ses - npm Package Compare versions

Comparing version 2.1.0 to 2.2.0

src/tame-temporal-object.js

+import {
+  freeze,
+  getOwnPropertyDescriptors,
+  create,
+  objectPrototype,
+  getPrototypeOf,
+  ownKeys,
+  fromEntries,
+  TypeError,
+  arrayPush,
+  Temporal, // may be undefined on old JS engines
+} from './commons.js';
+
+import { permitted } from './permits.js';
+
+/**
+ * Tame the `Temporal` namespace object.
+ *
+ * The `%InitialTemporal%` is indeed the original `Temporal` namespace
+ * object, to remain present on the start compartment.
+ *
+ * The `%SharedTemporal%` is the safe shared `Temporal` namespace object,
+ * to be endowed by default on the gloabl of all constructed compartments.
+ * This differs only by the omission of `Temporal.Now`, which is the source of
+ * the dynamic non-determinism of the ever-changing current time, and the
+ * glacial dynamic non-determinism of current timezone and UTC offset (daylight
+ * savings time).
+ *
+ * The remaining source of glacial dynamic non-determinism is locale
+ * sensitivity, which `Temporal` provides only via `toLocaleString` methods.
+ * This is handled by `tame-locale-methods.js` in the same way as all other
+ * `*Locale*` methods.
+ *
+ * `tameTemporalObject` is modeletd on `tameMathObject` and `tameDateConstructor`
+ */
+const tameTemporalObject = () => {
+  if (Temporal === undefined) {
+    return {};
+  }
+
+  if (typeof Temporal !== 'object') {
+    throw new TypeError(`unexpected typeof Temporal: ${typeof Temporal}`);
+  }
+  if (getPrototypeOf(Temporal) !== objectPrototype) {
+    throw new TypeError(
+      `unexpected Temporal __proto__: ${getPrototypeOf(Temporal)}`,
+    );
+  }
+
+  const initialTemporal = Temporal;
+  const { Now: _, ...otherDescriptors } =
+    getOwnPropertyDescriptors(initialTemporal);
+  const sharedTemporal = create(objectPrototype, otherDescriptors);
+
+  const initialTemporalPermit = permitted['%InitialTemporal%'];
+  const intrinsicEntries = [];
+  for (const topName of ownKeys(Temporal)) {
+    const topPermitName = initialTemporalPermit[topName];
+    const topPermit = permitted[topPermitName];
+    if (typeof topPermit === 'object') {
+      const topVal = initialTemporal[topName];
+      arrayPush(intrinsicEntries, [topPermitName, topVal]);
+    }
+  }
+
+  const result = {
+    ...fromEntries(intrinsicEntries),
+    '%InitialTemporal%': initialTemporal,
+    '%SharedTemporal%': sharedTemporal,
+  };
+  return result;
+};
+freeze(tameTemporalObject);
+
+export default tameTemporalObject;

dist/types.d.cts

@@ -135,2 +135,6 @@ /**
 
+export type StrictModuleDescriptor =
+  | SourceModuleDescriptor
+  | NamespaceModuleDescriptor;
+
 // Deprecated type aliases:
@@ -137,0 +141,0 @@ export type PrecompiledStaticModuleInterface = PrecompiledModuleSource;

package.json

 {
   "name": "ses",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Hardened JavaScript for Fearless Cooperation",
@@ -5,0 +5,0 @@ "keywords": [

src/commons.js

@@ -48,2 +48,3 @@ /**
   WeakSet,
+  Temporal, // may be undefined on old JS engines
 } = globalThis;
@@ -50,0 +51,0 @@

src/compartment.js

@@ -338,5 +338,5 @@ /**
   /**
-   * @param {...CompartmentOptionsArgs|LegacyCompartmentOptionsArgs} args
+   * @this {Compartment}
+   * @param {CompartmentOptionsArgs|LegacyCompartmentOptionsArgs} args
    */
-  /** @this {Compartment} */
   function Compartment(...args) {
@@ -343,0 +343,0 @@ if (enforceNew && new.target === undefined) {

src/lockdown.js

@@ -39,2 +39,3 @@ // Copyright (C) 2018 Agoric
 import tameMathObject from './tame-math-object.js';
+import tameTemporalObject from './tame-temporal-object.js';
 import { tameNaNSideChannel } from './tame-nan-sidechannel.js';
@@ -358,2 +359,3 @@ import tameRegExpConstructor from './tame-regexp-constructor.js';
   addIntrinsics(tameMathObject());
+  addIntrinsics(tameTemporalObject());
   tameNaNSideChannel();
@@ -360,0 +362,0 @@ addIntrinsics(tameRegExpConstructor(regExpTaming));

src/permits-intrinsics.js

@@ -181,30 +181,22 @@ // Copyright (C) 2011 Google Inc.
 
