comparing v0.1.2 and main on kitten.sh/evalish

+26

.github/workflows/mirror.yml

···

       1
       +
       # Mirrors to https://tangled.sh/@kitten.sh (knot.kitten.sh)

     

       2
       +
       name: Mirror (Git Backup)

     

       3
       +
       on:

     

       4
       +
         push:

     

       5
       +
           branches:

     

       6
       +
             - main

     

       7
       +
       jobs:

     

       8
       +
         mirror:

     

       9
       +
           runs-on: ubuntu-latest

     

       10
       +
           steps:

     

       11
       +
             - name: Checkout repository

     

       12
       +
               uses: actions/checkout@v4

     

       13
       +
               with:

     

       14
       +
                 fetch-depth: 0

     

       15
       +
                 fetch-tags: true

     

       16
       +
             - name: Mirror

     

       17
       +
               env:

     

       18
       +
                 MIRROR_SSH_KEY: ${{ secrets.MIRROR_SSH_KEY }}

     

       19
       +
                 GIT_SSH_COMMAND: 'ssh -o StrictHostKeyChecking=yes'

     

       20
       +
               run: |

     

       21
       +
                 mkdir -p ~/.ssh

     

       22
       +
                 echo "$MIRROR_SSH_KEY" > ~/.ssh/id_rsa

     

       23
       +
                 chmod 600 ~/.ssh/id_rsa

     

       24
       +
                 ssh-keyscan -H knot.kitten.sh >> ~/.ssh/known_hosts

     

       25
       +
                 git remote add mirror "git@knot.kitten.sh:kitten.sh/${GITHUB_REPOSITORY#*/}"

     

       26
       +
                 git push --mirror mirror

+2 -2

README.md

···

       25
        
       

     

       26
        
       It only does three simple things:

     

       27
        
       - Isolate the [global object](https://developer.mozilla.org/en-US/docs/Glossary/Global_object) and uses a separate object using a `with` statement

     

       28
       -
       - Wraps all passed through globals, like `Array`, in a recursive proxy that disallows access to prototype-polluting propeties, such as `constructor`

     

       29
       -
       - In the browser: Creates an `iframe` element and uses that frame's globals instead

     

       30
        
       

     

       31
        
       If you haven't run away screaming yet, maybe that's what you're looking for. Just a bit more safety.

     

       32
        
       But really, I wrote this just for fun and I haven't written any tests yet and neither have I tested all edge cases.

···

       25
        
       

     

       26
        
       It only does three simple things:

     

       27
        
       - Isolate the [global object](https://developer.mozilla.org/en-US/docs/Glossary/Global_object) and uses a separate object using a `with` statement

     

       28
       +
       - Wraps all passed through globals, like `Array`, in a recursive masking object that disallows access to object prototype properties

     

       29
       +
       - In the browser: Creates an `iframe` element and uses that frame's globals instead to prvent prototype pollution.

     

       30
        
       

     

       31
        
       If you haven't run away screaming yet, maybe that's what you're looking for. Just a bit more safety.

     

       32
        
       But really, I wrote this just for fun and I haven't written any tests yet and neither have I tested all edge cases.

+2 -1

package.json

···

       2
        
         "name": "evalish",

     

       3
        
         "description": "A maybe slightly safer-ish wrapper around eval Function constructors",

     

       4
        
         "DISCLAIMER": "Please maybe try something else first.. Please.",

     

       5
       -
         "version": "0.1.2",

     

       6
        
         "main": "dist/evalish.js",

     

       7
        
         "module": "dist/evalish.mjs",

     

       8
        
         "types": "dist/types/index.d.ts",

     
···

       57
        
           "@rollup/plugin-buble": "^0.21.3",

     

       58
        
           "@rollup/plugin-commonjs": "^21.0.2",

     

       59
        
           "@rollup/plugin-node-resolve": "^13.1.3",

     

       0
        
       
     

       60
        
           "@types/react": "^17.0.42",

     

       61
        
           "husky-v4": "^4.3.8",

     

       62
        
           "lint-staged": "^12.3.7",

···

       2
        
         "name": "evalish",

     

       3
        
         "description": "A maybe slightly safer-ish wrapper around eval Function constructors",

     

       4
        
         "DISCLAIMER": "Please maybe try something else first.. Please.",

     

       5
       +
         "version": "0.1.8",

     

       6
        
         "main": "dist/evalish.js",

     

       7
        
         "module": "dist/evalish.mjs",

     

