@cuxt/sandboxjs 0.1.0

package/build/unraw.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Replace raw escape character strings with their escape characters.
+ * @param raw A string where escape characters are represented as raw string
+ * values like `\'` rather than `'`.
+ * @param allowOctals If `true`, will process the now-deprecated octal escape
+ * sequences (ie, `\111`).
+ * @returns The processed string, with escape characters replaced by their
+ * respective actual Unicode characters.
+ */
+export declare function unraw(raw: string): string;
+export default unraw;

package/build/unraw.js

@@ -0,0 +1,168 @@
+/**
+ * Parse a string as a base-16 number. This is more strict than `parseInt` as it
+ * will not allow any other characters, including (for example) "+", "-", and
+ * ".".
+ * @param hex A string containing a hexadecimal number.
+ * @returns The parsed integer, or `NaN` if the string is not a valid hex
+ * number.
+ */
+function parseHexToInt(hex) {
+    const isOnlyHexChars = !hex.match(/[^a-f0-9]/i);
+    return isOnlyHexChars ? parseInt(hex, 16) : NaN;
+}
+/**
+ * Check the validity and length of a hexadecimal code and optionally enforces
+ * a specific number of hex digits.
+ * @param hex The string to validate and parse.
+ * @param errorName The name of the error message to throw a `SyntaxError` with
+ * if `hex` is invalid. This is used to index `errorMessages`.
+ * @param enforcedLength If provided, will throw an error if `hex` is not
+ * exactly this many characters.
+ * @returns The parsed hex number as a normal number.
+ * @throws {SyntaxError} If the code is not valid.
+ */
+function validateAndParseHex(hex, errorName, enforcedLength) {
+    const parsedHex = parseHexToInt(hex);
+    if (Number.isNaN(parsedHex) || (enforcedLength !== undefined && enforcedLength !== hex.length)) {
+        throw new SyntaxError(errorName + ': ' + hex);
+    }
+    return parsedHex;
+}
+/**
+ * Parse a two-digit hexadecimal character escape code.
+ * @param code The two-digit hexadecimal number that represents the character to
+ * output.
+ * @returns The single character represented by the code.
+ * @throws {SyntaxError} If the code is not valid hex or is not the right
+ * length.
+ */
+function parseHexadecimalCode(code) {
+    const parsedCode = validateAndParseHex(code, 'Malformed Hexadecimal', 2);
+    return String.fromCharCode(parsedCode);
+}
+/**
+ * Parse a four-digit Unicode character escape code.
+ * @param code The four-digit unicode number that represents the character to
+ * output.
+ * @param surrogateCode Optional four-digit unicode surrogate that represents
+ * the other half of the character to output.
+ * @returns The single character represented by the code.
+ * @throws {SyntaxError} If the codes are not valid hex or are not the right
+ * length.
+ */
+function parseUnicodeCode(code, surrogateCode) {
+    const parsedCode = validateAndParseHex(code, 'Malformed Unicode', 4);
+    if (surrogateCode !== undefined) {
+        const parsedSurrogateCode = validateAndParseHex(surrogateCode, 'Malformed Unicode', 4);
+        return String.fromCharCode(parsedCode, parsedSurrogateCode);
+    }
+    return String.fromCharCode(parsedCode);
+}
+/**
+ * Test if the text is surrounded by curly braces (`{}`).
+ * @param text Text to check.
+ * @returns `true` if the text is in the form `{*}`.
+ */
+function isCurlyBraced(text) {
+    return text.charAt(0) === '{' && text.charAt(text.length - 1) === '}';
+}
+/**
+ * Parse a Unicode code point character escape code.
+ * @param codePoint A unicode escape code point, including the surrounding curly
+ * braces.
+ * @returns The single character represented by the code.
+ * @throws {SyntaxError} If the code is not valid hex or does not have the
+ * surrounding curly braces.
+ */
+function parseUnicodeCodePointCode(codePoint) {
+    if (!isCurlyBraced(codePoint)) {
+        throw new SyntaxError('Malformed Unicode: +' + codePoint);
+    }
+    const withoutBraces = codePoint.slice(1, -1);
+    const parsedCode = validateAndParseHex(withoutBraces, 'Malformed Unicode');
+    try {
+        return String.fromCodePoint(parsedCode);
+    }
+    catch (err) {
+        throw err instanceof RangeError ? new SyntaxError('Code Point Limit:' + parsedCode) : err;
+    }
+}
+/**
+ * Map of unescaped letters to their corresponding special JS escape characters.
+ * Intentionally does not include characters that map to themselves like "\'".
