@nocobase/plugin-flow-engine 2.0.0-alpha.2

package/dist/node_modules/ses/src/error/types.js

@@ -0,0 +1,59 @@
+// @ts-check
+
+/** @import {GenericErrorConstructor, AssertMakeErrorOptions, DetailsToken, StringablePayload} from '../../types.js' */
+
+/**
+ * @typedef {object} VirtualConsole
+ * @property {Console['debug']} debug
+ * @property {Console['log']} log
+ * @property {Console['info']} info
+ * @property {Console['warn']} warn
+ * @property {Console['error']} error
+ *
+ * @property {Console['trace']} trace
+ * @property {Console['dirxml']} dirxml
+ * @property {Console['group']} group
+ * @property {Console['groupCollapsed']} groupCollapsed
+ *
+ * @property {Console['assert']} assert
+ * @property {Console['timeLog']} timeLog
+ *
+ * @property {Console['clear']} clear
+ * @property {Console['count']} count
+ * @property {Console['countReset']} countReset
+ * @property {Console['dir']} dir
+ * @property {Console['groupEnd']} groupEnd
+ *
+ * @property {Console['table']} table
+ * @property {Console['time']} time
+ * @property {Console['timeEnd']} timeEnd
+ * @property {Console['timeStamp']} timeStamp
+ */
+
+/* This is deliberately *not* JSDoc, it is a regular comment.
+ *
+ * TODO: We'd like to add the following properties to the above
+ * VirtualConsole, but they currently cause conflicts where
+ * some Typescript implementations don't have these properties
+ * on the Console type.
+ *
+ * @property {Console['profile']} profile
+ * @property {Console['profileEnd']} profileEnd
+ */
+
+/**
+ * @typedef {'debug' | 'log' | 'info' | 'warn' | 'error'} LogSeverity
+ */
+
+/**
+ * @typedef ConsoleFilter
+ * @property {(severity: LogSeverity) => boolean} canLog
+ */
+
+/**
+ * @callback FilterConsole
+ * @param {VirtualConsole} baseConsole
+ * @param {ConsoleFilter} filter
+ * @param {string} [topic]
+ * @returns {VirtualConsole}
+ */