       8
        
         "types": "dist/types/index.d.ts",

     
···

       57
        
           "@rollup/plugin-buble": "^0.21.3",

     

       58
        
           "@rollup/plugin-commonjs": "^21.0.2",

     

       59
        
           "@rollup/plugin-node-resolve": "^13.1.3",

     

       60
       +
           "@types/node": "^18.0.6",

     

       61
        
           "@types/react": "^17.0.42",

     

       62
        
           "husky-v4": "^4.3.8",

     

       63
        
           "lint-staged": "^12.3.7",

+132 -60

src/index.ts

···

       1
       -
       // These are marked with `Symbol.unscopables` for the Proxy

     

       2
       -
       const unscopables = {

     

       3
       -
         __proto__: true,

     

       4
       -
         prototype: true,

     

       5
       -
         constructor: true,

     

       6
       -
       };

     

       7
       -
       

     

       8
        
       // Keys that'll always not be included (for Node.js)

     

       9
        
       const ignore = {

     

       10
        
         sys: true,

     
···

       15
        
         require: true,

     

       16
        
         Function: true,

     

       17
        
         eval: true,

     

       0
        
       
     

       18
        
         module: true,

     

       19
        
         exports: true,

     

       0
        
       
     

       20
        
         __filename: true,

     

       21
        
         __dirname: true,

     

       22
        
         console: true,

     

       23
        
       };

     

       24
        
       

     

       25
        
       const noop = function () {} as any;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       26
        
       

     

       27
        
       type Object = Record<string | symbol, unknown>;

     

       28
        
       

     
···

       30
        
       function safeKey(target: Object, key: string | symbol): string | undefined {

     

       31
        
         return key !== 'constructor' &&

     

       32
        
           key !== '__proto__' &&

     

       33
       -
           key !== 'constructor' &&

     

       34
        
           typeof key !== 'symbol' &&

     

       35
        
           key in target

     

       36
        
           ? key

     

       37
        
           : undefined;

     

       38
        
       }

     

       39
        
       

     

       40
       -
       // Wrap any given target with a Proxy preventing access to unscopables

     

       41
       -
       function withProxy(target: any) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       42
        
         if (

     

       43
        
           target == null ||

     

       44
        
           (typeof target !== 'function' && typeof target !== 'object')

     

       45
        
         ) {

     

       46
        
           // If the target isn't a function or object then skip

     

       47
        
           return target;

     

       48
       -
         } else if (

     

       49
       -
           typeof Proxy === 'function' &&

     

       50
       -
           typeof Symbol === 'function' &&

     

       51
       -
           Symbol.unscopables

     

       52
       -
         ) {

     

       53
       -
           // Mark hidden keys as unscopable

     

       54
       -
           target[Symbol.unscopables] = unscopables;

     

       55
       -
           // Wrap the target in a Proxy that disallows access to some keys

     

       56
       -
           return new Proxy(target, {

     

       57
       -
             // Return a value, if it's allowed to be returned, and wrap that value in a proxy recursively

     

       58
       -
             get(target, _key) {

     

       59
       -
               const key = safeKey(target, _key);

     

       60
       -
               return key !== undefined ? withProxy(target[key]) : undefined;

     

       61
       -
             },

     

       62
       -
             has(target, key) {

     

       63
       -
               return !!safeKey(target, key);

     

       64
       -
             },

     

       65
       -
             set: noop,

     

       66
       -
             deleteProperty: noop,

     

       67
       -
             defineProperty: noop,

     

       68
       -
             getOwnPropertyDescriptor: noop,

     

       69
       -
           });

     

       70
        
         }

     

       71
        
       

     

       72
        
         // Create a stand-in object or function

     

       73
       -
         const standin =

     

       74
       -
           typeof target === 'function'

     

       75
       -
             ? function (this: any) {

     

       76
       -
                 return target.apply(this, arguments);

     

       77
       -
               }

     

       78
       -
             : Object.create(null);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       79
        
         // Copy all known keys over to the stand-in and recursively apply `withProxy`

     

       80
        
         // Prevent unsafe keys from being accessed

     

       81
       -
         const keys = ['constructor', 'prototype', '__proto__'].concat(

     

       82
       -
           Object.getOwnPropertyNames(target)

     

       83
       -
         );

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       84
        
         for (let i = 0; i < keys.length; i++) {

     

       85
        
           const key = keys[i];

     

       86
       -
           Object.defineProperty(standin, key, {

     

       87
       -
             enumerable: true,

     

       88
       -
             get: safeKey(target, key)

     

