@nocobase/plugin-flow-engine 2.0.0-alpha.2

package/dist/node_modules/ses/src/enable-property-overrides.js

@@ -0,0 +1,211 @@
+// Adapted from SES/Caja
+// Copyright (C) 2011 Google Inc.
+
+// @ts-check
+
+import {
+  Set,
+  String,
+  TypeError,
+  arrayForEach,
+  defineProperty,
+  getOwnPropertyDescriptor,
+  getOwnPropertyDescriptors,
+  isPrimitive,
+  hasOwn,
+  ownKeys,
+  setHas,
+} from './commons.js';
+
+import {
+  minEnablements,
+  moderateEnablements,
+  severeEnablements,
+} from './enablements.js';
+
+/** @import {Reporter} from './reporting-types.js' */
+
+/**
+ * For a special set of properties defined in the `enablement` list,
+ * `enablePropertyOverrides` ensures that the effect of freezing does not
+ * suppress the ability to override these properties on derived objects by
+ * simple assignment.
+ *
+ * Because of lack of sufficient foresight at the time, ES5 unfortunately
+ * specified that a simple assignment to a non-existent property must fail if
+ * it would override an non-writable data property of the same name in the
+ * shadow of the prototype chain. In retrospect, this was a mistake, the
+ * so-called "override mistake". But it is now too late and we must live with
+ * the consequences.
+ *
+ * As a result, simply freezing an object to make it tamper proof has the
+ * unfortunate side effect of breaking previously correct code that is
+ * considered to have followed JS best practices, if this previous code used
+ * assignment to override.
+ *
+ * For the enabled properties, `enablePropertyOverrides` effectively shims what
+ * the assignment behavior would have been in the absence of the override
+ * mistake. However, the shim produces an imperfect emulation. It shims the
+ * behavior by turning these data properties into accessor properties, where
+ * the accessor's getter and setter provide the desired behavior. For
+ * non-reflective operations, the illusion is perfect. However, reflective
+ * operations like `getOwnPropertyDescriptor` see the descriptor of an accessor
+ * property rather than the descriptor of a data property. At the time of this
+ * writing, this is the best we know how to do.
+ *
+ * To the getter of the accessor we add a property named
+ * `'originalValue'` whose value is, as it says, the value that the
+ * data property had before being converted to an accessor property. We add
+ * this extra property to the getter for two reason:
+ *
+ * The harden algorithm walks the own properties reflectively, i.e., with
+ * `getOwnPropertyDescriptor` semantics, rather than `[[Get]]` semantics. When
+ * it sees an accessor property, it does not invoke the getter. Rather, it
+ * proceeds to walk both the getter and setter as part of its transitive
+ * traversal. Without this extra property, `enablePropertyOverrides` would have
+ * hidden the original data property value from `harden`, which would be bad.
+ * Instead, by exposing that value in an own data property on the getter,
+ * `harden` finds and walks it anyway.
+ *
+ * We enable a form of cooperative emulation, giving reflective code an
+ * opportunity to cooperate in upholding the illusion. When such cooperative
+ * reflective code sees an accessor property, where the accessor's getter
+ * has an `originalValue` property, it knows that the getter is
+ * alleging that it is the result of the `enablePropertyOverrides` conversion
+ * pattern, so it can decide to cooperatively "pretend" that it sees a data
+ * property with that value.
+ *
+ * @param {Record<string, any>} intrinsics
+ * @param {'min' | 'moderate' | 'severe'} overrideTaming
+ * @param {Reporter} reporter
+ * @param {Iterable<string | symbol>} [overrideDebug]
+ */
+export default function enablePropertyOverrides(
+  intrinsics,
+  overrideTaming,
+  { warn },
+  overrideDebug = [],
+) {
+  const debugProperties = new Set(overrideDebug);
+  function enable(path, obj, prop, desc) {
+    if ('value' in desc && desc.configurable) {
+      const { value } = desc;
+
+      const isDebug = setHas(debugProperties, prop);
+
+      // We use concise method syntax to be `this` sensitive, but still
+      // omit a prototype property or [[Construct]] behavior.
