@usebruno/js 0.44.0 → 0.45.1

package/src/sandbox/node-vm/constants.js

@@ -0,0 +1,99 @@
+/**
+ * Constants for the Node.js VM sandbox.
+ *
+ * ECMAScript built-ins (Object, Array, Function, etc.)
+ * are NOT passed from the host. The VM provides its own versions, ensuring
+ * consistent prototype chains for libraries that use introspection.
+ *
+ * Handled separately in index.js:
+ * - global/globalThis: Points to isolated context (not host)
+ * - require: createCustomRequire() (custom module loader)
+ */
+
+/**
+ * Safe globals to pass from host to VM context.
+ *
+ * ECMAScript built-ins (Object, Array, Function, String, Number,
+ * Boolean, Symbol, Date, RegExp, Map, Set, Promise, JSON, Math,
+ * parseInt, etc.) are intentionally NOT included here.
+ *
+ * The VM context provides its own versions of these, which ensures consistent
+ * prototype chains. Passing host versions causes prototype mismatches.
+ *
+ * Only Node.js-specific and Web APIs that the VM doesn't provide are listed.
+ */
+const safeGlobals = [
+  'process',
+
+  // Node.js timers (not part of ECMAScript)
+  'setTimeout',
+  'setInterval',
+  'clearTimeout',
+  'clearInterval',
+  'setImmediate',
+  'clearImmediate',
+  'queueMicrotask',
+
+  // Node.js globals
+  'Buffer',
+
+  // Error types - needed for instanceof checks with errors from host APIs/modules
+  'Error',
+  'TypeError',
+  'ReferenceError',
+  'SyntaxError',
+  'RangeError',
+  'URIError',
+  'EvalError',
+  'AggregateError',
+
+  // URL APIs (WHATWG - not ECMAScript)
+  'URL',
+  'URLSearchParams',
+
+  // Encoding APIs
+  'TextEncoder',
+  'TextDecoder',
+  'atob',
+  'btoa',
+
+  // Fetch API (Node 18+)
+  'fetch',
+  'Request',
+  'Response',
+  'Headers',
+  'FormData',
+  'AbortController',
+  'AbortSignal',
+  'Blob',
+
+  // Streams API
+  'ReadableStream',
+  'WritableStream',
+  'TransformStream',
+
+  // Internationalization (needs host's locale data)
+  'Intl',
+
+  // Web Crypto API
+  'crypto',
+
+  // WebAssembly
+  'WebAssembly',
+
+  // Performance API
+  'performance',
+
+  // Events API
+  'Event',
+  'EventTarget',
+  'CustomEvent',
+
+  // Message passing
+  'MessageChannel',
+  'MessagePort'
+];
+
+module.exports = {
+  safeGlobals
+};

package/src/sandbox/node-vm/index.js

@@ -1,44 +1,30 @@
 const vm = require('node:vm');
-const fs = require('node:fs');
 const path = require('node:path');
 const { get } = require('lodash');
 const lodash = require('lodash');
+const { ScriptError } = require('./utils');
+const { createCustomRequire } = require('./cjs-loader');
+const { safeGlobals } = require('./constants');
 const { mixinTypedArrays } = require('../mixins/typed-arrays');
 
-class ScriptError extends Error {
-  constructor(error, script) {
-    super(error.message);
-    this.name = 'ScriptError';
-    this.originalError = error;
-    this.script = script;
-    this.stack = error.stack;
-  }
-}
-
 /**
  * Executes a script in a Node.js VM context with enhanced security and module loading
+ *
  * @param {Object} options - Configuration options
  * @param {string} options.script - The script code to execute
  * @param {Object} options.context - The execution context with Bruno objects
  * @param {string} options.collectionPath - Path to the collection directory
  * @param {Object} options.scriptingConfig - Scripting configuration options
- * @returns {Promise<Object>} Execution results including variables and test results
+ * @returns {Promise<void>}
  * @throws {ScriptError} When script execution fails
  */
-async function runScriptInNodeVm({
-  script,
-  context,
-  collectionPath,
-  scriptingConfig
-}) {
+async function runScriptInNodeVm({ script, context, collectionPath, scriptingConfig }) {
   if (script.trim().length === 0) {
     return;
   }
 
   try {
-    const allowScriptFilesystemAccess = get(scriptingConfig, 'filesystemAccess.allow', false);
-
-    // Compute additional context roots
+    // Compute allowed context roots for security validation
     const additionalContextRoots = get(scriptingConfig, 'additionalContextRoots', []);
     const additionalContextRootsAbsolute = lodash
       .chain(additionalContextRoots)
@@ -47,229 +33,67 @@ async function runScriptInNodeVm({
       .value();
     additionalContextRootsAbsolute.push(path.normalize(collectionPath));
 