       89
       -
               ? () => {

     

       90
       -
                   return typeof target[key] === 'function' ||

     

       91
       -
                     typeof target[key] === 'object'

     

       92
       -
                     ? withProxy(target[key])

     

       93
       -
                     : target[key];

     

       94
       -
                 }

     

       95
       -
               : noop,

     

       96
       -
           });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       97
        
         }

     

       98
        
       

     

       99
       -
         return standin;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       100
        
       }

     

       101
        
       

     

       102
        
       let safeGlobal: Record<string | symbol, unknown> | void;

     

       0
        
       
     

       103
        
       

     

       104
        
       function makeSafeGlobal() {

     

       105
        
         if (safeGlobal) {

     
···

       114
        
       

     

       115
        
         // Get all available global names on `globalThis` and remove keys that are

     

       116
        
         // explicitly ignored

     

       117
       -
         const trueGlobalKeys = Object.getOwnPropertyNames(trueGlobal).filter(

     

       118
        
           key => !ignore[key]

     

       119
        
         );

     

       120
        
       

     

       121
        
         // When we're in the browser, we can go a step further and try to create a

     

       122
        
         // new JS context and globals in a separate iframe

     

       123
       -
         let vmGlobals = trueGlobal;

     

       124
        
         let iframe: HTMLIFrameElement | void;

     

       125
        
         if (typeof document !== 'undefined') {

     

       126
        
           try {

     
···

       133
        
             document.head.appendChild(iframe);

     

       134
        
             // We copy over all known globals (as seen on the original `globalThis`)

     

       135
        
             // from the new global we receive from the iframe

     

       136
       -
             vmGlobals = Object.create(null);

     

       137
        
             for (let i = 0, l = trueGlobalKeys.length; i < l; i++) {

     

       138
        
               const key = trueGlobalKeys[i];

     

       139
        
               vmGlobals[key] = iframe.contentWindow![key];

     
···

       144
        
           } finally {

     

       145
        
             if (iframe) iframe.remove();

     

       146
        
           }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       147
        
         }

     

       148
        
       

     

       149
       -
         safeGlobal = Object.create(null);

     

       150
        
       

     

       151
        
         // The safe global is initialised by copying all values from either `globalThis`

     

       152
        
         // or the isolated global. They're wrapped using `withProxy` which further disallows

     

       153
        
         // certain key accesses

     

       154
        
         for (let i = 0, l = trueGlobalKeys.length; i < l; i++) {

     

       155
        
           const key = trueGlobalKeys[i];

     

       156
       -
           safeGlobal[key] = withProxy(vmGlobals[key]);

     

       157
        
         }

     

       158
        
       

     

       159
        
         // We then reset all globals that are present on `globalThis` directly

     
···

       162
        
         for (const key in ignore) safeGlobal[key] = undefined;

     

       163
        
         // It _might_ be safe to expose the Function constructor like this... who knows

     

       164
        
         safeGlobal!.Function = SafeFunction;

     

       0
        
       
     

       165
        
         // Lastly, we also disallow certain property accesses on the safe global

     

       166
       -
         return (safeGlobal = withProxy(safeGlobal!));

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       167
        
       }

     

       168
        
       

     

       169
        
       interface SafeFunction {

     
···

       175
        
         const safeGlobal = makeSafeGlobal();

     

       176
        
         const code = args.pop();

     

       177
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       178
        
         // We pass in our safe global and use it using `with` (ikr...)

     

       179
        
         // We then add a wrapper function for strict-mode and a few closing

     

       180
        
         // statements to prevent the code from escaping the `with` block;

     

       181
       -
         const fn = new Function(

     

       182
        
           'globalThis',

     

       183
        
           ...args,

     

       184
        
           'with (globalThis) {\n"use strict";\nreturn (function () {\n' +

···

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1
        
       // Keys that'll always not be included (for Node.js)

     

       2
        
       const ignore = {

     

       3
        
         sys: true,

     
···

       8
        
         require: true,

     

       9
        
         Function: true,

     

       10
        
         eval: true,

     

       11
       +
         process: true,

     

       12
        
         module: true,

     

       13
        
         exports: true,

     

       14
       +
         makeSafeGlobal: true,

     

       15
        
         __filename: true,

     

       16
        
         __dirname: true,

     

       17
        
         console: true,

     

       18
        
       };

     

       19
        
       

     

       20
        
       const noop = function () {} as any;

     

       21
       +
       const _freeze = Object.freeze;

     

       22
       +
       const _seal = Object.seal;

