ses - npm Package Compare versions

Comparing version 1.11.0 to 1.12.0

dist/types.d.cts

@@ -38,3 +38,10 @@ /**
   mathTaming?: 'safe' | 'unsafe';
-  evalTaming?: 'safeEval' | 'unsafeEval' | 'noEval';
+  evalTaming?:
+    | 'safe-eval'
+    | 'unsafe-eval'
+    | 'no-eval'
+    // deprecated
+    | 'safeEval'
+    | 'unsafeEval'
+    | 'noEval';
   stackFiltering?: 'concise' | 'verbose';
@@ -41,0 +48,0 @@ overrideTaming?: 'moderate' | 'min' | 'severe';

package.json

 {
   "name": "ses",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "Hardened JavaScript for Fearless Cooperation",
@@ -59,2 +59,8 @@ "keywords": [
     },
+    "./hermes": {
+      "require": {
+        "types": "./dist/types.d.cts",
+        "default": "./dist/ses-hermes.cjs"
+      }
+    },
     "./tools.js": "./tools.js",
@@ -74,3 +80,5 @@ "./assert-shim.js": "./assert-shim.js",
   "scripts": {
-    "build": "node scripts/bundle.js",
+    "build:vanilla": "node scripts/bundle.js",
+    "build:hermes": "node scripts/bundle.js hermes",
+    "build": "yarn build:vanilla && yarn build:hermes",
     "clean": "rm -rf dist",
@@ -86,2 +94,3 @@ "cover": "c8 ava",
     "test": "tsd && ava",
+    "test:hermes": "./scripts/hermes-test.sh",
     "test:xs": "xst dist/ses.umd.js test/_lockdown-safe.js && node scripts/generate-test-xs.js && xst tmp/test-xs.js && rm -rf tmp",
@@ -94,5 +103,10 @@ "postpack": "git clean -f '*.d.ts*' '*.tsbuildinfo'"
   "devDependencies": {
-    "@endo/compartment-mapper": "^1.5.0",
-    "@endo/module-source": "^1.2.0",
-    "@endo/test262-runner": "^0.1.44",
+    "@babel/generator": "^7.26.3",
+    "@babel/parser": "~7.26.2",
+    "@babel/traverse": "~7.25.9",
+    "@babel/types": "~7.26.0",
+    "@endo/compartment-mapper": "^1.6.0",
+    "@endo/module-source": "^1.3.0",
+    "@endo/test262-runner": "^0.1.45",
+    "@types/babel__traverse": "^7.20.5",
     "ava": "^6.1.3",
@@ -107,2 +121,3 @@ "babel-eslint": "^10.1.0",
     "eslint-plugin-import": "^2.29.1",
+    "hermes-engine-cli": "^0.12.0",
     "prettier": "^3.3.3",
@@ -218,3 +233,3 @@ "terser": "^5.16.6",
   },
-  "gitHead": "e0683e0bfdbfc84351af332c9e78813d7b67ef89"
+  "gitHead": "9b6784831d37db948cdd61f6da1f3489e8f97906"
 }

src/commons.js

@@ -323,3 +323,3 @@ /**
   // See https://github.com/endojs/endo/blob/master/packages/ses/error-codes/SES_NO_EVAL.md
-  throw TypeError('Cannot eval with evalTaming set to "noEval" (SES_NO_EVAL)');
+  throw TypeError('Cannot eval with evalTaming set to "no-eval" (SES_NO_EVAL)');
 };
@@ -384,1 +384,41 @@
 export const FERAL_STACK_SETTER = feralStackSetter;
+
+const getAsyncGeneratorFunctionInstance = () => {
+  // Test for async generator function syntax support.
+  try {
+    // Wrapping one in an new Function lets the `hermesc` binary file
+    // parse the Metro js bundle without SyntaxError, to generate the
+    // optimised Hermes bytecode bundle, when `gradlew` is called to
+    // assemble the release build APK for React Native prod Android apps.
+    // Delaying the error until runtime lets us customise lockdown behaviour.
+    return new FERAL_FUNCTION(
+      'return (async function* AsyncGeneratorFunctionInstance() {})',
+    )();
+  } catch (error) {
+    // Note: `Error.prototype.jsEngine` is only set by React Native runtime, not Hermes:
+    // https://github.com/facebook/react-native/blob/main/packages/react-native/ReactCommon/hermes/executor/HermesExecutorFactory.cpp#L224-L230
+    if (error.name === 'SyntaxError') {
+      // Swallows Hermes error `async generators are unsupported` at runtime.
+      // Note: `console` is not a JS built-in, so Hermes engine throws:
+      // Uncaught ReferenceError: Property 'console' doesn't exist
+      // See: https://github.com/facebook/hermes/issues/675
+      // However React Native provides a `console` implementation when setting up error handling:
+      // https://github.com/facebook/react-native/blob/main/packages/react-native/Libraries/Core/InitializeCore.js
+      return undefined;
+    } else if (error.name === 'EvalError') {
+      // eslint-disable-next-line no-empty-function
+      return async function* AsyncGeneratorFunctionInstance() {};
+    } else {
+      throw error;
+    }
+  }
+};
+
+/**
+ * If the platform supports async generator functions, this will be an
+ * async generator function instance. Otherwise, it will be `undefined`.
+ *
+ * @type {AsyncGeneratorFunction | undefined}
+ */
+export const AsyncGeneratorFunctionInstance =
+  getAsyncGeneratorFunctionInstance();

