Socket
Socket
Sign inDemoInstall

ses

Package Overview
Dependencies
Maintainers
6
Versions
102
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

ses - npm Package Compare versions

Comparing version 1.1.0 to 1.2.0

./dist/ses.cjs

7

NEWS.md
User-visible changes in SES:
# v1.2.0 (2024-02-14)
- Exports `ses/lockdown-shim.js`, `ses/compartment-shim.js`, and
`ses/assert-shim.js` for piecemeal usage.
This change is motivated by the need to omit `ses/assert-shim.js` in Test262
environments.
# v1.1.0 (2024-01-17)

@@ -4,0 +11,0 @@

18

package.json
{
"name": "ses",
"version": "1.1.0",
"version": "1.2.0",
"description": "Hardened JavaScript for Fearless Cooperation",

@@ -26,3 +26,4 @@ "keywords": [

"type": "git",
"url": "git+https://github.com/endojs/endo.git"
"url": "git+https://github.com/endojs/endo.git",
"directory": "packages/ses"
},

@@ -49,2 +50,5 @@ "bugs": {

"./tools.js": "./tools.js",
"./assert-shim.js": "./assert-shim.js",
"./lockdown-shim.js": "./lockdown-shim.js",
"./compartment-shim.js": "./compartment-shim.js",
"./package.json": "./package.json"

@@ -67,8 +71,8 @@ },

"dependencies": {
"@endo/env-options": "^1.1.0"
"@endo/env-options": "^1.1.1"
},
"devDependencies": {
"@endo/compartment-mapper": "^1.1.0",
"@endo/static-module-record": "^1.0.2",
"@endo/test262-runner": "^0.1.32",
"@endo/compartment-mapper": "^1.1.1",
"@endo/static-module-record": "^1.0.3",
"@endo/test262-runner": "^0.1.33",
"ava": "^5.3.0",

@@ -190,3 +194,3 @@ "babel-eslint": "^10.0.3",

},
"gitHead": "373f9eebab66c94ed42350473c90fb25e6054f0a"
"gitHead": "f731c5c12f8d185dbf2daf53ec6a57e5ac56e4e9"
}

@@ -199,3 +199,3 @@ # SES

behaviors of the `Date` constructor which would reveal the current time.
Comaprtments leave these out since they can be used as covert communication
Compartments leave these out since they can be used as covert communication
channels between programs.

@@ -202,0 +202,0 @@ However, a compartment may be expressly given access to these objects

@@ -14,2 +14,3 @@ // @ts-check

promiseThen,
toStringTagSymbol,
weakmapGet,

@@ -109,6 +110,2 @@ weakmapSet,

toString() {
return '[object Compartment]';
},
module(specifier) {

@@ -173,2 +170,14 @@ if (typeof specifier !== 'string') {

// This causes `String(new Compartment())` to evaluate to `[object Compartment]`.
// The descriptor follows the conventions of other globals with @@toStringTag
// properties, e.g. Math.
defineProperties(CompartmentPrototype, {
[toStringTagSymbol]: {
value: 'Compartment',
writable: false,
enumerable: false,
configurable: true,
},
});
defineProperties(InertCompartment, {

@@ -175,0 +184,0 @@ prototype: { value: CompartmentPrototype },

@@ -1,2 +0,2 @@

import { toStringTagSymbol } from './commons.js';
import { toStringTagSymbol, iteratorSymbol } from './commons.js';

@@ -100,2 +100,4 @@ /**

push: true, // set by "Google Analytics"
concat: true, // set by mobx generated code (old TS compiler?)
[iteratorSymbol]: true, // set by mobx generated code (old TS compiler?)
},

@@ -102,0 +104,0 @@

@@ -5,2 +5,3 @@ // @ts-check

import { makeLRUCacheMap } from '../make-lru-cachemap.js';
import './internal-types.js';