package/dist/node_modules/ses/src/error/unhandled-rejection.js

@@ -0,0 +1,122 @@
+// @ts-check
+import {
+  FinalizationRegistry,
+  Map,
+  mapGet,
+  mapDelete,
+  WeakMap,
+  mapSet,
+  finalizationRegistryRegister,
+  weakmapSet,
+  weakmapGet,
+  mapEntries,
+  mapHas,
+} from '../commons.js';
+
+/**
+ * Create rejection-tracking machinery compatible with Node.js and browsers.
+ *
+ * Note that modern browsers *prevent* access to the 'unhandledrejection' and
+ * 'rejectionhandled' events needed:
+ * - in cross-origin mode, like when served from file://
+ * - in the browser console (interactively typed-in code)
+ * - in the debugger
+ *
+ * Then, they just look like: `Uncaught (in promise) Error: ...` and don't
+ * implement the machinery.
+ *
+ * The solution is to serve your web page from an http:// or https:// web server
+ * and execute actual code.
+ *
+ * @param {(reason: unknown) => void} reportReason report the reason for an
+ * unhandled rejection.
+ */
+export const makeRejectionHandlers = reportReason => {
+  if (FinalizationRegistry === undefined) {
+    return undefined;
+  }
+
+  /** @typedef {number} ReasonId */
+  let lastReasonId = 0;
+
+  /** @type {Map<ReasonId, unknown>} */
+  const idToReason = new Map();
+
+  /** @type {(() => void) | undefined} */
+  let cancelChecking;
+
+  const removeReasonId = reasonId => {
+    mapDelete(idToReason, reasonId);
+    if (cancelChecking && idToReason.size === 0) {
+      // No more unhandled rejections to check, just cancel the check.
+      cancelChecking();
+      cancelChecking = undefined;
+    }
+  };
+
+  /** @type {WeakMap<Promise, ReasonId>} */
+  const promiseToReasonId = new WeakMap();
+
+  /**
+   * Clean up and report the reason for a GCed unhandled rejection.
+   *
+   * @param {ReasonId} heldReasonId
+   */
+  const finalizeDroppedPromise = heldReasonId => {
+    if (mapHas(idToReason, heldReasonId)) {
+      const reason = mapGet(idToReason, heldReasonId);
+      removeReasonId(heldReasonId);
+      reportReason(reason);
+    }
+  };
+
+  /** @type {FinalizationRegistry<ReasonId>} */
+  const promiseToReason = new FinalizationRegistry(finalizeDroppedPromise);
+
+  /**
+   * Track a rejected promise and its corresponding reason if there is no
+   * rejection handler synchronously attached.
+   *
+   * @param {unknown} reason
+   * @param {Promise} pr
+   */
+  const unhandledRejectionHandler = (reason, pr) => {
+    lastReasonId += 1;
+    const reasonId = lastReasonId;
+
+    // Update bookkeeping.
+    mapSet(idToReason, reasonId, reason);
+    weakmapSet(promiseToReasonId, pr, reasonId);
+    finalizationRegistryRegister(promiseToReason, pr, reasonId, pr);
+  };
+
+  /**
+   * Deal with the addition of a handler to a previously rejected promise.
+   *
+   * Just remove it from our list.  Let the FinalizationRegistry or
+   * processTermination report any GCed unhandled rejected promises.
+   *
+   * @param {Promise} pr
+   */
+  const rejectionHandledHandler = pr => {
+    const reasonId = weakmapGet(promiseToReasonId, pr);
+    removeReasonId(reasonId);
+  };
+
+  /**
+   * Report all the unhandled rejections, now that we are abruptly terminating
+   * the agent cluster.
+   */
+  const processTerminationHandler = () => {
+    for (const [reasonId, reason] of mapEntries(idToReason)) {
+      removeReasonId(reasonId);
+      reportReason(reason);
+    }
+  };
+
+  return {
+    rejectionHandledHandler,
+    unhandledRejectionHandler,
+    processTerminationHandler,
+  };
+};

package/dist/node_modules/ses/src/eval-scope.js

@@ -0,0 +1,89 @@