-    // Create script context with all necessary variables
-    const scriptContext = {
-      // Bruno context
-      console: context.console,
-      req: context.req,
-      res: context.res,
-      bru: context.bru,
-      expect: context.expect,
-      assert: context.assert,
-      __brunoTestResults: context.__brunoTestResults,
-      test: context.test,
-      // Configuration for nested module loading
-      scriptingConfig: scriptingConfig,
-      // Global objects
-      Buffer: global.Buffer,
-      process: global.process,
-      setTimeout: global.setTimeout,
-      setInterval: global.setInterval,
-      clearTimeout: global.clearTimeout,
-      clearInterval: global.clearInterval,
-      setImmediate: global.setImmediate,
-      clearImmediate: global.clearImmediate,
-      Error: global.Error,
-      TypeError: global.TypeError,
-      ReferenceError: global.ReferenceError,
-      SyntaxError: global.SyntaxError,
-      RangeError: global.RangeError
-    };
+    // Build the script context with Bruno objects and globals
+    const scriptContext = buildScriptContext(context, scriptingConfig);
+
+    // Create truly isolated context - scriptContext becomes the global object
+    // Scripts can ONLY access what's explicitly in scriptContext
+    const isolatedContext = vm.createContext(scriptContext);
 
-    mixinTypedArrays(scriptContext);
+    // Add global/globalThis pointing to the isolated context (not host global)
+    // This allows libraries that reference 'global' to work while maintaining isolation
+    scriptContext.global = scriptContext;
+    scriptContext.globalThis = scriptContext;
 
-    // Create shared cache for local modules
+    // Create module cache for CJS modules
     const localModuleCache = new Map();
 
-    // Create a custom require function and add it to the context
+    // Add require() function for CJS module loading
     scriptContext.require = createCustomRequire({
-      scriptingConfig,
       collectionPath,
-      scriptContext,
+      isolatedContext,
       currentModuleDir: collectionPath,
       localModuleCache,
-      allowScriptFilesystemAccess,
       additionalContextRootsAbsolute
     });
 
-    // Execute the script in an isolated VM context
-    await vm.runInNewContext(`
-        (async function(){
-          ${script}
-        })();
-      `, scriptContext, {
-      filename: path.join(collectionPath, 'script.js'),
-      displayErrors: true
+    // Execute the script in the isolated context
+    const wrappedScript = `(async function(){ ${script} \n})();`;
+    const compiledScript = new vm.Script(wrappedScript, {
+      filename: path.join(collectionPath, 'script.js')
     });
+
+    await compiledScript.runInContext(isolatedContext);
   } catch (error) {
     throw new ScriptError(error, script);
   }
-
-  return;
 }
 
 /**
- * Creates a custom require function with enhanced security and local module support
- * @param {Object} options - Configuration options
- * @param {Object} options.scriptingConfig - Scripting configuration with additional context roots
- * @param {string} options.collectionPath - Base collection path for security checks
- * @param {Object} options.scriptContext - Script execution context
- * @param {string} options.currentModuleDir - Current module directory for relative imports
- * @param {Map} options.localModuleCache - Cache for loaded local modules
- * @param {boolean} options.allowScriptFilesystemAccess - Whether to allow fs module access
- * @param {Array<string>} options.additionalContextRootsAbsolute - Pre-computed absolute context roots
- * @returns {Function} Custom require function
+ * Build the script context with Bruno objects and necessary globals
+ * @param {Object} context - Bruno context (bru, req, res, etc.)
+ * @param {Object} scriptingConfig - Scripting configuration
+ * @returns {Object} Script context object
  */
-function createCustomRequire({
-  scriptingConfig,
-  collectionPath,
-  scriptContext,
-  currentModuleDir = collectionPath,
-  localModuleCache = new Map(),
-  allowScriptFilesystemAccess = false,
-  additionalContextRootsAbsolute = []
-}) {
-  return (moduleName) => {
-    // Check if it's a local module (starts with ./ or ../ or .\ or ..\)
-    // Normalize backslashes to forward slashes for cross-platform compatibility
-    const normalizedModuleName = moduleName.replace(/\\/g, '/');
-    if (normalizedModuleName.startsWith('./') || normalizedModuleName.startsWith('../')) {
-      return loadLocalModule({ moduleName: normalizedModuleName, collectionPath, scriptContext, localModuleCache, currentModuleDir, additionalContextRootsAbsolute });
-    }
-
-    // Helper function to check if a module is the fs module or a submodule
-    const isFsModule = (module) => {
-      if (!module) return false;
-      const fsModule = require('fs');
-      // Check if it's the fs module itself
-      if (module === fsModule) return true;
-      // Check if it's fs/promises submodule
-      if (module === fsModule.promises) return true;
-      // Check if it's fs/promises by comparing with require('fs/promises')
-      try {
-        if (module === require('fs/promises')) return true;
-      } catch {
-        // fs/promises might not be available in all Node versions
-      }
-      return false;
-    };
-
-    // First try to require as a native/npm module
-    try {
-      const requiredModulePath = require.resolve(moduleName, { paths: [...additionalContextRootsAbsolute, ...module.paths] });
-      const requiredModule = require(requiredModulePath);
-
-      // Block filesystem module access if filesystem access is not allowed
-      if (!allowScriptFilesystemAccess && isFsModule(requiredModule)) {
-        throw new Error('Filesystem access is not allowed. Enable "filesystemAccess.allow" in scripting config to use the fs module.');
-      }
-
-      return requiredModule;
-    } catch (requireError) {
-      // Re-throw if it's our filesystem access error
-      if (requireError.message && requireError.message.includes('Enable "filesystemAccess.allow"')) {
-        throw requireError;
-      }
-
-      // If that fails, try to resolve from additionalContextRoots
-      throw new Error(`Could not resolve module "${moduleName}": ${requireError.message}\n\nThis most likely means you did not install the module under the collection or the "additionalContextRoots" using a package manager like npm.\n\nThese are your current "additionalContextRoots":\n${additionalContextRootsAbsolute.map((root) => `  - ${root}`).join('\n') || '  - No "additionalContextRoots" defined'}`);
-    }
+function buildScriptContext(context, scriptingConfig) {
+  const scriptContext = {
+    ...context,
+
+    // Configuration for nested module loading
+    scriptingConfig: scriptingConfig,
+
+    // Safe globals from allowlist (Node.js/Web APIs only, not ECMAScript built-ins)
+    ...Object.fromEntries(
+      safeGlobals
+        .filter((key) => global[key] !== undefined)
+        .map((key) => [key, global[key]])
+    )
   };
-}
-
-/**
- * Loads a local module from the filesystem with security checks and caching
- * @param {Object} options - Configuration options
- * @param {string} options.moduleName - Name/path of the module to load
- * @param {string} options.collectionPath - Base collection path for security validation
- * @param {Object} options.scriptContext - Script execution context to inherit
- * @param {Map} options.localModuleCache - Cache for loaded modules
- * @param {string} options.currentModuleDir - Directory of the current module for relative resolution
- * @param {Array<string>} options.additionalContextRootsAbsolute - Additional allowed context root paths
- * @returns {*} The exported content of the loaded module
- * @throws {Error} When module is outside collection path or cannot be loaded
- */
-function loadLocalModule({
-  moduleName,
-  collectionPath,
-  scriptContext,
-  localModuleCache,
-  currentModuleDir,
-  additionalContextRootsAbsolute = []
-}) {
-  // Check if the filename has an extension
-  const hasExtension = path.extname(moduleName) !== '';
-  const resolvedFilename = hasExtension ? moduleName : `${moduleName}.js`;
 