-      if (prop === 'prototype' || prop === 'constructor') {
-        // For prototype and constructor value properties, the permit
-        // is the name of an intrinsic.
-        // Assumption: prototype and constructor cannot be primitives.
-        // Assert: the permit is the name of an intrinsic.
-        // Assert: the property value is equal to that intrinsic.
+      if (arrayIncludes(primitives, permit)) {
+        // The permit is the name of a primitive.
 
-        if (hasOwn(intrinsics, permit)) {
-          if (value !== intrinsics[permit]) {
-            throw TypeError(`Does not match permit for ${path}`);
-          }
-          return true;
+        if (prop === 'prototype' || prop === 'constructor') {
+          throw new TypeError(`At ${path} expected intrinsic, not ${permit}`);
         }
-      } else {
-        // For all other properties, the permit is the name of a primitive.
-        // Assert: the permit is the name of a primitive.
-        // Assert: the property value type is equal to that primitive.
+        // eslint wants to compare typeof only to string literals
+        // eslint-disable-next-line valid-typeof
+        if (typeof value !== permit) {
+          throw TypeError(`At ${path} expected ${permit} not ${typeof value}`);
+        }
+        return true;
+      }
 
-        // eslint-disable-next-line no-lonely-if
-        if (arrayIncludes(primitives, permit)) {
-          // eslint-disable-next-line valid-typeof
-          if (typeof value !== permit) {
-            throw TypeError(
-              `At ${path} expected ${permit} not ${typeof value}`,
-            );
-          }
-          return true;
+      if (hasOwn(intrinsics, permit)) {
+        // the permit is the name of an intrinsic.
+        if (value !== intrinsics[permit]) {
+          throw TypeError(`Does not match permit for ${path}`);
         }
+        return true;
       }
@@ -211,0 +203,0 @@ }

src/permits.js

@@ -143,2 +143,3 @@ /* eslint-disable no-restricted-globals */
   Math: '%InitialMath%',
+  Temporal: '%InitialTemporal%',
 
@@ -190,2 +191,3 @@ // We move these from universalPropertyNames because the NaN side channel
   Math: '%SharedMath%',
+  Temporal: '%SharedTemporal%',
 
@@ -871,3 +873,3 @@ // TODO Temporal
 
-    toTemporalInstant: false,
+    toTemporalInstant: fn,
   },
@@ -1747,2 +1749,342 @@
 