+import { FERAL_EVAL, create, defineProperties, freeze } from './commons.js';
+
+import { assert } from './error/assert.js';
+
+const { Fail } = assert;
+
+// We attempt to frustrate stack bumping attacks on the safe evaluator
+// (`make-safe-evaluator.js`).
+// A stack bumping attack forces an API call to throw a stack overflow
+// `RangeError` at an inopportune time.
+// The attacker arranges for the stack to be sufficiently deep that the API
+// consumes exactly enough stack frames to throw an exception.
+//
+// For the safe evaluator, an exception thrown between adding and then deleting
+// `eval` on `evalScope` could leak the real `eval` to an attacker's lexical
+// scope.
+// This would be sufficiently disastrous that we guard against it twice.
+// First, we delete `eval` from `evalScope` immediately before rendering it to
+// the guest program's lexical scope.
+//
+// If the attacker manages to arrange for `eval` to throw an exception after we
+// call `allowNextEvalToBeUnsafe` but before the guest program accesses `eval`,
+// it would be able to access `eval` once more in its own code.
+// Although they could do no harm with a direct `eval`, they would be able to
+// escape to the true global scope with an indirect `eval`.
+//
+//   prepareStack(depth, () => {
+//     (eval)('');
+//   });
+//   const unsafeEval = (eval);
+//   const safeEval = (eval);
+//   const realGlobal = unsafeEval('globalThis');
+//
+// To protect against that case, we also delete `eval` from the `evalScope` in
+// a `finally` block surrounding the call to the safe evaluator.
+// The only way to reach this case is if `eval` remains on `evalScope` due to
+// an attack, so we assume that attack would have have invalided our isolation
+// and revoke all future access to the evaluator.
+//
+// To defeat a stack bumping attack, we must use fewer stack frames to recover
+// in that `finally` block than we used in the `try` block.
+// We have no reliable guarantees about how many stack frames a block of
+// JavaScript will consume.
+// Function inlining, tail-call optimization, variations in the size of a stack
+// frame, and block scopes may affect the depth of the stack.
+// The only number of acceptable stack frames to use in the finally block is
+// zero.
+// We only use property assignment and deletion in the safe evaluator's
+// `finally` block.
+// We use `delete evalScope.eval` to withhold the evaluator.
+// We assign an envelope object over `evalScopeKit.revoked` to revoke the
+// evaluator.
+//
+// This is why we supply a meaningfully named function for
+// `allowNextEvalToBeUnsafe` but do not provide a corresponding
+// `revokeAccessToUnsafeEval` or even simply `revoke`.
+// These recovery routines are expressed inline in the safe evaluator.
+
+export const makeEvalScopeKit = () => {
+  const evalScope = create(null);
+  const oneTimeEvalProperties = freeze({
+    eval: {
+      get() {
+        delete evalScope.eval;
+        return FERAL_EVAL;
+      },
+      enumerable: false,
+      configurable: true,
+    },
+  });
+
+  const evalScopeKit = {
+    evalScope,
+    allowNextEvalToBeUnsafe() {
+      const { revoked } = evalScopeKit;
+      if (revoked !== null) {
+        Fail`a handler did not reset allowNextEvalToBeUnsafe ${revoked.err}`;
+      }
+      // Allow next reference to eval produce the unsafe FERAL_EVAL.
+      // We avoid defineProperty because it consumes an extra stack frame taming
+      // its return value.
+      defineProperties(evalScope, oneTimeEvalProperties);
+    },
+    /** @type {null | { err: any }} */
+    revoked: null,
+  };
+
+  return evalScopeKit;
+};