src/compartment.js

@@ -312,2 +312,4 @@ /**
 
+    const compartment = this;
+
     setGlobalObjectSymbolUnscopables(globalObject);
@@ -371,7 +373,7 @@
       }
-      await load(privateFields, moduleAliases, this, fullSpecifier);
+      await load(privateFields, moduleAliases, compartment, fullSpecifier);
       const { execute, exportsProxy } = link(
         privateFields,
         moduleAliases,
-        this,
+        compartment,
         fullSpecifier,
@@ -378,0 +380,0 @@ );

src/get-anonymous-intrinsics.js

@@ -17,2 +17,4 @@ import {
   globalThis,
+  assign,
+  AsyncGeneratorFunctionInstance,
 } from './commons.js';
@@ -99,16 +101,2 @@ import { InertCompartment } from './compartment.js';
 
-  // 25.3.1 The AsyncGeneratorFunction Constructor
-
-  // eslint-disable-next-line no-empty-function
-  async function* AsyncGeneratorFunctionInstance() {}
-  const AsyncGeneratorFunction = getConstructorOf(
-    AsyncGeneratorFunctionInstance,
-  );
-
-  // 25.3.2.2 AsyncGeneratorFunction.prototype
-  const AsyncGenerator = AsyncGeneratorFunction.prototype;
-  // 25.5.1 Properties of the AsyncGenerator Prototype Object
-  const AsyncGeneratorPrototype = AsyncGenerator.prototype;
-  const AsyncIteratorPrototype = getPrototypeOf(AsyncGeneratorPrototype);
-
   // 25.7.1 The AsyncFunction Constructor
@@ -124,6 +112,2 @@
     '%InertAsyncFunction%': AsyncFunction,
-    '%AsyncGenerator%': AsyncGenerator,
-    '%InertAsyncGeneratorFunction%': AsyncGeneratorFunction,
-    '%AsyncGeneratorPrototype%': AsyncGeneratorPrototype,
-    '%AsyncIteratorPrototype%': AsyncIteratorPrototype,
     '%Generator%': Generator,
@@ -141,2 +125,23 @@ '%InertGeneratorFunction%': GeneratorFunction,
 
+  if (AsyncGeneratorFunctionInstance !== undefined) {
+    // 25.3.1 The AsyncGeneratorFunction Constructor
+
+    const AsyncGeneratorFunction = getConstructorOf(
+      AsyncGeneratorFunctionInstance,
+    );
+
+    // 25.3.2.2 AsyncGeneratorFunction.prototype
+    const AsyncGenerator = AsyncGeneratorFunction.prototype;
+    // 25.5.1 Properties of the AsyncGenerator Prototype Object
+    const AsyncGeneratorPrototype = AsyncGenerator.prototype;
+    const AsyncIteratorPrototype = getPrototypeOf(AsyncGeneratorPrototype);
+
+    assign(intrinsics, {
+      '%AsyncGenerator%': AsyncGenerator,
+      '%InertAsyncGeneratorFunction%': AsyncGeneratorFunction,
+      '%AsyncGeneratorPrototype%': AsyncGeneratorPrototype,
+      '%AsyncIteratorPrototype%': AsyncIteratorPrototype,
+    });
+  }
+
   if (globalThis.Iterator) {
@@ -143,0 +148,0 @@ intrinsics['%IteratorHelperPrototype%'] = getPrototypeOf(

src/lockdown.js

@@ -186,3 +186,3 @@ // Copyright (C) 2018 Agoric
     domainTaming = getenv('LOCKDOWN_DOMAIN_TAMING', 'safe'),
-    evalTaming = getenv('LOCKDOWN_EVAL_TAMING', 'safeEval'),
+    evalTaming = getenv('LOCKDOWN_EVAL_TAMING', 'safe-eval'),
     overrideDebug = arrayFilter(
@@ -207,5 +207,8 @@ stringSplit(getenv('LOCKDOWN_OVERRIDE_DEBUG', ''), ','),
 