+  '%Temporal.PlainDatePrototype%': {
+    constructor: '%Temporal.PlainDate%',
+    era: accessor,
+    eraYear: accessor,
+    calendarId: accessor,
+    year: accessor,
+    month: accessor,
+    monthCode: accessor,
+    day: accessor,
+    dayOfWeek: accessor,
+    dayOfYear: accessor,
+    weekOfYear: accessor,
+    yearOfWeek: accessor,
+    daysInWeek: accessor,
+    daysInMonth: accessor,
+    daysInYear: accessor,
+    monthsInYear: accessor,
+    inLeapYear: accessor,
+    toPlainYearMonth: fn,
+    toPlainMonthDay: fn,
+    add: fn,
+    subtract: fn,
+    with: fn,
+    withCalendar: fn,
+    until: fn,
+    since: fn,
+    equals: fn,
+    toPlainDateTime: fn,
+    toZonedDateTime: fn,
+    toString: fn,
+    toLocaleString: fn,
+    toJSON: fn,
+    valueOf: fn,
+    '@@toStringTag': 'string',
+  },
+  '%Temporal.PlainDate%': {
+    '[[Proto]]': '%FunctionPrototype%',
+    length: 'number',
+    name: 'string',
+    prototype: '%Temporal.PlainDatePrototype%',
+    from: fn,
+    compare: fn,
+  },
+
+  '%Temporal.PlainTimePrototype%': {
+    constructor: '%Temporal.PlainTime%',
+    hour: accessor,
+    minute: accessor,
+    second: accessor,
+    millisecond: accessor,
+    microsecond: accessor,
+    nanosecond: accessor,
+    add: fn,
+    subtract: fn,
+    with: fn,
+    until: fn,
+    since: fn,
+    round: fn,
+    equals: fn,
+    toLocaleString: fn,
+    toString: fn,
+    toJSON: fn,
+    valueOf: fn,
+    '@@toStringTag': 'string',
+  },
+  '%Temporal.PlainTime%': {
+    '[[Proto]]': '%FunctionPrototype%',
+    length: 'number',
+    name: 'string',
+    prototype: '%Temporal.PlainTimePrototype%',
+    from: fn,
+    compare: fn,
+  },
+
+  '%Temporal.PlainDateTimePrototype%': {
+    constructor: '%Temporal.PlainDateTime%',
+    calendarId: accessor,
+    era: accessor,
+    eraYear: accessor,
+    year: accessor,
+    month: accessor,
+    monthCode: accessor,
+    day: accessor,
+    hour: accessor,
+    minute: accessor,
+    second: accessor,
+    millisecond: accessor,
+    microsecond: accessor,
+    nanosecond: accessor,
+    dayOfWeek: accessor,
+    dayOfYear: accessor,
+    weekOfYear: accessor,
+    yearOfWeek: accessor,
+    daysInWeek: accessor,
+    daysInMonth: accessor,
+    daysInYear: accessor,
+    monthsInYear: accessor,
+    inLeapYear: accessor,
+    with: fn,
+    withCalendar: fn,
+    withPlainTime: fn,
+    add: fn,
+    subtract: fn,
+    until: fn,
+    since: fn,
+    round: fn,
+    equals: fn,
+    toLocaleString: fn,
+    toJSON: fn,
+    toString: fn,
+    valueOf: fn,
+    toZonedDateTime: fn,
+    toPlainDate: fn,
+    toPlainTime: fn,
+    '@@toStringTag': 'string',
+  },
+  '%Temporal.PlainDateTime%': {
+    '[[Proto]]': '%FunctionPrototype%',
+    length: 'number',
+    name: 'string',
+    prototype: '%Temporal.PlainDateTimePrototype%',
+    from: fn,
+    compare: fn,
+  },
+
+  '%Temporal.ZonedDateTimePrototype%': {
+    constructor: '%Temporal.ZonedDateTime%',
+    timeZoneId: accessor,
+    calendarId: accessor,
+    era: accessor,
+    eraYear: accessor,
+    year: accessor,
+    month: accessor,
+    monthCode: accessor,
+    day: accessor,
+    hour: accessor,
+    minute: accessor,
+    second: accessor,
+    millisecond: accessor,
+    microsecond: accessor,
+    nanosecond: accessor,
+    epochMilliseconds: accessor,
+    epochNanoseconds: accessor,
+    dayOfWeek: accessor,
+    dayOfYear: accessor,
+    weekOfYear: accessor,
+    yearOfWeek: accessor,
+    hoursInDay: accessor,
+    daysInWeek: accessor,
+    daysInMonth: accessor,
+    daysInYear: accessor,
+    monthsInYear: accessor,
+    inLeapYear: accessor,
+    offsetNanoseconds: accessor,
+    offset: accessor,
+    with: fn,
+    withCalendar: fn,
+    withPlainTime: fn,
+    withTimeZone: fn,
+    add: fn,
+    subtract: fn,
+    until: fn,
+    since: fn,
+    round: fn,
+    equals: fn,
+    toLocaleString: fn,
+    toString: fn,
+    toJSON: fn,
+    valueOf: fn,
+    startOfDay: fn,
+    getTimeZoneTransition: fn,
+    toInstant: fn,
+    toPlainDate: fn,
+    toPlainTime: fn,
+    toPlainDateTime: fn,
+    '@@toStringTag': 'string',
+  },
+  '%Temporal.ZonedDateTime%': {
+    '[[Proto]]': '%FunctionPrototype%',
+    length: 'number',
+    name: 'string',
+    prototype: '%Temporal.ZonedDateTimePrototype%',
+    from: fn,
+    compare: fn,
+  },
+
+  '%Temporal.DurationPrototype%': {
+    constructor: '%Temporal.Duration%',
+    years: accessor,
+    months: accessor,
+    weeks: accessor,
+    days: accessor,