+ */
+const singleCharacterEscapes = new Map([
+    ['b', '\b'],
+    ['f', '\f'],
+    ['n', '\n'],
+    ['r', '\r'],
+    ['t', '\t'],
+    ['v', '\v'],
+    ['0', '\0'],
+]);
+/**
+ * Parse a single character escape sequence and return the matching character.
+ * If none is matched, defaults to `code`.
+ * @param code A single character code.
+ */
+function parseSingleCharacterCode(code) {
+    return singleCharacterEscapes.get(code) || code;
+}
+/**
+ * Matches every escape sequence possible, including invalid ones.
+ *
+ * All capture groups (described below) are unique (only one will match), except
+ * for 4, which can only potentially match if 3 does.
+ *
+ * **Capture Groups:**
+ * 0. A single backslash
+ * 1. Hexadecimal code
+ * 2. Unicode code point code with surrounding curly braces
+ * 3. Unicode escape code with surrogate
+ * 4. Surrogate code
+ * 5. Unicode escape code without surrogate
+ * 6. Octal code _NOTE: includes "0"._
+ * 7. A single character (will never be \, x, u, or 0-3)
+ */
+const escapeMatch = /\\(?:(\\)|x([\s\S]{0,2})|u(\{[^}]*\}?)|u([\s\S]{4})\\u([^{][\s\S]{0,3})|u([\s\S]{0,4})|([0-3]?[0-7]{1,2})|([\s\S])|$)/g;
+/**
+ * Replace raw escape character strings with their escape characters.
+ * @param raw A string where escape characters are represented as raw string
+ * values like `\'` rather than `'`.
+ * @param allowOctals If `true`, will process the now-deprecated octal escape
+ * sequences (ie, `\111`).
+ * @returns The processed string, with escape characters replaced by their
+ * respective actual Unicode characters.
+ */
+export function unraw(raw) {
+    return raw.replace(escapeMatch, function (_, backslash, hex, codePoint, unicodeWithSurrogate, surrogate, unicode, octal, singleCharacter) {
+        // Compare groups to undefined because empty strings mean different errors
+        // Otherwise, `\u` would fail the same as `\` which is wrong.
+        if (backslash !== undefined) {
+            return '\\';
+        }
+        if (hex !== undefined) {
+            return parseHexadecimalCode(hex);
+        }
+        if (codePoint !== undefined) {
+            return parseUnicodeCodePointCode(codePoint);
+        }
+        if (unicodeWithSurrogate !== undefined) {
+            return parseUnicodeCode(unicodeWithSurrogate, surrogate);
+        }
+        if (unicode !== undefined) {
+            return parseUnicodeCode(unicode);
+        }
+        if (octal === '0') {
+            return '\0';
+        }
+        if (octal !== undefined) {
+            throw new SyntaxError('Octal Deprecation: ' + octal);
+        }
+        if (singleCharacter !== undefined) {
+            return parseSingleCharacterCode(singleCharacter);
+        }
+        throw new SyntaxError('End of string');
+    });
+}
+export default unraw;

package/build/utils.d.ts

@@ -0,0 +1,264 @@
+export declare const AsyncFunction: Function;
+export declare const GeneratorFunction: Function;
+export declare const AsyncGeneratorFunction: Function;
+import { IEvalContext } from './eval';
+import { Change, Unknown } from './executor';
+import { IConstants, IExecutionTree, Lisp, LispItem } from './parser';
+import SandboxExec from './SandboxExec';
+export type replacementCallback = (obj: any, isStaticAccess: boolean) => any;
+export interface IOptionParams {
+    audit?: boolean;
+    forbidFunctionCalls?: boolean;
+    forbidFunctionCreation?: boolean;
+    prototypeReplacements?: Map<Function, replacementCallback>;
+    prototypeWhitelist?: Map<Function, Set<string>>;
+    globals?: IGlobals;
+    executionQuota?: bigint;
+    haltOnSandboxError?: boolean;
+}
+export interface IOptions {
+    audit: boolean;
+    forbidFunctionCalls: boolean;
+    forbidFunctionCreation: boolean;
+    prototypeReplacements: Map<Function, replacementCallback>;
+    prototypeWhitelist: Map<Function, Set<string>>;
+    globals: IGlobals;
+    executionQuota?: bigint;
+    haltOnSandboxError?: boolean;
+}