-  evalTaming === 'unsafeEval' ||
-    evalTaming === 'safeEval' ||
-    evalTaming === 'noEval' ||
+  evalTaming === 'unsafe-eval' ||
+    evalTaming === 'unsafeEval' || // deprecated
+    evalTaming === 'safe-eval' ||
+    evalTaming === 'safeEval' || // deprecated
+    evalTaming === 'no-eval' ||
+    evalTaming === 'noEval' || // deprecated
     Fail`lockdown(): non supported option evalTaming: ${q(evalTaming)}`;
@@ -413,3 +416,7 @@
 
-  if (evalTaming === 'noEval') {
+  if (
+    evalTaming === 'no-eval' ||
+    // deprecated
+    evalTaming === 'noEval'
+  ) {
     setGlobalObjectEvaluators(
@@ -420,3 +427,7 @@ globalThis,
     );
-  } else if (evalTaming === 'safeEval') {
+  } else if (
+    evalTaming === 'safe-eval' ||
+    // deprecated
+    evalTaming === 'safeEval'
+  ) {
     const { safeEvaluate } = makeSafeEvaluator({ globalObject: globalThis });
@@ -428,6 +439,11 @@ setGlobalObjectEvaluators(
     );
-  } else if (evalTaming === 'unsafeEval') {
-    // Leave eval function and Function constructor of the initial compartment in-tact.
-    // Other compartments will not have access to these evaluators unless a guest program
-    // escapes containment.
+  } else if (
+    evalTaming === 'unsafe-eval' ||
+    // deprecated
+    evalTaming === 'unsafeEval'
+  ) {
+    // Leave eval function and Function constructor of the initial
+    // compartment intact.
+    // Other compartments will not have access to these evaluators unless a
+    // guest program escapes containment.
   }
@@ -434,0 +450,0 @@

src/strict-scope-terminator.js

@@ -9,3 +9,2 @@ import {
   getOwnPropertyDescriptors,
-  globalThis,
 } from './commons.js';
@@ -59,3 +58,3 @@ import { assert } from './error/assert.js';
     // we must at least return true for all properties on the realm globalThis
-    return prop in globalThis;
+    return true;
   },
@@ -62,0 +61,0 @@

src/tame-function-constructors.js

@@ -9,2 +9,3 @@ import {
   freeze,
+  AsyncGeneratorFunctionInstance,
 } from './commons.js';
@@ -130,9 +131,12 @@
   );
-  repairFunction(
-    'AsyncGeneratorFunction',
-    '%InertAsyncGeneratorFunction%',
-    '(async function*(){})',
-  );
 
+  if (AsyncGeneratorFunctionInstance !== undefined) {
+    repairFunction(
+      'AsyncGeneratorFunction',
+      '%InertAsyncGeneratorFunction%',
+      '(async function*(){})',
+    );
+  }
+
   return newIntrinsics;
 }

types.d.ts

@@ -38,3 +38,10 @@ /**
   mathTaming?: 'safe' | 'unsafe';
-  evalTaming?: 'safeEval' | 'unsafeEval' | 'noEval';
+  evalTaming?:
+    | 'safe-eval'
+    | 'unsafe-eval'
+    | 'no-eval'
+    // deprecated
+    | 'safeEval'
+    | 'unsafeEval'
+    | 'noEval';
   stackFiltering?: 'concise' | 'verbose';
@@ -41,0 +48,0 @@ overrideTaming?: 'moderate' | 'min' | 'severe';

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

4083940

13.31%

Number of package files

86

1.18%

Lines of code

91871

19.08%

Number of low supply chain risk alerts

0

-100%

Worsened metrics

Dev dependency count

22

37.5%

Number of medium supply chain risk alerts

16

14.29%

No dependency changes