vm2 - npm Package Compare versions

Comparing version 3.9.9 to 3.9.10

CHANGELOG.md

@@ -0,1 +1,7 @@
+v3.9.10 (2022-07-05)
+-------------------
+[new] Add uptime to process.  
+[fix] Security fix.  
+[fix] Fix inspection with showProxy.
+
 v3.9.9 (2022-02-24)
@@ -2,0 +8,0 @@ -------------------

lib/bridge.js

@@ -105,2 +105,4 @@ 'use strict';
 const thisSymbolToStringTag = Symbol.toStringTag;
+const thisSymbolIterator = Symbol.iterator;
+const thisSymbolNodeJSUtilInspectCustom = Symbol.for('nodejs.util.inspect.custom');
 
@@ -352,5 +354,9 @@ /**
 			super();
-			this.object = object;
+			this.objectWrapper = () => object;
 		}
 
+		getObject() {
+			return this.objectWrapper();
+		}
+
 		getFactory() {
@@ -413,3 +419,3 @@ return defaultFactory;
 			// Note: target@this(unsafe) key@prim receiver@this(unsafe) throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			switch (key) {
@@ -453,3 +459,3 @@ case 'constructor': {
 			// Note: target@this(unsafe) key@prim value@this(unsafe) receiver@this(unsafe) throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			if (key === '__proto__' && !thisOtherHasOwnProperty(object, key)) {
@@ -478,3 +484,3 @@ return this.setPrototypeOf(target, value);
 			// Note: target@this(unsafe) context@this(unsafe) args@this(safe-array) throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			let ret; // @other(unsafe)
@@ -493,3 +499,3 @@ try {
 			// Note: target@this(unsafe) args@this(safe-array) newTarget@this(unsafe) throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			let ret; // @other(unsafe)
@@ -507,3 +513,3 @@ try {
 			// Note: target@this(unsafe) prop@prim desc@other{safe} throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			if (desc && typeof object === 'function' && (prop === 'arguments' || prop === 'caller' || prop === 'callee')) desc.value = null;
@@ -515,3 +521,3 @@ return desc;
 			// Note: target@this(unsafe) prop@prim throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			let desc; // @other(safe)
@@ -562,3 +568,3 @@ try {
 			// Note: target@this(unsafe) prop@prim desc@this(unsafe) throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			if (!thisReflectSetPrototypeOf(desc, null)) throw thisUnexpected();
@@ -616,3 +622,3 @@
 			// Note: target@this(unsafe) prop@prim throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			try {
@@ -627,3 +633,3 @@ return otherReflectDeleteProperty(object, prop) === true;
 			// Note: target@this(unsafe) key@prim throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			try {
@@ -638,3 +644,3 @@ return otherReflectHas(object, key) === true;
 			// Note: target@this(unsafe) throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			try {
@@ -653,3 +659,3 @@ if (otherReflectIsExtensible(object)) return true;
 			// Note: target@this(unsafe) throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			let res; // @other(unsafe)
@@ -666,3 +672,3 @@ try {
 			// Note: target@this(unsafe) throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			try {
@@ -681,3 +687,3 @@ if (!otherReflectPreventExtensions(object)) return false;
 			// Note: target@this(unsafe) throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			let res; // @other(unsafe)
@@ -694,2 +700,6 @@ try {
 
+	BaseHandler.prototype[thisSymbolNodeJSUtilInspectCustom] = undefined;
+	BaseHandler.prototype[thisSymbolToStringTag] = 'VM2 Wrapper';
+	BaseHandler.prototype[thisSymbolIterator] = undefined;
+
 	function defaultFactory(object) {
@@ -792,3 +802,3 @@ // Note: other@other(unsafe) returns@this(unsafe) throws@this(unsafe)
 			// Note: target@this(unsafe) key@prim receiver@this(unsafe) throws@this(unsafe)
-			const object = this.object; // @other(unsafe)
+			const object = this.getObject(); // @other(unsafe)
 			const mock = this.mock;
@@ -795,0 +805,0 @@ if (thisReflectApply(thisObjectHasOwnProperty, mock, key) && !thisOtherHasOwnProperty(object, key)) {

lib/setup-node-sandbox.js

@@ -333,2 +333,4 @@ /* global host, data, VMError */
 
+const baseUptime = localProcess.uptime();
+
 // FIXME wrong class structure
@@ -358,2 +360,5 @@ global.process = {
 	},
+	uptime: function uptime() {
+		return localProcess.uptime() - baseUptime;
+	},
 	cwd: function cwd() {
@@ -360,0 +365,0 @@ return localProcess.cwd();

lib/setup-sandbox.js

@@ -54,3 +54,6 @@ /* global host, bridge, data, context */
 
-const localWeakMapGet = LocalWeakMap.prototype.get;
+const {
+	get: localWeakMapGet,
+	set: localWeakMapSet
+} = LocalWeakMap.prototype;
 
@@ -286,4 +289,4 @@ function localUnexpected() {
 			};
-			wrappedPrepareStackTrace.set(value, newWrapped);
-			wrappedPrepareStackTrace.set(newWrapped, newWrapped);
+			localReflectApply(localWeakMapSet, wrappedPrepareStackTrace, [value, newWrapped]);
+			localReflectApply(localWeakMapSet, wrappedPrepareStackTrace, [newWrapped, newWrapped]);
 			currentPrepareStackTrace = newWrapped;
@@ -290,0 +293,0 @@ }

lib/transformer.js

@@ -54,2 +54,6 @@
 		code = body;
+		// Note: Keywords are not allows to contain u escapes
+		if (!/\b(?:catch|import|async)\b/.test(code)) {
+			return {__proto__: null, code, hasAsync: false};
+		}
 	} else {
@@ -56,0 +60,0 @@ code = isAsync ? '(async function' : '(function';

package.json

@@ -16,3 +16,3 @@ {
   ],
-  "version": "3.9.9",
+  "version": "3.9.10",
   "main": "index.js",
@@ -19,0 +19,0 @@ "sideEffects": false,

README.md

@@ -141,3 +141,3 @@ # vm2 [![NPM Version][npm-image]][npm-url] [![NPM Downloads][downloads-image]][downloads-url] [![Package Quality][quality-image]][quality-url] [![Node.js CI](https://github.com/patriksimek/vm2/actions/workflows/node-test.yml/badge.svg)](https://github.com/patriksimek/vm2/actions/workflows/node-test.yml) [![Known Vulnerabilities][snyk-image]][snyk-url]
 * `require.external.transitive` - Boolean which indicates if transitive dependencies of external modules are allowed (default: `false`). **WARNING**: When a module is required transitively, any module is then able to require it normally, even if this was not possible before it was loaded.
-* `require.builtin` - Array of allowed built-in modules, accepts ["*"] for all (default: none). **WARNING**: "*" can be dangerous as new built-ins can be added.
+* `require.builtin` - Array of allowed built-in modules, accepts ["\*"] for all (default: none). **WARNING**: "\*" can be dangerous as new built-ins can be added.
 * `require.root` - Restricted path(s) where local modules can be required (default: every path).
@@ -144,0 +144,0 @@ * `require.mock` - Collection of mock modules (both external or built-in).

No alert changes

Improved metrics

Total package byte prevSize

206989

increased by0.47%

Lines of code

5431

increased by0.35%

No dependency changes