@@ -11,207 +12,2 @@

/**
* @template Data
* @typedef {object} DoublyLinkedCell
* A cell of a doubly-linked ring, i.e., a doubly-linked circular list.
* DoublyLinkedCells are not frozen, and so should be closely encapsulated by
* any abstraction that uses them.
* @property {DoublyLinkedCell<Data>} next
* @property {DoublyLinkedCell<Data>} prev
* @property {Data} data
*/
/**
* Makes a new self-linked cell. There are two reasons to do so:
* * To make the head sigil of a new initially-empty doubly-linked ring.
* * To make a non-sigil cell to be `spliceAfter`ed.
*
* @template Data
* @param {Data} data
* @returns {DoublyLinkedCell<Data>}
*/
const makeSelfCell = data => {
/** @type {Partial<DoublyLinkedCell<Data>>} */
const incompleteCell = {
next: undefined,
prev: undefined,
data,
};
const selfCell = /** @type {DoublyLinkedCell<Data>} */ (incompleteCell);
selfCell.next = selfCell;
selfCell.prev = selfCell;
// Not frozen!
return selfCell;
};
/**
* Splices a self-linked non-sigil cell into a ring after `prev`.
* `prev` could be the head sigil, or it could be some other non-sigil
* cell within a ring.
*
* @template Data
* @param {DoublyLinkedCell<Data>} prev
* @param {DoublyLinkedCell<Data>} selfCell
*/
const spliceAfter = (prev, selfCell) => {
if (prev === selfCell) {
throw TypeError('Cannot splice a cell into itself');
}
if (selfCell.next !== selfCell || selfCell.prev !== selfCell) {
throw TypeError('Expected self-linked cell');
}
const cell = selfCell;
// rename variable cause it isn't self-linked after this point.
const next = prev.next;
cell.prev = prev;
cell.next = next;
prev.next = cell;
next.prev = cell;
// Not frozen!
return cell;
};
/**
* @template Data
* @param {DoublyLinkedCell<Data>} cell
* No-op if the cell is self-linked.
*/
const spliceOut = cell => {
const { prev, next } = cell;
prev.next = next;
next.prev = prev;
cell.prev = cell;
cell.next = cell;
};
/**
* The LRUCacheMap is used within the implementation of `assert` and so
* at a layer below SES or harden. Thus, we give it a `WeakMap`-like interface
* rather than a `WeakMapStore`-like interface. To work before `lockdown`,
* the implementation must use `freeze` manually, but still exhaustively.
*
* It implements the WeakMap interface, and holds its keys weakly. Cached
* values are only held while the key is held by the user and the key/value
* bookkeeping cell has not been pushed off the end of the cache by `budget`
* number of more recently referenced cells. If the key is dropped by the user,
* the value will no longer be held by the cache, but the bookkeeping cell
* itself will stay in memory.
*
* @template {{}} K
* @template {unknown} V
* @param {number} keysBudget
* @returns {WeakMap<K,V>}
*/
export const makeLRUCacheMap = keysBudget => {
if (!isSafeInteger(keysBudget) || keysBudget < 0) {
throw TypeError('keysBudget must be a safe non-negative integer number');
}
/** @typedef {DoublyLinkedCell<WeakMap<K, V> | undefined>} LRUCacheCell */
/** @type {WeakMap<K, LRUCacheCell>} */
const keyToCell = new WeakMap();
let size = 0; // `size` must remain <= `keysBudget`
// As a sigil, `head` uniquely is not in the `keyToCell` map.
/** @type {LRUCacheCell} */
const head = makeSelfCell(undefined);
const touchCell = key => {
const cell = keyToCell.get(key);
if (cell === undefined || cell.data === undefined) {
// Either the key was GCed, or the cell was condemned.
return undefined;
}
// Becomes most recently used
spliceOut(cell);
spliceAfter(head, cell);
return cell;
};
/**
* @param {K} key
*/
const has = key => touchCell(key) !== undefined;
freeze(has);
/**
* @param {K} key
*/
// UNTIL https://github.com/endojs/endo/issues/1514
// Prefer: const get = key => touchCell(key)?.data?.get(key);
const get = key => {
const cell = touchCell(key);
return cell && cell.data && cell.data.get(key);
};
freeze(get);
/**
* @param {K} key
* @param {V} value
*/
const set = (key, value) => {
if (keysBudget < 1) {
// eslint-disable-next-line no-use-before-define
return lruCacheMap; // Implements WeakMap.set
}
let cell = touchCell(key);
if (cell === undefined) {
cell = makeSelfCell(undefined);
spliceAfter(head, cell); // start most recently used
}
if (!cell.data) {
// Either a fresh cell or a reused condemned cell.
size += 1;
// Add its data.
cell.data = new WeakMap();
// Advertise the cell for this key.
keyToCell.set(key, cell);
while (size > keysBudget) {
const condemned = head.prev;
spliceOut(condemned); // Drop least recently used
condemned.data = undefined;
size -= 1;
}
}
// Update the data.
cell.data.set(key, value);
// eslint-disable-next-line no-use-before-define
return lruCacheMap; // Implements WeakMap.set
};
freeze(set);
// "delete" is a keyword.
/**
* @param {K} key
*/
const deleteIt = key => {
const cell = keyToCell.get(key);
if (cell === undefined) {
return false;
}
spliceOut(cell);
keyToCell.delete(key);
if (cell.data === undefined) {
// Already condemned.
return false;
}
cell.data = undefined;
size -= 1;
return true;
};
freeze(deleteIt);
const lruCacheMap = freeze({
has,
get,
set,
delete: deleteIt,
[Symbol.toStringTag]: 'LRUCacheMap',
});
return lruCacheMap;
};
freeze(makeLRUCacheMap);
const defaultLoggedErrorsBudget = 1000;

@@ -218,0 +14,0 @@ const defaultArgsPerErrorBudget = 100;

