@alicloud/sandbox-escape 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,5 @@
+# CHANGELOG
+
+## 1.0.0 2022/06/28 @驳是
+
+* First Blood

package/README.md

@@ -0,0 +1,3 @@
+# @alicloud/sandbox-escape
+
+沙箱逃逸，虽然 ConsoleBase 不属于沙箱，但有沙箱应用会用到 ConsoleBase 提供的包，需要保证 ConsoleBase 在这些沙箱应用下可以用到真正的 window 等全局对象。

package/build/cjs/index.js

@@ -0,0 +1,18 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+
+var _util = require("./util");
+
+Object.keys(_util).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _util[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function get() {
+      return _util[key];
+    }
+  });
+});

package/build/cjs/util/get-window-by-dom.js

@@ -0,0 +1,14 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = getWindowByDom;
+
+function getWindowByDom() {
+  try {
+    return window.document.getElementsByTagName('html')[0].ownerDocument.defaultView;
+  } catch (err) {
+    return null;
+  }
+}

package/build/cjs/util/get-window-by-new-function.js

@@ -0,0 +1,19 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = getWindowByNewFunction;
+
+function getWindowByNewFunction() {
+  /**
+   * 需要 try-catch，因为可能会被 CSP 拦截，比如这段代码放在 Github 的项目页面就会报错如下：
+   *
+   * 「Content Security Policy: The page’s settings blocked the loading of a resource at eval (“script-src”).」
+   */
+  try {
+    return new Function('', 'return window')(); // eslint-disable-line no-new-func
+  } catch (err) {
+    return null;
+  }
+}

package/build/cjs/util/get-window.js

@@ -0,0 +1,26 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = getWindow;
+
+var _getWindowByNewFunction = _interopRequireDefault(require("./get-window-by-new-function"));
+
+var _getWindowByDom = _interopRequireDefault(require("./get-window-by-dom"));
+
+var win;
+/**
+ * 避免沙箱模式下 window 被 with 劫持
+ */
+
+function getWindow() {
+  if (!win) {
+    // 取一次即可
+    win = (0, _getWindowByNewFunction.default)() || (0, _getWindowByDom.default)() || window;
+  }
+
+  return win;
+}

package/build/cjs/util/index.js

@@ -0,0 +1,15 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "getWindow", {
+  enumerable: true,
+  get: function get() {
+    return _getWindow.default;
+  }
+});
+
+var _getWindow = _interopRequireDefault(require("./get-window"));

package/build/es/index.js

@@ -0,0 +1 @@
+export * from './util';

package/build/es/util/get-window-by-dom.js

@@ -0,0 +1,7 @@
+export default function getWindowByDom() {
+  try {
+    return window.document.getElementsByTagName('html')[0].ownerDocument.defaultView;
+  } catch (err) {
+    return null;
+  }
+}

package/build/es/util/get-window-by-new-function.js

@@ -0,0 +1,12 @@
+export default function getWindowByNewFunction() {
+  /**
+   * 需要 try-catch，因为可能会被 CSP 拦截，比如这段代码放在 Github 的项目页面就会报错如下：
+   *
+   * 「Content Security Policy: The page’s settings blocked the loading of a resource at eval (“script-src”).」
+   */
+  try {
+    return new Function('', 'return window')(); // eslint-disable-line no-new-func
+  } catch (err) {
+    return null;
+  }
+}

package/build/es/util/get-window.js

@@ -0,0 +1,15 @@
+import getWindowByNewFunction from './get-window-by-new-function';
+import getWindowByDom from './get-window-by-dom';
+var win;
+/**
+ * 避免沙箱模式下 window 被 with 劫持
+ */
+
+export default function getWindow() {
+  if (!win) {
+    // 取一次即可
+    win = getWindowByNewFunction() || getWindowByDom() || window;
+  }
+
+  return win;
+}

package/build/es/util/index.js

@@ -0,0 +1 @@
+export { default as getWindow } from './get-window';

package/build/types/index.d.ts

@@ -0,0 +1 @@
+export * from './util';

package/build/types/util/get-window-by-dom.d.ts

@@ -0,0 +1 @@
+export default function getWindowByDom(): Window | null;

package/build/types/util/get-window-by-new-function.d.ts

@@ -0,0 +1 @@
+export default function getWindowByNewFunction(): Window | null;

package/build/types/util/get-window.d.ts

@@ -0,0 +1,4 @@
+/**
+ * 避免沙箱模式下 window 被 with 劫持
+ */
+export default function getWindow<T extends Window = Window>(): T;

package/build/types/util/index.d.ts

@@ -0,0 +1 @@
+export { default as getWindow } from './get-window';

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@alicloud/sandbox-escape",
+  "version": "1.0.0",
+  "description": "沙箱逃逸",
+  "license": "MIT",
+  "main": "build/cjs/index.js",
+  "module": "build/es/index.js",
+  "types": "build/types/index.d.ts",
+  "homepage": "https://github.com/aliyun/alibabacloud-console-base/tree/master/packages/sandbox-escape",
+  "author": {
+    "name": "Jianchun Wang",
+    "email": "justnewbee@gmail.com"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aliyun/alibabacloud-console-base.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "sandbox",
+    "escape",
+    "window"
+  ],
+  "devDependencies": {
+    "@alicloud/console-toolkit-cli": "^1.2.30",
+    "@alicloud/console-toolkit-preset-component": "^1.2.61",
+    "@types/lodash": "^4.14.182",
+    "@types/react": "^17.0.45",
+    "react": "^17.0.2",
+    "typescript": "^4.7.4"
+  },
+  "scripts": {
+    "start": "breezr start-storybook",
+    "test": "breezr test:unit",
+    "build:esm": "breezr build --engine babel --es-module",
+    "build:cjs": "breezr build --engine babel",
+    "build:bundle": "breezr build --engine webpack",
+    "build:typings": "tsc --outDir build/types --declaration --emitDeclarationOnly",
+    "build": "yarn build:esm && yarn build:cjs && yarn build:typings",
+    "clean": "rm -rf build",
+    "prepublishOnly": "yarn clean && yarn build"
+  }
+}