package/dist/node_modules/ses/src/get-anonymous-intrinsics.js

@@ -0,0 +1,181 @@
+import {
+  FERAL_FUNCTION,
+  Float32Array,
+  Map,
+  Set,
+  String,
+  getOwnPropertyDescriptor,
+  getPrototypeOf,
+  iterateArray,
+  iterateMap,
+  iterateSet,
+  iterateString,
+  matchAllRegExp,
+  matchAllSymbol,
+  regexpPrototype,
+  globalThis,
+  assign,
+  AsyncGeneratorFunctionInstance,
+  ArrayBuffer,
+} from './commons.js';
+import { InertCompartment } from './compartment.js';
+
+/**
+ * Object.getConstructorOf()
+ * Helper function to improve readability, similar to Object.getPrototypeOf().
+ *
+ * @param {object} obj
+ */
+function getConstructorOf(obj) {
+  return getPrototypeOf(obj).constructor;
+}
+
+// getAnonymousIntrinsics uses a utility function to construct an arguments
+// object, since it cannot have one of its own and also be a const export.
+function makeArguments() {
+  // eslint-disable-next-line prefer-rest-params
+  return arguments;
+}
+
+/**
+ * getAnonymousIntrinsics()
+ * Get the intrinsics not otherwise reachable by named own property
+ * traversal from the global object.
+ *
+ * @returns {object}
+ */
+export const getAnonymousIntrinsics = () => {
+  const InertFunction = FERAL_FUNCTION.prototype.constructor;
+
+  // 9.2.4.1 %ThrowTypeError%
+
+  const argsCalleeDesc = getOwnPropertyDescriptor(makeArguments(), 'callee');
+  const ThrowTypeError = argsCalleeDesc && argsCalleeDesc.get;
+
+  // 21.1.5.2 The %StringIteratorPrototype% Object
+
+  // eslint-disable-next-line no-new-wrappers
+  const StringIteratorObject = iterateString(new String());
+  const StringIteratorPrototype = getPrototypeOf(StringIteratorObject);
+
+  // 21.2.7.1 The %RegExpStringIteratorPrototype% Object
+  const RegExpStringIterator =
+    regexpPrototype[matchAllSymbol] && matchAllRegExp(/./);
+  const RegExpStringIteratorPrototype =
+    RegExpStringIterator && getPrototypeOf(RegExpStringIterator);
+
+  // 22.1.5.2 The %ArrayIteratorPrototype% Object
+
+  // eslint-disable-next-line no-array-constructor
+  const ArrayIteratorObject = iterateArray([]);
+  const ArrayIteratorPrototype = getPrototypeOf(ArrayIteratorObject);
+
+  // 22.2.1 The %TypedArray% Intrinsic Object
+
+  const TypedArray = getPrototypeOf(Float32Array);
+
+  // 23.1.5.2 The %MapIteratorPrototype% Object
+
+  const MapIteratorObject = iterateMap(new Map());
+  const MapIteratorPrototype = getPrototypeOf(MapIteratorObject);
+
+  // 23.2.5.2 The %SetIteratorPrototype% Object
+
+  const SetIteratorObject = iterateSet(new Set());
+  const SetIteratorPrototype = getPrototypeOf(SetIteratorObject);
+
+  // 25.1.2 The %IteratorPrototype% Object
+
+  const IteratorPrototype = getPrototypeOf(ArrayIteratorPrototype);
+
+  // 25.2.1 The GeneratorFunction Constructor
+
+  // eslint-disable-next-line no-empty-function
+  function* GeneratorFunctionInstance() {}
+  const GeneratorFunction = getConstructorOf(GeneratorFunctionInstance);
+
+  // 25.2.3 Properties of the GeneratorFunction Prototype Object
+
+  const Generator = GeneratorFunction.prototype;
+
+  // 25.7.1 The AsyncFunction Constructor
+
+  // eslint-disable-next-line no-empty-function
+  async function AsyncFunctionInstance() {}
+  const AsyncFunction = getConstructorOf(AsyncFunctionInstance);
+
+  const intrinsics = {
+    '%InertFunction%': InertFunction,
+    '%ArrayIteratorPrototype%': ArrayIteratorPrototype,
+    '%InertAsyncFunction%': AsyncFunction,
+    '%Generator%': Generator,
+    '%InertGeneratorFunction%': GeneratorFunction,
+    '%IteratorPrototype%': IteratorPrototype,
+    '%MapIteratorPrototype%': MapIteratorPrototype,
+    '%RegExpStringIteratorPrototype%': RegExpStringIteratorPrototype,
+    '%SetIteratorPrototype%': SetIteratorPrototype,
+    '%StringIteratorPrototype%': StringIteratorPrototype,
+    '%ThrowTypeError%': ThrowTypeError,
+    '%TypedArray%': TypedArray,
+    '%InertCompartment%': InertCompartment,
+  };
+
+  if (AsyncGeneratorFunctionInstance !== undefined) {
+    // 25.3.1 The AsyncGeneratorFunction Constructor
+
+    const AsyncGeneratorFunction = getConstructorOf(
+      AsyncGeneratorFunctionInstance,
+    );
+
+    // 25.3.2.2 AsyncGeneratorFunction.prototype
+    const AsyncGenerator = AsyncGeneratorFunction.prototype;
+    // 25.5.1 Properties of the AsyncGenerator Prototype Object
+    const AsyncGeneratorPrototype = AsyncGenerator.prototype;
+    const AsyncIteratorPrototype = getPrototypeOf(AsyncGeneratorPrototype);
+
+    assign(intrinsics, {
+      '%AsyncGenerator%': AsyncGenerator,
+      '%InertAsyncGeneratorFunction%': AsyncGeneratorFunction,
+      '%AsyncGeneratorPrototype%': AsyncGeneratorPrototype,
+      '%AsyncIteratorPrototype%': AsyncIteratorPrototype,
+    });
+  }
+
+  if (globalThis.Iterator) {
+    intrinsics['%IteratorHelperPrototype%'] = getPrototypeOf(
+      // eslint-disable-next-line @endo/no-polymorphic-call
+      globalThis.Iterator.from([]).take(0),
+    );
+    intrinsics['%WrapForValidIteratorPrototype%'] = getPrototypeOf(
+      // eslint-disable-next-line @endo/no-polymorphic-call
+      globalThis.Iterator.from({
+        next() {
+          return { value: undefined };
+        },
+      }),
+    );
+  }
+
+  if (globalThis.AsyncIterator) {
+    intrinsics['%AsyncIteratorHelperPrototype%'] = getPrototypeOf(
+      // eslint-disable-next-line @endo/no-polymorphic-call
+      globalThis.AsyncIterator.from([]).take(0),
+    );
+    intrinsics['%WrapForValidAsyncIteratorPrototype%'] = getPrototypeOf(
+      // eslint-disable-next-line @endo/no-polymorphic-call
+      globalThis.AsyncIterator.from({ next() {} }),
+    );
+  }
+
+  const ab = new ArrayBuffer(0);
+  // @ts-expect-error TODO How do I add sliceToImmutable to ArrayBuffer type?
+  // eslint-disable-next-line @endo/no-polymorphic-call
+  const iab = ab.sliceToImmutable();
+  const iabProto = getPrototypeOf(iab);
+  if (iabProto !== ArrayBuffer.prototype) {
+    // In a native implementation, these will be the same prototype
+    intrinsics['%ImmutableArrayBufferPrototype%'] = iabProto;
+  }
+
+  return intrinsics;
+};