+export interface IContext {
+    sandbox: SandboxExec;
+    globalScope: Scope;
+    sandboxGlobal: ISandboxGlobal;
+    globalsWhitelist: Set<any>;
+    prototypeWhitelist: Map<any, Set<PropertyKey>>;
+    sandboxedFunctions: WeakSet<Function>;
+    options: IOptions;
+    auditReport?: IAuditReport;
+    ticks: Ticks;
+}
+export interface IAuditReport {
+    globalsAccess: Set<unknown>;
+    prototypeAccess: {
+        [name: string]: Set<PropertyKey>;
+    };
+}
+export interface Ticks {
+    ticks: bigint;
+    tickLimit?: bigint;
+}
+export type SubscriptionSubject = object;
+export interface IExecContext extends IExecutionTree {
+    ctx: IContext;
+    getSubscriptions: Set<(obj: SubscriptionSubject, name: string) => void>;
+    setSubscriptions: WeakMap<SubscriptionSubject, Map<string, Set<(modification: Change) => void>>>;
+    changeSubscriptions: WeakMap<SubscriptionSubject, Set<(modification: Change) => void>>;
+    setSubscriptionsGlobal: WeakMap<SubscriptionSubject, Map<string, Set<(modification: Change) => void>>>;
+    changeSubscriptionsGlobal: WeakMap<SubscriptionSubject, Set<(modification: Change) => void>>;
+    registerSandboxFunction: (fn: (...args: any[]) => any) => void;
+    evals: Map<Function, Function>;
+    allowJit: boolean;
+    evalContext?: IEvalContext;
+}
+export interface ISandboxGlobal {
+    [key: string]: unknown;
+}
+interface SandboxGlobalConstructor {
+    new (globals: IGlobals): ISandboxGlobal;
+}
+export declare const SandboxGlobal: SandboxGlobalConstructor;
+export type IGlobals = ISandboxGlobal;
+export declare class ExecContext implements IExecContext {
+    ctx: IContext;
+    constants: IConstants;
+    tree: Lisp[];
+    getSubscriptions: Set<(obj: SubscriptionSubject, name: string) => void>;
+    setSubscriptions: WeakMap<SubscriptionSubject, Map<string, Set<(modification: Change) => void>>>;
+    changeSubscriptions: WeakMap<SubscriptionSubject, Set<(modification: Change) => void>>;
+    setSubscriptionsGlobal: WeakMap<SubscriptionSubject, Map<string, Set<(modification: Change) => void>>>;
+    changeSubscriptionsGlobal: WeakMap<SubscriptionSubject, Set<(modification: Change) => void>>;
+    evals: Map<any, any>;
+    registerSandboxFunction: (fn: (...args: any[]) => any) => void;
+    allowJit: boolean;
+    evalContext?: IEvalContext | undefined;
+    constructor(ctx: IContext, constants: IConstants, tree: Lisp[], getSubscriptions: Set<(obj: SubscriptionSubject, name: string) => void>, setSubscriptions: WeakMap<SubscriptionSubject, Map<string, Set<(modification: Change) => void>>>, changeSubscriptions: WeakMap<SubscriptionSubject, Set<(modification: Change) => void>>, setSubscriptionsGlobal: WeakMap<SubscriptionSubject, Map<string, Set<(modification: Change) => void>>>, changeSubscriptionsGlobal: WeakMap<SubscriptionSubject, Set<(modification: Change) => void>>, evals: Map<any, any>, registerSandboxFunction: (fn: (...args: any[]) => any) => void, allowJit: boolean, evalContext?: IEvalContext | undefined);
+}
+export declare function createContext(sandbox: SandboxExec, options: IOptions): IContext;
+export declare function createExecContext(sandbox: {
+    readonly setSubscriptions: WeakMap<SubscriptionSubject, Map<string, Set<(modification: Change) => void>>>;
+    readonly changeSubscriptions: WeakMap<SubscriptionSubject, Set<(modification: Change) => void>>;
+    readonly sandboxFunctions: WeakMap<(...args: any[]) => any, IExecContext>;
+    readonly context: IContext;
+}, executionTree: IExecutionTree, evalContext?: IEvalContext): IExecContext;
+export declare class CodeString {
+    start: number;
+    end: number;
+    ref: {
+        str: string;
+    };
+    constructor(str: string | CodeString);
+    substring(start: number, end?: number): CodeString;
+    get length(): number;
+    char(i: number): string | undefined;
+    toString(): string;
+    trimStart(): CodeString;
+    slice(start: number, end?: number): CodeString;
+    trim(): CodeString;
