParsedStackInfo | StructuredStackInfo} */
+  /** @type {WeakMap<Error, ParsedStackInfo | StructuredStackInfo>} */
   const stackInfos = new WeakMap();
@@ -213,0 +213,0 @@

src/eval-scope.js

@@ -75,4 +75,5 @@ import { FERAL_EVAL, create, defineProperties, freeze } from './commons.js';
     allowNextEvalToBeUnsafe() {
-      if (evalScopeKit.revoked !== null) {
-        Fail`a handler did not reset allowNextEvalToBeUnsafe ${this.revoked.err}`;
+      const { revoked } = evalScopeKit;
+      if (revoked !== null) {
+        Fail`a handler did not reset allowNextEvalToBeUnsafe ${revoked.err}`;
       }
@@ -84,2 +85,3 @@ // Allow next reference to eval produce the unsafe FERAL_EVAL.
     },
+    /** @type {null | { err: any }} */
     revoked: null,
@@ -86,0 +88,0 @@ };

src/get-anonymous-intrinsics.js

@@ -48,6 +48,4 @@ import {
 
-  const ThrowTypeError = getOwnPropertyDescriptor(
-    makeArguments(),
-    'callee',
-  ).get;
+  const argsCalleeDesc = getOwnPropertyDescriptor(makeArguments(), 'callee');
+  const ThrowTypeError = argsCalleeDesc && argsCalleeDesc.get;
 
@@ -54,0 +52,0 @@ // 21.1.5.2 The %StringIteratorPrototype% Object

src/intrinsics.js

@@ -5,2 +5,3 @@ import {
   arrayFilter,
+  create,
   defineProperty,
@@ -38,2 +39,3 @@ entries,
     if (
+      !preDesc ||
       !is(preDesc.value, desc.value) ||
@@ -75,3 +77,4 @@ preDesc.get !== desc.get ||
 export const makeIntrinsicsCollector = () => {
-  const intrinsics = { __proto__: null };
+  /** @type {Record<any, any>} */
+  const intrinsics = create(null);
   let pseudoNatives;
@@ -78,0 +81,0 @@

src/make-hardener.js

@@ -30,2 +30,3 @@ // Adapted from SES/Caja - Copyright (C) 2011 Google Inc.
   WeakSet,
+  globalThis,
   apply,
@@ -131,2 +132,8 @@ arrayForEach,
 export const makeHardener = () => {
+  // Use a native hardener if possible.
+  if (typeof globalThis.harden === 'function') {
+    const safeHarden = globalThis.harden;
+    return safeHarden;
+  }
+
   const hardened = new WeakSet();
@@ -133,0 +140,0 @@

src/make-safe-evaluator.js

@@ -22,4 +22,4 @@ // Portions adapted from V8 - Copyright 2016 the V8 project authors.
  * @param {object} [options.moduleLexicals]
- * @param {Array<Transform>} [options.globalTransforms]
- * @param {bool} [options.sloppyGlobalsMode]
+ * @param {Array<import('./lockdown-shim.js').Transform>} [options.globalTransforms]
+ * @param {boolean} [options.sloppyGlobalsMode]
  */
@@ -31,3 +31,3 @@ export const makeSafeEvaluator = ({
   sloppyGlobalsMode = false,
-} = {}) => {
+}) => {
   const scopeTerminator = sloppyGlobalsMode
@@ -59,5 +59,6 @@ ? createSloppyGlobalsScopeTerminator(globalObject)
    * @param {object} [options]
-   * @param {Array<Transform>} [options.localTransforms]
+   * @param {Array<import('./lockdown-shim.js').Transform>} [options.localTransforms]
    */
-  const safeEvaluate = (source, { localTransforms = [] } = {}) => {
+  const safeEvaluate = (source, options) => {
+    const { localTransforms = [] } = options || {};
     provideEvaluate();
@@ -64,0 +65,0 @@

src/module-instance.js

@@ -192,2 +192,3 @@ import { assert } from './error/assert.js';
       let tdz = true;
+      /** @type {null | Array<(value: any) => void>} */
       let optUpdaters = [];
@@ -218,3 +219,3 @@
         tdz = false;
-        for (const updater of updaters) {
+        for (const updater of updaters || []) {
           updater(initValue);
@@ -233,3 +234,3 @@ }
         if (tdz) {
-          arrayPush(optUpdaters, updater);
+          arrayPush(optUpdaters || [], updater);
         } else {
@@ -236,0 +237,0 @@ updater(value);

src/module-load.js

@@ -322,3 +322,3 @@ // For brevity, in this file, as in module-link.js, the term "moduleRecord"
   const pendingJobs = new Set();
-  /** @type {Map<object, Map<string, Promise<Record>>} */
+  /** @type {Map<object, Map<string, Promise<Record<any, any>>>>} */
   const moduleLoads = new Map();
@@ -325,0 +325,0 @@ /** @type {Array<Error>} */

src/scope-constants.js

@@ -118,2 +118,3 @@ import {
   return (
+    desc &&
     //
@@ -120,0 +121,0 @@ // The getters will not have .writable, don't let the falsyness of

src/tame-function-tostring.js

@@ -30,3 +30,3 @@ import {
       toString() {
-        const str = functionToString(this, []);
+        const str = functionToString(this);
         if (
@@ -33,0 +33,0 @@ stringEndsWith(str, nativeSuffix) ||

src/tame-harden.js

@@ -19,2 +19,8 @@ /* eslint-disable no-restricted-globals */
 
+  if (safeHarden.isFake) {
+    // The "safe" hardener is already a fake hardener.
+    // Just use it.
+    return safeHarden;
+  }
+
   const fakeHarden = arg => arg;
@@ -21,0 +27,0 @@ fakeHarden.isFake = true;

src/tame-regexp-constructor.js

@@ -18,2 +18,5 @@ import {
     // RegExp has non-writable static properties we need to omit.
+    /**
+     * @param  {Parameters<typeof FERAL_REG_EXP>} rest
+     */
     const ResultRegExp = function RegExp(...rest) {
@@ -26,2 +29,7 @@ if (new.target === undefined) {
 
+    const speciesDesc = getOwnPropertyDescriptor(FERAL_REG_EXP, speciesSymbol);
+    if (!speciesDesc) {
+      throw new TypeError('no RegExp[Symbol.species] descriptor');
+    }
+
     defineProperties(ResultRegExp, {
@@ -35,3 +43,3 @@ length: { value: 2 },
       },
-      [speciesSymbol]: getOwnPropertyDescriptor(FERAL_REG_EXP, speciesSymbol),
+      [speciesSymbol]: speciesDesc,
     });
@@ -45,2 +53,3 @@ return ResultRegExp;
   if (regExpTaming !== 'unsafe') {
+    // @ts-expect-error Deleted properties must be optional
     delete RegExpPrototype.compile;
@@ -47,0 +56,0 @@ }

src/whitelist-intrinsics.js

@@ -215,2 +215,5 @@ // Copyright (C) 2011 Google Inc.
     const desc = getOwnPropertyDescriptor(obj, prop);
+    if (!desc) {
+      throw new TypeError(`Property ${prop} not found at ${path}`);
+    }
 
@@ -217,0 +220,0 @@ // Is this a value property?

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

2958398

increased by0.26%

Lines of code

63289

increased by0.25%

No dependency changes