package/dist/node_modules/ses/src/get-source-url.js

@@ -0,0 +1,50 @@
+import { FERAL_REG_EXP, regexpExec, stringSlice } from './commons.js';
+
+// Captures a key and value of the form #key=value or @key=value
+const sourceMetaEntryRegExp =
+  '\\s*[@#]\\s*([a-zA-Z][a-zA-Z0-9]*)\\s*=\\s*([^\\s\\*]*)';
+// Captures either a one-line or multi-line comment containing
+// one #key=value or @key=value.
+// Produces two pairs of capture groups, but the initial two may be undefined.
+// On account of the mechanics of regular expressions, scanning from the end
+// does not allow us to capture every pair, so getSourceURL must capture and
+// trim until there are no matching comments.
+const sourceMetaEntriesRegExp = new FERAL_REG_EXP(
+  `(?:\\s*//${sourceMetaEntryRegExp}|/\\*${sourceMetaEntryRegExp}\\s*\\*/)\\s*$`,
+);
+
+/**
+ * @param {string} src
+ */
+export const getSourceURL = src => {
+  let sourceURL = '<unknown>';
+
+  // Our regular expression matches the last one or two comments with key value
+  // pairs at the end of the source, avoiding a scan over the entire length of
+  // the string, but at the expense of being able to capture all the (key,
+  // value) pair meta comments at the end of the source, which may include
+  // sourceMapURL in addition to sourceURL.
+  // So, we sublimate the comments out of the source until no source or no
+  // comments remain.
+  while (src.length > 0) {
+    const match = regexpExec(sourceMetaEntriesRegExp, src);
+    if (match === null) {
+      break;
+    }
+    src = stringSlice(src, 0, src.length - match[0].length);
+
+    // We skip $0 since it contains the entire match.
+    // The match contains four capture groups,
+    // two (key, value) pairs, the first of which
+    // may be undefined.
+    // On the off-chance someone put two sourceURL comments in their code with
+    // different commenting conventions, the latter has precedence.
+    if (match[3] === 'sourceURL') {
+      sourceURL = match[4];
+    } else if (match[1] === 'sourceURL') {
+      sourceURL = match[2];
+    }
+  }
+
+  return sourceURL;
+};