+      // @ts-expect-error We know there is an accessor descriptor there
+      const { get: getter, set: setter } = getOwnPropertyDescriptor(
+        {
+          get [prop]() {
+            return value;
+          },
+          set [prop](newValue) {
+            if (obj === this) {
+              throw TypeError(
+                `Cannot assign to read only property '${String(
+                  prop,
+                )}' of '${path}'`,
+              );
+            }
+            if (hasOwn(this, prop)) {
+              this[prop] = newValue;
+            } else {
+              if (isDebug) {
+                warn(TypeError(`Override property ${prop}`));
+              }
+              defineProperty(this, prop, {
+                value: newValue,
+                writable: true,
+                enumerable: true,
+                configurable: true,
+              });
+            }
+          },
+        },
+        prop,
+      );
+
+      defineProperty(getter, 'originalValue', {
+        value,
+        writable: false,
+        enumerable: false,
+        configurable: false,
+      });
+
+      defineProperty(obj, prop, {
+        get: getter,
+        set: setter,
+        enumerable: desc.enumerable,
+        configurable: desc.configurable,
+      });
+    }
+  }
+
+  function enableProperty(path, obj, prop) {
+    const desc = getOwnPropertyDescriptor(obj, prop);
+    if (!desc) {
+      return;
+    }
+    enable(path, obj, prop, desc);
+  }
+
+  function enableAllProperties(path, obj) {
+    const descs = getOwnPropertyDescriptors(obj);
+    if (!descs) {
+      return;
+    }
+    // TypeScript does not allow symbols to be used as indexes because it
+    // cannot recokon types of symbolized properties.
+    arrayForEach(ownKeys(descs), prop => enable(path, obj, prop, descs[prop]));
+  }
+
+  function enableProperties(path, obj, plan) {
+    for (const prop of ownKeys(plan)) {
+      const desc = getOwnPropertyDescriptor(obj, prop);
+      if (!desc || desc.get || desc.set) {
+        // No not a value property, nothing to do.
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+
+      // In case `prop` is a symbol, we first coerce it with `String`,
+      // purely for diagnostic purposes.
+      const subPath = `${path}.${String(prop)}`;
+      const subPlan = plan[prop];
+
+      if (subPlan === true) {
+        enableProperty(subPath, obj, prop);
+      } else if (subPlan === '*') {
+        enableAllProperties(subPath, desc.value);
+      } else if (!isPrimitive(subPlan)) {
+        enableProperties(subPath, desc.value, subPlan);
+      } else {
+        throw TypeError(`Unexpected override enablement plan ${subPath}`);
+      }
+    }
+  }
+
+  let plan;
+  switch (overrideTaming) {
+    case 'min': {
+      plan = minEnablements;
+      break;
+    }
+    case 'moderate': {
+      plan = moderateEnablements;
+      break;
+    }
+    case 'severe': {
+      plan = severeEnablements;
+      break;
+    }
+    default: {
+      throw TypeError(`unrecognized overrideTaming ${overrideTaming}`);
+    }
+  }
+
+  // Do the repair.
+  enableProperties('root', intrinsics, plan);
+}

package/dist/node_modules/ses/src/enablements.js

@@ -0,0 +1,244 @@
+import { toStringTagSymbol, iteratorSymbol } from './commons.js';
+
+/**
+ * Exports {@code enablements}, a recursively defined
+ * JSON record defining the optimum set of intrinsics properties
+ * that need to be "repaired" before hardening is applied on
+ * enviromments subject to the override mistake.
+ *
+ * @author JF Paradis
+ * @author Mark S. Miller
+ *
+ * @module
+ */
+
+/**
+ * <p>Because "repairing" replaces data properties with accessors, every
+ * time a repaired property is accessed, the associated getter is invoked,
+ * which degrades the runtime performance of all code executing in the
+ * repaired enviromment, compared to the non-repaired case. In order
+ * to maintain performance, we only repair the properties of objects
+ * for which hardening causes a breakage of their normal intended usage.