+    hours: accessor,
+    minutes: accessor,
+    seconds: accessor,
+    milliseconds: accessor,
+    microseconds: accessor,
+    nanoseconds: accessor,
+    sign: accessor,
+    blank: accessor,
+    with: fn,
+    negated: fn,
+    abs: fn,
+    add: fn,
+    subtract: fn,
+    round: fn,
+    total: fn,
+    toLocaleString: fn,
+    toString: fn,
+    toJSON: fn,
+    valueOf: fn,
+    '@@toStringTag': 'string',
+  },
+  '%Temporal.Duration%': {
+    '[[Proto]]': '%FunctionPrototype%',
+    length: 'number',
+    name: 'string',
+    prototype: '%Temporal.DurationPrototype%',
+    from: fn,
+    compare: fn,
+  },
+
+  '%Temporal.InstantPrototype%': {
+    constructor: '%Temporal.Instant%',
+    epochMilliseconds: accessor,
+    epochNanoseconds: accessor,
+    add: fn,
+    subtract: fn,
+    until: fn,
+    since: fn,
+    round: fn,
+    equals: fn,
+    toLocaleString: fn,
+    toString: fn,
+    toJSON: fn,
+    valueOf: fn,
+    toZonedDateTimeISO: fn,
+    '@@toStringTag': 'string',
+  },
+  '%Temporal.Instant%': {
+    '[[Proto]]': '%FunctionPrototype%',
+    length: 'number',
+    name: 'string',
+    prototype: '%Temporal.InstantPrototype%',
+    from: fn,
+    fromEpochMilliseconds: fn,
+    fromEpochNanoseconds: fn,
+    compare: fn,
+  },
+
+  '%Temporal.PlainYearMonthPrototype%': {
+    constructor: '%Temporal.PlainYearMonth%',
+    calendarId: accessor,
+    era: accessor,
+    eraYear: accessor,
+    year: accessor,
+    month: accessor,
+    monthCode: accessor,
+    daysInYear: accessor,
+    daysInMonth: accessor,
+    monthsInYear: accessor,
+    inLeapYear: accessor,
+    with: fn,
+    add: fn,
+    subtract: fn,
+    until: fn,
+    since: fn,
+    equals: fn,
+    toLocaleString: fn,
+    toString: fn,
+    toJSON: fn,
+    valueOf: fn,
+    toPlainDate: fn,
+    '@@toStringTag': 'string',
+  },
+  '%Temporal.PlainYearMonth%': {
+    '[[Proto]]': '%FunctionPrototype%',
+    length: 'number',
+    name: 'string',
+    prototype: '%Temporal.PlainYearMonthPrototype%',
+    from: fn,
+    compare: fn,
+  },
+
+  '%Temporal.PlainMonthDayPrototype%': {
+    constructor: '%Temporal.PlainMonthDay%',
+    calendarId: accessor,
+    monthCode: accessor,
+    day: accessor,
+    with: fn,
+    equals: fn,
+    toLocaleString: fn,
+    toString: fn,
+    toJSON: fn,
+    valueOf: fn,
+    toPlainDate: fn,
+    '@@toStringTag': 'string',
+  },
+  '%Temporal.PlainMonthDay%': {
+    '[[Proto]]': '%FunctionPrototype%',
+    length: 'number',
+    name: 'string',
+    prototype: '%Temporal.PlainMonthDayPrototype%',
+    from: fn,
+  },
+
+  '%Temporal.Now%': {
+    instant: fn,
+    timeZoneId: fn,
+    plainDateTimeISO: fn,
+    zonedDateTimeISO: fn,
+    plainDateISO: fn,
+    plainTimeISO: fn,
+    '@@toStringTag': 'string',
+  },
+
+  '%InitialTemporal%': {
+    Now: '%Temporal.Now%',
+    PlainDate: '%Temporal.PlainDate%',
+    PlainTime: '%Temporal.PlainTime%',
+    PlainDateTime: '%Temporal.PlainDateTime%',
+    ZonedDateTime: '%Temporal.ZonedDateTime%',
+    Duration: '%Temporal.Duration%',
+    Instant: '%Temporal.Instant%',
+    PlainYearMonth: '%Temporal.PlainYearMonth%',
+    PlainMonthDay: '%Temporal.PlainMonthDay%',
+    '@@toStringTag': 'string',
+  },
+  '%SharedTemporal%': {
+    PlainDate: '%Temporal.PlainDate%',
+    PlainTime: '%Temporal.PlainTime%',
+    PlainDateTime: '%Temporal.PlainDateTime%',
+    ZonedDateTime: '%Temporal.ZonedDateTime%',
+    Duration: '%Temporal.Duration%',
+    Instant: '%Temporal.Instant%',
+    PlainYearMonth: '%Temporal.PlainYearMonth%',
+    PlainMonthDay: '%Temporal.PlainMonthDay%',
+    '@@toStringTag': 'string',
+  },
+
   // Appendix B
@@ -1749,0 +2091,0 @@

src/tame-nan-sidechannel.js

@@ -49,3 +49,3 @@ import {
  */
-const canonicalNaN64Encoding = 0x7ff8000000000000n;
+const canonicalNaN64Encoding = 0x7ff8_0000_0000_0000n;
 
@@ -67,3 +67,3 @@ /**
  */
-const canonicalNaN32Encoding = 0x7fc00000;
+const canonicalNaN32Encoding = 0x7fc0_0000;
 
@@ -70,0 +70,0 @@ /**

types.d.ts

@@ -135,2 +135,6 @@ /**
 
+export type StrictModuleDescriptor =
+  | SourceModuleDescriptor
+  | NamespaceModuleDescriptor;
+
 // Deprecated type aliases:
@@ -137,0 +141,0 @@ export type PrecompiledStaticModuleInterface = PrecompiledModuleSource;

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

4540830

2.39%

Number of package files

91

1.11%

Lines of code

104382

3.22%

Worsened metrics

Number of low supply chain risk alerts

2

100%

Number of medium supply chain risk alerts

17

6.25%

No dependency changes