     

       23
       +
       const _keys = Object.keys;

     

       24
       +
       const _getOwnPropertyNames = Object.getOwnPropertyNames;

     

       25
       +
       const _getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;

     

       26
       +
       const _defineProperty = Object.defineProperty;

     

       27
       +
       const _create = Object.create;

     

       28
       +
       const _slice = Array.prototype.slice;

     

       29
        
       

     

       30
        
       type Object = Record<string | symbol, unknown>;

     

       31
        
       

     
···

       33
        
       function safeKey(target: Object, key: string | symbol): string | undefined {

     

       34
        
         return key !== 'constructor' &&

     

       35
        
           key !== '__proto__' &&

     

       36
       +
           key !== 'prototype' &&

     

       37
        
           typeof key !== 'symbol' &&

     

       38
        
           key in target

     

       39
        
           ? key

     

       40
        
           : undefined;

     

       41
        
       }

     

       42
        
       

     

       43
       +
       function freeze(target: Object): Object {

     

       44
       +
         try { _freeze(target); } catch (_error) {}

     

       45
       +
         try { _seal(target); } catch (_error) {}

     

       46
       +
         return target;

     

       47
       +
       }

     

       48
       +
       

     

       49
       +
       const masked = new Set();

     

       50
       +
       

     

       51
       +
       // Wrap any given target with a masking object preventing access to prototype properties

     

       52
       +
       function mask(target: any, toplevel: boolean) {

     

       53
        
         if (

     

       54
        
           target == null ||

     

       55
        
           (typeof target !== 'function' && typeof target !== 'object')

     

       56
        
         ) {

     

       57
        
           // If the target isn't a function or object then skip

     

       58
        
           return target;

     

       59
       +
         }

     

       60
       +
       

     

       61
       +
         if (!('constructor' in target)) {

     

       62
       +
           toplevel = false;

     

       63
       +
         }

     

       64
       +
       

     

       65
       +
         if (toplevel && masked.has(target)) {

     

       66
       +
           return target;

     

       67
       +
         } else if (toplevel) {

     

       68
       +
           masked.add(target);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       69
        
         }

     

       70
        
       

     

       71
        
         // Create a stand-in object or function

     

       72
       +
         let standin = target;

     

       73
       +
         if (!toplevel) {

     

       74
       +
           standin = typeof target === 'function'

     

       75
       +
             ? (function (this: any) {

     

       76
       +
                 if (new.target === undefined) {

     

       77
       +
                   return target.apply(this, arguments);

     

       78
       +
                 } else {

     

       79
       +
                   const args = _slice.call(arguments);

     

       80
       +
                   args.unshift(null);

     

       81
       +
                   return new (target.bind.apply(target, args));

     

       82
       +
                 }

     

       83
       +
               })

     

       84
       +
             : _create(null);

     

       85
       +
         }

     

       86
       +
       

     

       87
        
         // Copy all known keys over to the stand-in and recursively apply `withProxy`

     

       88
        
         // Prevent unsafe keys from being accessed

     

       89
       +
         const keys = ["__proto__", "constructor"];

     

       90
       +
         try {

     

       91
       +
           // Chromium already restricts access to certain globals in an

     

       92
       +
           // iframe, this try catch block is to avoid

     

       93
       +
           // "Failed to enumerate the properties of 'Storage': access is denied for this document"

     

       94
       +
           keys.push(..._getOwnPropertyNames(target));

     

       95
       +
         } catch (_error) {

     

       96
       +
           keys.push(..._keys(target));

     

       97
       +
         }

     

       98
       +
       

     

       99
       +
         const seen = new Set();

     

       100
        
         for (let i = 0; i < keys.length; i++) {

     

       101
        
           const key = keys[i];

     

       102
       +
           if (seen.has(key)) {

     

       103
       +
             continue;

     

       104
       +
           } else if (

     

       105
       +
             key !== 'prototype' &&

     

       106
       +
             (typeof standin !== 'function' || (key !== 'arguments' && key !== 'caller'))

     

       107
       +
           ) {

     

       108
       +
             seen.add(key);

     

       109
       +
             const descriptor = _getOwnPropertyDescriptor(standin, key) || {};

     

       110
       +
             if (descriptor.configurable) {

     

       111
       +
               _defineProperty(standin, key, {

     

       112
       +
                 enumerable: descriptor.enumerable,

     

       113
       +
                 configurable: descriptor.configurable,

     

       114
       +
                 get: (() => {

     