+    valueOf(): string;
+}
+export declare const reservedWords: Set<string>;
+export declare const enum VarType {
+    let = "let",
+    const = "const",
+    var = "var"
+}
+export declare class Scope {
+    parent: Scope | null;
+    const: {
+        [key: string]: true;
+    };
+    let: {
+        [key: string]: true;
+    };
+    var: {
+        [key: string]: true;
+    };
+    globals: {
+        [key: string]: true;
+    };
+    allVars: {
+        [key: string]: unknown;
+    } & object;
+    functionThis?: Unknown;
+    constructor(parent: Scope | null, vars?: {}, functionThis?: Unknown);
+    get(key: string): Prop;
+    set(key: string, val: unknown): Prop<unknown>;
+    getWhereValScope(key: string, isThis: boolean): Scope | null;
+    getWhereVarScope(key: string, localScope?: boolean): Scope;
+    declare(key: string, type: VarType, value?: unknown, isGlobal?: boolean): Prop;
+}
+export interface IScope {
+    [key: string]: any;
+}
+export declare class FunctionScope implements IScope {
+}
+export declare class LocalScope implements IScope {
+}
+export declare class SandboxError extends Error {
+}
+export declare class SandboxExecutionQuotaExceededError extends SandboxError {
+}
+export declare class SandboxExecutionTreeError extends SandboxError {
+}
+export declare class SandboxCapabilityError extends SandboxError {
+}
+export declare class SandboxAccessError extends SandboxError {
+}
+export declare function isLisp<Type extends Lisp = Lisp>(item: LispItem | LispItem): item is Type;
+export declare const enum LispType {
+    None = 0,
+    Prop = 1,
+    StringIndex = 2,
+    Let = 3,
+    Const = 4,
+    Call = 5,
+    KeyVal = 6,
+    Number = 7,
+    Return = 8,
+    Assign = 9,
+    InlineFunction = 10,
+    ArrowFunction = 11,
+    CreateArray = 12,
+    If = 13,
+    IfCase = 14,
+    InlineIf = 15,
+    InlineIfCase = 16,
+    SpreadObject = 17,
+    SpreadArray = 18,
+    ArrayProp = 19,
+    PropOptional = 20,
+    CallOptional = 21,
+    CreateObject = 22,
+    Group = 23,
+    Not = 24,
+    IncrementBefore = 25,
+    IncrementAfter = 26,
+    DecrementBefore = 27,
+    DecrementAfter = 28,
+    And = 29,
+    Or = 30,
+    StrictNotEqual = 31,
+    StrictEqual = 32,
+    Plus = 33,
+    Var = 34,
+    GlobalSymbol = 35,
+    Literal = 36,
+    Function = 37,
+    Loop = 38,
+    Try = 39,
+    Switch = 40,
+    SwitchCase = 41,
+    Block = 42,
+    Expression = 43,
+    Await = 44,
+    New = 45,
+    Throw = 46,
+    Minus = 47,
+    Divide = 48,
+    Power = 49,
+    Multiply = 50,
+    Modulus = 51,
+    Equal = 52,
+    NotEqual = 53,
+    SmallerEqualThan = 54,
+    LargerEqualThan = 55,
+    SmallerThan = 56,
+    LargerThan = 57,
+    Negative = 58,
+    Positive = 59,
+    Typeof = 60,
+    Delete = 61,
+    Instanceof = 62,
+    In = 63,
+    Inverse = 64,
+    SubractEquals = 65,
+    AddEquals = 66,
+    DivideEquals = 67,
+    PowerEquals = 68,
+    MultiplyEquals = 69,
+    ModulusEquals = 70,
+    BitNegateEquals = 71,
+    BitAndEquals = 72,
+    BitOrEquals = 73,
+    UnsignedShiftRightEquals = 74,
+    ShiftRightEquals = 75,
+    ShiftLeftEquals = 76,
+    BitAnd = 77,
+    BitOr = 78,
+    BitNegate = 79,
+    BitShiftLeft = 80,
+    BitShiftRight = 81,
+    BitUnsignedShiftRight = 82,
+    BigInt = 83,
+    LiteralIndex = 84,
+    RegexIndex = 85,
+    LoopAction = 86,
+    Void = 87,
+    True = 88,
+    NullishCoalescing = 89,
+    AndEquals = 90,
+    OrEquals = 91,
+    NullishCoalescingEquals = 92,
+    LispEnumSize = 93
+}
+export declare class Prop<T = unknown> {
+    context: T;
+    prop: PropertyKey;
+    isConst: boolean;
+    isGlobal: boolean;
+    isVariable: boolean;
+    constructor(context: T, prop: PropertyKey, isConst?: boolean, isGlobal?: boolean, isVariable?: boolean);
+    get<T = unknown>(context: IExecContext): T;
+}
+export declare function hasOwnProperty(obj: unknown, prop: PropertyKey): boolean;
+export {};