@endo/lockdown 1.0.14 → 1.0.16

package/SECURITY.md

@@ -8,9 +8,9 @@ be made for the most recent branch only.
 
 ## Coordinated Vulnerability Disclosure of Security Bugs
 
-SES stands for fearless cooperation, and strong security requires strong collaboration with security researchers. If you believe that you have found a security sensitive bug that should not be disclosed until a fix has been made available, we encourage you to report it. To report a bug in HardenedJS, you have several options that include: 
+SES stands for fearless cooperation, and strong security requires strong collaboration with security researchers. If you believe that you have found a security sensitive bug that should not be disclosed until a fix has been made available, we encourage you to report it. To report a bug in HardenedJS, you have several options that include:
 
-* Reporting the issue to the [Agoric HackerOne vulnerability rewards program](https://hackerone.com/agoric). 
+* Reporting the issue to the [Agoric HackerOne vulnerability rewards program](https://hackerone.com/agoric).
 
 * Sending an email to security at (@) agoric.com., encrypted or unencrypted. To encrypt, please use  @Warner’s personal GPG key  [A476E2E6 11880C98 5B3C3A39 0386E81B 11CAA07A](http://www.lothar.com/warner-gpg.html)  .
 

package/commit-debug.js

@@ -21,13 +21,13 @@ lockdown({
   // NOTE TO REVIEWERS: If you see the following line commented out,
   // this may be a development accident that should be fixed before merging.
   //
-  errorTaming: 'unsafe-debug',
+  errorTaming: 'unsafe',
 
   // The default `{stackFiltering: 'concise'}` setting usually makes for a
   // better debugging experience, by severely reducing the noisy distractions
   // of the normal verbose stack traces. Which is why we comment
-  // out the `'verbose'` setting is commented out below. However, some
-  // tools look for the full filename that it expects in order
+  // out the other settings below. However, some
+  // tools look for the full filename path that it expects in order
   // to fetch the source text for diagnostics,
   //
   // Another reason for not commenting it out: The cause
@@ -36,10 +36,14 @@ lockdown({
   // uncomment out the following line. But please do not commit it in that
   // state.
   //
-  // NOTE TO REVIEWERS: If you see the following line *not* commented out,
-  // this may be a development accident that MUST be fixed before merging.
+  // NOTE TO REVIEWERS: If you see the `stackFiltering` settings *not*
+  // commented out below, this may be a development accident that MUST be
+  // fixed before merging.
   //
-  // stackFiltering: 'verbose',
+  // stackFiltering: 'concise', // Omit frames and shorten paths
+  // stackFiltering: 'omit-frames', // Only omit frames. Do not shorten paths
+  // stackFiltering: 'shorten-paths', // Only shorten paths. Do not omit frames
+  // stackFiltering: 'verbose', // Do not omit frames or shorten paths
 
   // The default `{overrideTaming: 'moderate'}` setting does not hurt the
   // debugging experience much. But it will introduce noise into, for example,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@endo/lockdown",
-  "version": "1.0.14",
+  "version": "1.0.16",
   "description": "Wrappers for hardening JavaScript for Endo",
   "type": "module",
   "main": "pre.js",
@@ -16,13 +16,12 @@
     "build": "exit 0",
     "test": "exit 0",
     "test:xs": "exit 0",
-    "lint-check": "yarn lint",
     "lint-fix": "eslint --fix '**/*.js'",
     "lint": "eslint '**/*.js'",
     "postpack": "git clean -f '*.d.ts*' '*.tsbuildinfo'"
   },
   "dependencies": {
-    "ses": "^1.11.0"
+    "ses": "^1.13.0"
   },
   "files": [
     "./*.d.ts",
@@ -62,5 +61,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "e0683e0bfdbfc84351af332c9e78813d7b67ef89"
+  "gitHead": "571b7803cf10df7cb4fa9d70e4d53a0b53767fa8"
 }

package/pre.js

@@ -102,13 +102,12 @@ export const lockdown = defaultOptions => {
       // this may be a development accident that MUST be fixed before merging.
       //
       // errorTaming: 'unsafe',
-      //
-      //
+
       // The default `{stackFiltering: 'concise'}` setting usually makes for a
       // better debugging experience, by severely reducing the noisy distractions
       // of the normal verbose stack traces. Which is why we comment
-      // out the `'verbose'` setting is commented out below. However, some
-      // tools look for the full filename that it expects in order
+      // out the other settings below. However, some
+      // tools look for the full filename path that it expects in order
       // to fetch the source text for diagnostics,
       //
       // Another reason for not commenting it out: The cause
@@ -117,12 +116,15 @@ export const lockdown = defaultOptions => {
       // uncomment out the following line. But please do not commit it in that
       // state.
       //
-      // NOTE TO REVIEWERS: If you see the following line *not* commented out,
-      // this may be a development accident that MUST be fixed before merging.
-      //
-      // stackFiltering: 'verbose',
-      //
+      // NOTE TO REVIEWERS: If you see the `stackFiltering` settings *not*
+      // commented out below, this may be a development accident that MUST be
+      // fixed before merging.
       //
+      // stackFiltering: 'concise', // Omit frames and shorten paths
+      // stackFiltering: 'omit-frames', // Only omit frames. Do not shorten paths
+      // stackFiltering: 'shorten-paths', // Only shorten paths. Do not omit frames
+      // stackFiltering: 'verbose', // Do not omit frames or shorten paths
+
       // The default `{overrideTaming: 'moderate'}` setting does not hurt the
       // debugging experience much. But it will introduce noise into, for example,
       // the vscode debugger's object inspector. During debug and test, if you can
@@ -134,8 +136,7 @@ export const lockdown = defaultOptions => {
       // this may be a development accident that MUST be fixed before merging.
       //
       // overrideTaming: 'min',
-      //
-      //
+
       // The default `{consoleTaming: 'safe'}` setting usually makes for a
       // better debugging experience, by wrapping the original `console` with
       // the SES replacement `console` that provides more information about