       115
       +
                   if (!safeKey(target, key)) {

     

       116
       +
                     return noop;

     

       117
       +
                   } if (toplevel) {

     

       118
       +
                     try {

     

       119
       +
                       const value = mask(target[key], false);

     

       120
       +
                       return () => value;

     

       121
       +
                     } catch (_error) {

     

       122
       +
                       return noop;

     

       123
       +
                     }

     

       124
       +
                   } else {

     

       125
       +
                     return () => mask(target[key], false);

     

       126
       +
                   }

     

       127
       +
                 })(),

     

       128
       +
               });

     

       129
       +
             }

     

       130
       +
           }

     

       131
        
         }

     

       132
        
       

     

       133
       +
         if (standin.prototype != null) {

     

       134
       +
           standin.prototype = _create(null);

     

       135
       +
         }

     

       136
       +
       

     

       137
       +
         return toplevel ? standin : freeze(standin);

     

       138
        
       }

     

       139
        
       

     

       140
        
       let safeGlobal: Record<string | symbol, unknown> | void;

     

       141
       +
       let vmGlobals: Record<string | symbol, unknown> = {};

     

       142
        
       

     

       143
        
       function makeSafeGlobal() {

     

       144
        
         if (safeGlobal) {

     
···

       153
        
       

     

       154
        
         // Get all available global names on `globalThis` and remove keys that are

     

       155
        
         // explicitly ignored

     

       156
       +
         const trueGlobalKeys = _getOwnPropertyNames(trueGlobal).filter(

     

       157
        
           key => !ignore[key]

     

       158
        
         );

     

       159
        
       

     

       160
        
         // When we're in the browser, we can go a step further and try to create a

     

       161
        
         // new JS context and globals in a separate iframe

     

       162
       +
         vmGlobals = trueGlobal;

     

       163
        
         let iframe: HTMLIFrameElement | void;

     

       164
        
         if (typeof document !== 'undefined') {

     

       165
        
           try {

     
···

       172
        
             document.head.appendChild(iframe);

     

       173
        
             // We copy over all known globals (as seen on the original `globalThis`)

     

       174
        
             // from the new global we receive from the iframe

     

       175
       +
             vmGlobals = _create(null);

     

       176
        
             for (let i = 0, l = trueGlobalKeys.length; i < l; i++) {

     

       177
        
               const key = trueGlobalKeys[i];

     

       178
        
               vmGlobals[key] = iframe.contentWindow![key];

     
···

       183
        
           } finally {

     

       184
        
             if (iframe) iframe.remove();

     

       185
        
           }

     

       186
       +
         } else if (typeof require === 'function') {

     

       187
       +
           vmGlobals = _create(null);

     

       188
       +
           const scriptGlobal = new (require('vm').Script)('exports = globalThis').runInNewContext({}).exports;

     

       189
       +
           for (let i = 0, l = trueGlobalKeys.length; i < l; i++) {

     

       190
       +
             const key = trueGlobalKeys[i];

     

       191
       +
             vmGlobals[key] = scriptGlobal[key];

     

       192
       +
           }

     

       193
        
         }

     

       194
        
       

     

       195
       +
         safeGlobal = _create(null);

     

       196
        
       

     

       197
        
         // The safe global is initialised by copying all values from either `globalThis`

     

       198
        
         // or the isolated global. They're wrapped using `withProxy` which further disallows

     

       199
        
         // certain key accesses

     

       200
        
         for (let i = 0, l = trueGlobalKeys.length; i < l; i++) {

     

       201
        
           const key = trueGlobalKeys[i];

     

       202
       +
           safeGlobal[key] = mask(vmGlobals[key], true);

     

       203
        
         }

     

       204
        
       

     

       205
        
         // We then reset all globals that are present on `globalThis` directly

     
···

       208
        
         for (const key in ignore) safeGlobal[key] = undefined;

     

       209
        
         // It _might_ be safe to expose the Function constructor like this... who knows

     

       210
        
         safeGlobal!.Function = SafeFunction;

     

       211
       +
       

     

       212
        
         // Lastly, we also disallow certain property accesses on the safe global

     

       213
       +
         // Wrap any given target with a Proxy preventing access to unscopables

     

       214
       +
         if (typeof Proxy === 'function') {

     

       215
       +
           // Wrap the target in a Proxy that disallows access to some keys

     

       216
       +
           return (safeGlobal = new Proxy(safeGlobal!, {

     

       217
       +
             // Return a value, if it's allowed to be returned and mask this value

     

       218
       +
             get(target, _key) {

     