+ *
+ * There are three unwanted cases:
+ * <ul>
+ * <li>Overriding properties on objects typically used as records,
+ *     namely {@code "Object"} and {@code "Array"}. In the case of arrays,
+ *     the situation is unintentional, a given program might not be aware
+ *     that non-numerical properties are stored on the underlying object
+ *     instance, not on the array. When an object is typically used as a
+ *     map, we repair all of its prototype properties.
+ * <li>Overriding properties on objects that provide defaults on their
+ *     prototype and that programs typically set using an assignment, such as
+ *     {@code "Error.prototype.message"} and {@code "Function.prototype.name"}
+ *     (both default to "").
+ * <li>Setting-up a prototype chain, where a constructor is set to extend
+ *     another one. This is typically set by assignment, for example
+ *     {@code "Child.prototype.constructor = Child"}, instead of invoking
+ *     Object.defineProperty();
+ *
+ * <p>Each JSON record enumerates the disposition of the properties on
+ * some corresponding intrinsic object.
+ *
+ * <p>For each such record, the values associated with its property
+ * names can be:
+ * <ul>
+ * <li>true, in which case this property is simply repaired. The
+ *     value associated with that property is not traversed. For
+ *     example, {@code "Function.prototype.name"} leads to true,
+ *     meaning that the {@code "name"} property of {@code
+ *     "Function.prototype"} should be repaired (which is needed
+ *     when inheriting from @code{Function} and setting the subclass's
+ *     {@code "prototype.name"} property). If the property is
+ *     already an accessor property, it is not repaired (because
+ *     accessors are not subject to the override mistake).
+ * <li>"*", in which case this property is not repaired but the
+ *     value associated with that property are traversed and repaired.
+ * <li>Another record, in which case this property is not repaired
+ *     and that next record represents the disposition of the object
+ *     which is its value. For example,{@code "FunctionPrototype"}
+ *     leads to another record explaining which properties {@code
+ *     Function.prototype} need to be repaired.
+ */
+
+/**
+ * Minimal enablements when all the code is modern and known not to
+ * step into the override mistake, except for the following pervasive
+ * cases.
+ */
+export const minEnablements = {
+  '%ObjectPrototype%': {
+    toString: true,
+  },
+
+  '%FunctionPrototype%': {
+    toString: true, // set by "rollup"
+  },
+
+  '%ErrorPrototype%': {
+    name: true, // set by "precond", "ava", "node-fetch"
+  },
+  '%IteratorPrototype%': {
+    toString: true,
+    // https://github.com/tc39/proposal-iterator-helpers
+    constructor: true,
+    // https://github.com/tc39/proposal-iterator-helpers
+    [toStringTagSymbol]: true,
+  },
+};
+
+/**
+ * Moderate enablements are usually good enough for legacy compat.
+ */
+export const moderateEnablements = {
+  '%ObjectPrototype%': {
+    toString: true,
+    valueOf: true,
+  },
+
+  '%ArrayPrototype%': {
+    toString: true,
+    push: true, // set by "Google Analytics"
+    concat: true, // set by mobx generated code (old TS compiler?)
+    [iteratorSymbol]: true, // set by mobx generated code (old TS compiler?)
+  },
+
+  // Function.prototype has no 'prototype' property to enable.
+  // Function instances have their own 'name' and 'length' properties
+  // which are configurable and non-writable. Thus, they are already
+  // non-assignable anyway.
