@jsenv/plugin-commonjs 2.5.1 → 2.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/plugin-commonjs",
-  "version": "2.5.1",
+  "version": "2.6.1",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -28,16 +28,15 @@
     "@jsenv/log": "3.4.0",
     "@jsenv/url-meta": "8.1.0",
     "@jsenv/urls": "2.2.1",
-    "@rollup/plugin-commonjs": "25.0.3",
+    "@rollup/plugin-commonjs": "25.0.4",
     "@rollup/plugin-json": "6.0.0",
-    "@rollup/plugin-node-resolve": "15.1.0",
+    "@rollup/plugin-node-resolve": "15.2.1",
     "@rollup/plugin-replace": "5.0.2",
     "cjs-module-lexer": "1.2.3",
     "is-valid-identifier": "2.0.2",
-    "resolve": "1.22.2",
-    "rollup": "3.27.0",
+    "resolve": "1.22.4",
+    "rollup": "3.29.1",
     "rollup-plugin-node-globals": "1.4.0",
-    "rollup-plugin-polyfill-node": "0.12.0",
-    "vm2": "3.9.19"
+    "rollup-plugin-polyfill-node": "0.12.0"
   }
 }

package/src/rollup_plugin_commonjs_named_exports.js

@@ -3,7 +3,7 @@
 import { readFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import path from "node:path";
-import { VM as VM2 } from "vm2";
+import { Worker } from "node:worker_threads";
 import resolve from "resolve";
 import isValidIdentifier from "is-valid-identifier";
 import { init, parse } from "cjs-module-lexer";
@@ -27,23 +27,29 @@ export const rollupPluginCommonJsNamedExports = ({ logger }) => {
     name: "scan_cjs_named_exports",
     async buildStart({ input }) {
       await init();
-      Object.keys(input).forEach((key) => {
-        const inputFilePath = input[key];
-        const namedCjs =
-          detectStaticExports({ logger, filePath: inputFilePath }) ||
-          detectExportsUsingSandboxedRuntime({
+      await Promise.all(
+        Object.keys(input).map(async (key) => {
+          const inputFilePath = input[key];
+          let namedCjs = detectStaticExports({
             logger,
             filePath: inputFilePath,
           });
-        scanResults[inputFilePath] = {
-          all: true,
-          default: true,
-          namespace: true,
-          named: [],
-          namedCjs,
-        };
-        input[key] = importWrapper.wrap(inputFilePath);
-      });
+          if (!namedCjs) {
+            namedCjs = await detectExportsUsingSandboxedRuntime({
+              logger,
+              filePath: inputFilePath,
+            });
+          }
+          scanResults[inputFilePath] = {
+            all: true,
+            default: true,
+            namespace: true,
+            named: [],
+            namedCjs,
+          };
+          input[key] = importWrapper.wrap(inputFilePath);
+        }),
+      );
     },
     resolveId(specifier) {
       if (importWrapper.isWrapped(specifier)) {
@@ -126,20 +132,36 @@ const detectStaticExports = ({ logger, filePath, visited = new Set() }) => {
 /*
  * Attempt #2b - Sandboxed runtime analysis: More powerful, but slower.
  * This will only work on UMD and very simple CJS files (require not supported).
- * Uses VM2 to run safely sandbox untrusted code (no access no Node.js primitives, just JS).
+ * run safely sandbox untrusted code (no access no Node.js primitives, just JS).
  * If nothing was detected, return undefined.
  */
-const detectExportsUsingSandboxedRuntime = ({ logger, filePath }) => {
+export const detectExportsUsingSandboxedRuntime = async ({
+  logger,
+  filePath,
+}) => {
   try {
-    const fileContents = readFileSync(filePath, "utf8");
-    const vm = new VM2({ wasm: false, fixAsync: false });
-    const codeToRun = wrapCodeToRunInVm(fileContents);
-    const vmResult = vm.run(codeToRun);
-    const exportsResult = Object.keys(vmResult);
+    const workerThread = new Worker(
+      new URL("./worker_runtime.mjs", import.meta.url),
+    );
+    workerThread.postMessage({
+      filePath,
+    });
+    const promise = new Promise((resolve, reject) => {
+      workerThread.on("error", reject);
+      workerThread.on("message", (message) => {
+        resolve(message);
+        workerThread.terminate();
+      });
+    });
+    const result = await promise;
+    if (result.errorMessage) {
+      throw new Error(result.errorMessage);
+    }
+    const exportNames = result.exportNames;
     logger.debug(
-      `detectExportsUsingSandboxedRuntime success ${filePath}: ${exportsResult}`,
+      `detectExportsUsingSandboxedRuntime success ${filePath}: ${exportNames}`,
     );
-    return exportsResult.filter((identifier) => isValidIdentifier(identifier));
+    return exportNames.filter((identifier) => isValidIdentifier(identifier));
   } catch (err) {
     logger.debug(
       `detectExportsUsingSandboxedRuntime error ${filePath}: ${err.message}`,
@@ -151,13 +173,6 @@ const detectExportsUsingSandboxedRuntime = ({ logger, filePath }) => {
 const isValidNamedExport = (name) =>
   name !== "default" && name !== "__esModule" && isValidIdentifier(name);
 
-const wrapCodeToRunInVm = (code) => {
-  return `const exports = {};
-const module = { exports };
-${code};;
-module.exports;`;
-};
-
 const generateCodeForExports = ({
   uniqueNamedExports,
   scanResult,

package/src/worker_runtime.mjs

@@ -0,0 +1,34 @@
+import { parentPort } from "node:worker_threads";
+import { readFileSync } from "node:fs";
+import vm from "node:vm";
+
+parentPort.once("message", ({ filePath }) => {
+  const fileContents = readFileSync(filePath, "utf8");
+  const codeToRun = wrapCodeToRunInVm(fileContents);
+  const script = new vm.Script(codeToRun);
+  try {
+    const returnValue = script.runInNewContext(
+      {},
+      {
+        contextCodeGeneration: {
+          wasm: false,
+        },
+      },
+    );
+    const exportNames = Object.keys(returnValue);
+    parentPort.postMessage({
+      exportNames,
+    });
+  } catch (e) {
+    parentPort.postMessage({
+      errorMessage: e.message,
+    });
+  }
+});
+
+const wrapCodeToRunInVm = (code) => {
+  return `const exports = {};
+const module = { exports };
+${code};;
+module.exports;`;
+};