       219
       +
               const key = safeKey(target, _key);

     

       220
       +
               return !ignore[_key] && key !== undefined ? target[key] : undefined;

     

       221
       +
             },

     

       222
       +
             has(_target, _key) {

     

       223
       +
               return true;

     

       224
       +
             },

     

       225
       +
             set: noop,

     

       226
       +
             deleteProperty: noop,

     

       227
       +
             defineProperty: noop,

     

       228
       +
             getOwnPropertyDescriptor: noop,

     

       229
       +
           }));

     

       230
       +
         } else {

     

       231
       +
           // NOTE: Some property accesses may leak through here without the Proxy

     

       232
       +
           return freeze(safeGlobal!);

     

       233
       +
         }

     

       234
        
       }

     

       235
        
       

     

       236
        
       interface SafeFunction {

     
···

       242
        
         const safeGlobal = makeSafeGlobal();

     

       243
        
         const code = args.pop();

     

       244
        
       

     

       245
       +
         // Retrieve Function constructor from vm globals

     

       246
       +
         const Function = vmGlobals.Function as FunctionConstructor | void;

     

       247
       +
         const Object = vmGlobals.Object as ObjectConstructor;

     

       248
       +
         const createFunction = (Function || Object.constructor.constructor) as FunctionConstructor;

     

       249
       +
       

     

       250
        
         // We pass in our safe global and use it using `with` (ikr...)

     

       251
        
         // We then add a wrapper function for strict-mode and a few closing

     

       252
        
         // statements to prevent the code from escaping the `with` block;

     

       253
       +
         const fn = createFunction(

     

       254
        
           'globalThis',

     

       255
        
           ...args,

     

       256
        
           'with (globalThis) {\n"use strict";\nreturn (function () {\n' +

+1 -1

tsconfig.json

···

       1
        
       {

     

       2
        
         "compilerOptions": {

     

       3
       -
           "types": [],

     

       4
        
           "baseUrl": "./",

     

       5
        
           "esModuleInterop": true,

     

       6
        
           "forceConsistentCasingInFileNames": true,

···

       1
        
       {

     

       2
        
         "compilerOptions": {

     

       3
       +
           "types": ["node"],

     

       4
        
           "baseUrl": "./",

     

       5
        
           "esModuleInterop": true,

     

       6
        
           "forceConsistentCasingInFileNames": true,

yarn.lock

···

       136
        
         resolved "https://registry.yarnpkg.com/@types/node/-/node-18.0.4.tgz#48aedbf35efb3af1248e4cd4d792c730290cd5d6"

     

       137
        
         integrity sha512-M0+G6V0Y4YV8cqzHssZpaNCqvYwlCiulmm0PwpNLF55r/+cT8Ol42CHRU1SEaYFH2rTwiiE1aYg/2g2rrtGdPA==

     

       138
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       139
        
       "@types/parse-json@^4.0.0":

     

       140
        
         version "4.0.0"

     

       141
        
         resolved "https://registry.yarnpkg.com/@types/parse-json/-/parse-json-4.0.0.tgz#2f8bb441434d163b35fb8ffdccd7138927ffb8c0"

···

       136
        
         resolved "https://registry.yarnpkg.com/@types/node/-/node-18.0.4.tgz#48aedbf35efb3af1248e4cd4d792c730290cd5d6"

     

       137
        
         integrity sha512-M0+G6V0Y4YV8cqzHssZpaNCqvYwlCiulmm0PwpNLF55r/+cT8Ol42CHRU1SEaYFH2rTwiiE1aYg/2g2rrtGdPA==

     

       138
        
       

     

       139
       +
       "@types/node@^18.0.6":

     

       140
       +
         version "18.0.6"

     

       141
       +
         resolved "https://registry.yarnpkg.com/@types/node/-/node-18.0.6.tgz#0ba49ac517ad69abe7a1508bc9b3a5483df9d5d7"

     

       142
       +
         integrity sha512-/xUq6H2aQm261exT6iZTMifUySEt4GR5KX8eYyY+C4MSNPqSh9oNIP7tz2GLKTlFaiBbgZNxffoR3CVRG+cljw==

     

       143
       +
       

     

       144
        
       "@types/parse-json@^4.0.0":

     

       145
        
         version "4.0.0"

     

       146
        
         resolved "https://registry.yarnpkg.com/@types/parse-json/-/parse-json-4.0.0.tgz#2f8bb441434d163b35fb8ffdccd7138927ffb8c0"

Compare changes