Mirror: A maybe slightly safer-ish wrapper around eval Function constructors

Use Function constructor from iframe global object

Changed files
+8 -2
src
+8 -2
src/index.ts
···
}
let safeGlobal: Record<string | symbol, unknown> | void;
function makeSafeGlobal() {
if (safeGlobal) {
···
// When we're in the browser, we can go a step further and try to create a
// new JS context and globals in a separate iframe
-
let vmGlobals = trueGlobal;
let iframe: HTMLIFrameElement | void;
if (typeof document !== 'undefined') {
try {
···
const safeGlobal = makeSafeGlobal();
const code = args.pop();
// We pass in our safe global and use it using `with` (ikr...)
// We then add a wrapper function for strict-mode and a few closing
// statements to prevent the code from escaping the `with` block;
-
const fn = new Function(
'globalThis',
...args,
'with (globalThis) {\n"use strict";\nreturn (function () {\n' +
···
}
let safeGlobal: Record<string | symbol, unknown> | void;
+
let vmGlobals: Record<string | symbol, unknown> = {};
function makeSafeGlobal() {
if (safeGlobal) {
···
// When we're in the browser, we can go a step further and try to create a
// new JS context and globals in a separate iframe
+
vmGlobals = trueGlobal;
let iframe: HTMLIFrameElement | void;
if (typeof document !== 'undefined') {
try {
···
const safeGlobal = makeSafeGlobal();
const code = args.pop();
+
// Retrieve Function constructor from vm globals
+
const Function = vmGlobals.Function as FunctionConstructor | void;
+
const Object = vmGlobals.Object as ObjectConstructor;
+
const createFunction = (Function || Object.constructor.constructor) as FunctionConstructor;
+
// We pass in our safe global and use it using `with` (ikr...)
// We then add a wrapper function for strict-mode and a few closing
// statements to prevent the code from escaping the `with` block;
+
const fn = createFunction(
'globalThis',
...args,
'with (globalThis) {\n"use strict";\nreturn (function () {\n' +