+  '%FunctionPrototype%': {
+    constructor: true, // set by "regenerator-runtime"
+    bind: true, // set by "underscore", "express"
+    toString: true, // set by "rollup"
+  },
+
+  '%ErrorPrototype%': {
+    constructor: true, // set by "fast-json-patch", "node-fetch"
+    message: true,
+    name: true, // set by "precond", "ava", "node-fetch", "node 14"
+    toString: true, // set by "bluebird"
+  },
+
+  '%TypeErrorPrototype%': {
+    constructor: true, // set by "readable-stream"
+    message: true, // set by "tape"
+    name: true, // set by "readable-stream", "node 14"
+  },
+
+  '%SyntaxErrorPrototype%': {
+    message: true, // to match TypeErrorPrototype.message
+    name: true, // set by "node 14"
+  },
+
+  '%RangeErrorPrototype%': {
+    message: true, // to match TypeErrorPrototype.message
+    name: true, // set by "node 14"
+  },
+
+  '%URIErrorPrototype%': {
+    message: true, // to match TypeErrorPrototype.message
+    name: true, // set by "node 14"
+  },
+
+  '%EvalErrorPrototype%': {
+    message: true, // to match TypeErrorPrototype.message
+    name: true, // set by "node 14"
+  },
+
+  '%ReferenceErrorPrototype%': {
+    message: true, // to match TypeErrorPrototype.message
+    name: true, // set by "node 14"
+  },
+
+  // https://github.com/endojs/endo/issues/550
+  '%AggregateErrorPrototype%': {
+    message: true, // to match TypeErrorPrototype.message
+    name: true, // set by "node 14"?
+  },
+
+  '%PromisePrototype%': {
+    constructor: true, // set by "core-js"
+  },
+
+  '%TypedArrayPrototype%': '*', // set by https://github.com/feross/buffer
+
+  '%Generator%': {
+    constructor: true,
+    name: true,
+    toString: true,
+  },
+
+  '%IteratorPrototype%': {
+    toString: true,
+    // https://github.com/tc39/proposal-iterator-helpers
+    constructor: true,
+    // https://github.com/tc39/proposal-iterator-helpers
+    [toStringTagSymbol]: true,
+  },
+};
+
+/**
+ * The 'severe' enablement are needed because of issues tracked at
+ * https://github.com/endojs/endo/issues/576
+ *
+ * They are like the `moderate` enablements except for the entries below.
+ */
+export const severeEnablements = {
+  ...moderateEnablements,
+
+  /**
+   * Rollup (as used at least by vega) and webpack
+   * (as used at least by regenerator) both turn exports into assignments
+   * to a big `exports` object that inherits directly from
+   * `Object.prototype`. Some of the exported names we've seen include
+   * `hasOwnProperty`, `constructor`, and `toString`. But the strategy used
+   * by rollup and webpack potentionally turns any exported name
+   * into an assignment rejected by the override mistake. That's why
+   * the `severe` enablements takes the extreme step of enabling
+   * everything on `Object.prototype`.
+   *
+   * In addition, code doing inheritance manually will often override
+   * the `constructor` property on the new prototype by assignment. We've
+   * seen this several times.
+   *
+   * The cost of enabling all these is that they create a miserable debugging
+   * experience specifically on Node.
+   * https://github.com/Agoric/agoric-sdk/issues/2324
+   * explains how it confused the Node console.
+   *
+   * (TODO Reexamine the vscode situation. I think it may have improved
+   * since the following paragraph was written.)
+   *
+   * The vscode debugger's object inspector shows the own data properties of
+   * an object, which is typically what you want, but also shows both getter
+   * and setter for every accessor property whether inherited or own.
+   * With the `'*'` setting here, all the properties inherited from
+   * `Object.prototype` are accessors, creating an unusable display as seen
+   * at As explained at
+   * https://github.com/endojs/endo/blob/master/packages/ses/docs/lockdown.md#overridetaming-options
+   * Open the triangles at the bottom of that section.
+   */
+  '%ObjectPrototype%': '*',
+
+  /**
+   * The widely used Buffer defined at https://github.com/feross/buffer
+   * on initialization, manually creates the equivalent of a subclass of
+   * `TypedArray`, which it then initializes by assignment. These assignments
+   * include enough of the `TypeArray` methods that here, the `severe`
+   * enablements just enable them all.
+   */
+  '%TypedArrayPrototype%': '*',
+
+  /**
+   * Needed to work with Immer before https://github.com/immerjs/immer/pull/914
+   * is accepted.
+   */
+  '%MapPrototype%': '*',
+
+  /**
+   * Needed to work with Immer before https://github.com/immerjs/immer/pull/914
+   * is accepted.
+   */
+  '%SetPrototype%': '*',
+};