-  // Resolve the file path relative to the current module's directory
-  const filePath = path.resolve(currentModuleDir, resolvedFilename);
-  const normalizedFilePath = path.normalize(filePath);
+  // Add TypedArrays from host for compatibility with host APIs (TextEncoder, crypto, etc.)
+  mixinTypedArrays(scriptContext);
 
-  const isWithinAllowedRoot = additionalContextRootsAbsolute.some((allowedRoot) => {
-    const normalizedAllowedRoot = path.normalize(allowedRoot);
-    const relativePath = path.relative(normalizedAllowedRoot, normalizedFilePath);
-    return !relativePath.startsWith('..') && !path.isAbsolute(relativePath);
-  });
-
-  if (!isWithinAllowedRoot) {
-    const allowedRootsDisplay = additionalContextRootsAbsolute.map((root) => `  - ${root}`).join('\n');
-    throw new Error(
-      `Access to files outside of the allowed context roots is not allowed: ${moduleName}\n\n`
-      + `Allowed context roots:\n${allowedRootsDisplay}`
-    );
-  }
-
-  // Check cache first (use normalized path as key)
-  if (localModuleCache.has(normalizedFilePath)) {
-    return localModuleCache.get(normalizedFilePath);
-  }
-
-  if (!fs.existsSync(normalizedFilePath)) {
-    throw new Error(`Cannot find module ${moduleName}`);
-  }
-
-  // Read and execute the local module
-  const moduleCode = fs.readFileSync(normalizedFilePath, 'utf8');
-
-  // Create module object
-  const moduleObj = { exports: {} };
-
-  // Get the directory of this module for nested imports
-  const moduleDir = path.dirname(normalizedFilePath);
-
-  // Create a new context that inherits from the script context
-  const moduleContext = {
-    ...scriptContext,
-    module: moduleObj,
-    exports: moduleObj.exports,
-    __filename: normalizedFilePath,
-    __dirname: moduleDir,
-    // Create a custom require function for this module that resolves relative to its directory
-    require: createCustomRequire({
-      scriptingConfig: scriptContext.scriptingConfig || {},
-      collectionPath,
-      scriptContext,
-      currentModuleDir: moduleDir,
-      localModuleCache,
-      allowScriptFilesystemAccess: get(scriptContext.scriptingConfig, 'filesystemAccess.allow', false),
-      additionalContextRootsAbsolute
-    })
-  };
-
-  try {
-    // Execute the module code in the shared context
-    vm.runInNewContext(moduleCode, moduleContext, {
-      filename: normalizedFilePath,
-      displayErrors: true
-    });
-
-    // Cache the result using normalized path
-    localModuleCache.set(normalizedFilePath, moduleObj.exports);
-
-    return moduleObj.exports;
-  } catch (error) {
-    throw new Error(`Error loading local module ${moduleName}: ${error.message}`);
-  }
+  return scriptContext;
 }
 
 module.exports = {