package/dist/node_modules/ses/src/global-object.js

@@ -0,0 +1,175 @@
+import {
+  TypeError,
+  assign,
+  create,
+  defineProperty,
+  entries,
+  freeze,
+  hasOwn,
+  unscopablesSymbol,
+} from './commons.js';
+import { makeEvalFunction } from './make-eval-function.js';
+import { makeFunctionConstructor } from './make-function-constructor.js';
+import { constantProperties, universalPropertyNames } from './permits.js';
+
+/**
+ * The host's ordinary global object is not provided by a `with` block, so
+ * assigning to Symbol.unscopables has no effect.
+ * Since this shim uses `with` blocks to create a confined lexical scope for
+ * guest programs, we cannot emulate the proper behavior.
+ * With this shim, assigning Symbol.unscopables causes the given lexical
+ * names to fall through to the terminal scope proxy.
+ * But, we can install this setter to prevent a program from proceding on
+ * this false assumption.
+ *
+ * @param {object} globalObject
+ */
+export const setGlobalObjectSymbolUnscopables = globalObject => {
+  defineProperty(
+    globalObject,
+    unscopablesSymbol,
+    freeze(
+      assign(create(null), {
+        set: freeze(() => {
+          throw TypeError(
+            `Cannot set Symbol.unscopables of a Compartment's globalThis`,
+          );
+        }),
+        enumerable: false,
+        configurable: false,
+      }),
+    ),
+  );
+};
+
+/**
+ * setGlobalObjectConstantProperties()
+ * Initializes a new global object using a process similar to ECMA specifications
+ * (SetDefaultGlobalBindings). This process is split between this function and
+ * `setGlobalObjectMutableProperties`.
+ *
+ * @param {object} globalObject
+ */
+export const setGlobalObjectConstantProperties = globalObject => {
+  for (const [name, constant] of entries(constantProperties)) {
+    defineProperty(globalObject, name, {
+      value: constant,
+      writable: false,
+      enumerable: false,
+      configurable: false,
+    });
+  }
+};
+
+/**
+ * setGlobalObjectMutableProperties()
+ * Create new global object using a process similar to ECMA specifications
+ * (portions of SetRealmGlobalObject and SetDefaultGlobalBindings).
+ * `newGlobalPropertyNames` should be either `initialGlobalPropertyNames` or
+ * `sharedGlobalPropertyNames`.
+ *
+ * @param {object} globalObject
+ * @param {object} args
+ * @param {object} args.intrinsics
+ * @param {object} args.newGlobalPropertyNames
+ * @param {Function} args.makeCompartmentConstructor
+ * @param {(object) => void} args.markVirtualizedNativeFunction
+ * @param {Compartment} [args.parentCompartment]
+ */
+export const setGlobalObjectMutableProperties = (
+  globalObject,
+  {
+    intrinsics,
+    newGlobalPropertyNames,
+    makeCompartmentConstructor,
+    markVirtualizedNativeFunction,
+    parentCompartment,
+  },
+) => {
+  for (const [name, intrinsicName] of entries(universalPropertyNames)) {
+    if (hasOwn(intrinsics, intrinsicName)) {
+      defineProperty(globalObject, name, {
+        value: intrinsics[intrinsicName],
+        writable: true,
+        enumerable: false,
+        configurable: true,
+      });
+    }
+  }
+
+  for (const [name, intrinsicName] of entries(newGlobalPropertyNames)) {
+    if (hasOwn(intrinsics, intrinsicName)) {
+      defineProperty(globalObject, name, {
+        value: intrinsics[intrinsicName],
+        writable: true,
+        enumerable: false,
+        configurable: true,
+      });
+    }
+  }
+
+  const perCompartmentGlobals = {
+    globalThis: globalObject,
+  };
+
+  perCompartmentGlobals.Compartment = freeze(
+    makeCompartmentConstructor(
+      makeCompartmentConstructor,
+      intrinsics,
+      markVirtualizedNativeFunction,
+      {
+        parentCompartment,
+        enforceNew: true,
+      },
+    ),
+  );
+
+  // TODO These should still be tamed according to the permits before
+  // being made available.
+  for (const [name, value] of entries(perCompartmentGlobals)) {
+    defineProperty(globalObject, name, {
+      value,
+      writable: true,
+      enumerable: false,
+      configurable: true,
+    });
+    if (typeof value === 'function') {
+      markVirtualizedNativeFunction(value);
+    }
+  }
+};
+
+/**
+ * setGlobalObjectEvaluators()
+ * Set the eval and the Function evaluator on the global object with given evalTaming policy.
+ *
+ * @param {object} globalObject
+ * @param {Function} evaluator
+ * @param {(object) => void} markVirtualizedNativeFunction
+ */
+export const setGlobalObjectEvaluators = (
+  globalObject,
+  evaluator,
+  markVirtualizedNativeFunction,
+) => {
+  {
+    const f = freeze(makeEvalFunction(evaluator));
+    markVirtualizedNativeFunction(f);
+    defineProperty(globalObject, 'eval', {
+      value: f,
+      writable: true,
+      enumerable: false,
+      configurable: true,
+    });
+  }
+  {
+    const f = freeze(makeFunctionConstructor(evaluator));
+    markVirtualizedNativeFunction(f);
+    defineProperty(globalObject, 'Function', {
+      value: f,
+      writable: true,
+      enumerable: false,
+      configurable: true,
+    });
+  }
+};