@@ -61,10 +61,10 @@ // @ts-check

: typeof globalThis.print === 'function'
? // Make a good-enough console for eshost (including only functions that
// log at a specific level with no special argument interpretation).
// https://console.spec.whatwg.org/#logging
(p => freeze({ debug: p, log: p, info: p, warn: p, error: p }))(
// eslint-disable-next-line no-undef
wrapLogger(globalThis.print),
)
: undefined
? // Make a good-enough console for eshost (including only functions that
// log at a specific level with no special argument interpretation).
// https://console.spec.whatwg.org/#logging
(p => freeze({ debug: p, log: p, info: p, warn: p, error: p }))(
// eslint-disable-next-line no-undef
wrapLogger(globalThis.print),
)
: undefined
);

@@ -71,0 +71,0 @@

@@ -56,2 +56,4 @@ /* eslint-disable no-restricted-globals */

EvalError: 'EvalError',
// https://github.com/tc39/proposal-float16array
Float16Array: 'Float16Array',
Float32Array: 'Float32Array',

@@ -386,2 +388,4 @@ Float64Array: 'Float64Array',

mod: false,
// See https://github.com/Moddable-OpenSource/moddable/issues/523#issuecomment-1942904505
irandom: false,
};

@@ -448,2 +452,4 @@

groupBy: fn,
// Seen on QuickJS
__getClass: false,
},

@@ -495,2 +501,6 @@

arguments: false,
// Seen on QuickJS. TODO grab getter for use by console
fileName: false,
// Seen on QuickJS. TODO grab getter for use by console
lineNumber: false,
},

@@ -535,2 +545,4 @@

useSetter: false,
// Seen on QuickJS
operatorSet: false,
},

@@ -646,2 +658,26 @@

fromArrayBuffer: false,
// Seen on QuickJS
tdiv: false,
// Seen on QuickJS
fdiv: false,
// Seen on QuickJS
cdiv: false,
// Seen on QuickJS
ediv: false,
// Seen on QuickJS
tdivrem: false,
// Seen on QuickJS
fdivrem: false,
// Seen on QuickJS
cdivrem: false,
// Seen on QuickJS
edivrem: false,
// Seen on QuickJS
sqrt: false,
// Seen on QuickJS
sqrtrem: false,
// Seen on QuickJS
floorLog2: false,
// Seen on QuickJS
ctz: false,
},

@@ -815,2 +851,4 @@

unicodeSets: fn,
// Seen on QuickJS
__quote: false,
},

@@ -1055,2 +1093,4 @@

BigUint64Array: TypedArray('%BigUint64ArrayPrototype%'),
// https://github.com/tc39/proposal-float16array
Float16Array: TypedArray('%Float16ArrayPrototype%'),
Float32Array: TypedArray('%Float32ArrayPrototype%'),

@@ -1068,2 +1108,4 @@ Float64Array: TypedArray('%Float64ArrayPrototype%'),

'%BigUint64ArrayPrototype%': TypedArrayPrototype('BigUint64Array'),
// https://github.com/tc39/proposal-float16array
'%Float16ArrayPrototype%': TypedArrayPrototype('Float16Array'),
'%Float32ArrayPrototype%': TypedArrayPrototype('Float32Array'),

@@ -1118,2 +1160,4 @@ '%Float64ArrayPrototype%': TypedArrayPrototype('Float64Array'),

'@@species': getter,
// Seen on QuickJS
groupBy: false,
},

@@ -1235,2 +1279,4 @@

getBigUint64: fn,
// https://github.com/tc39/proposal-float16array
getFloat16: fn,
getFloat32: fn,

@@ -1246,2 +1292,4 @@ getFloat64: fn,

setBigUint64: fn,
// https://github.com/tc39/proposal-float16array
setFloat16: fn,
setFloat32: fn,

@@ -1299,2 +1347,4 @@ setFloat64: fn,

toAsync: fn,
// See https://github.com/Moddable-OpenSource/moddable/issues/523#issuecomment-1942904505
'@@dispose': false,
},

@@ -1342,2 +1392,4 @@

'@@toStringTag': 'string',
// See https://github.com/Moddable-OpenSource/moddable/issues/523#issuecomment-1942904505
'@@asyncDispose': false,
},

@@ -1533,4 +1585,2 @@

name: getter,
// Should this be proposed?
toString: fn,
import: asyncFn,

@@ -1540,2 +1590,3 @@ load: asyncFn,

module: fn,
'@@toStringTag': 'string',
},

@@ -1542,0 +1593,0 @@

Sorry, the diff of this file is not supported yet

Sorry, the diff of this file is not supported yet

Sorry, the diff of this file is too big to display

Sorry, the diff of this file is too big to display

Sorry, the diff of this file is not supported yet

Sorry, the diff of this file is not supported yet

Sorry, the diff of this file is too big to display

Sorry, the diff of this file is too big to display

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc