dsh-unlag 1.7.5 → 1.7.7

package/client.js

@@ -115,6 +115,7 @@ window.__ModuleLoader__.load({
           for (const id of source.ids) {
             if (!body.includes(id)) return false;
           }
+          if (!parsesAsClassicScript(body)) return false;
         } catch {
           return false;
         }
@@ -122,6 +123,28 @@ window.__ModuleLoader__.load({
       return true;
     }
 
+    // Every row kind a document boot understands; an unknown one ends the document.
+    const STARTUP_ROW_KINDS = new Set(['global', 'script', 'script-src', 'script-preload', 'style', 'html']);
+
+    /**
+     * Whether a script body parses the way the document will parse it: as a classic script. A body
+     * that needs module syntax never runs, so the document that loads it fails to boot and the
+     * desktop shell ends. Compiling runs nothing, so nothing here has a side effect; a page that
+     * forbids compiling strings cannot answer, and then the checks already done stand.
+     * @param body - the served script.
+     * @returns true when the body parses, or when this page cannot compile one at all.
+     */
+    function parsesAsClassicScript(body) {
+      try {
+        new Function(body); // eslint-disable-line no-new-func
+        return true;
+      } catch (error) {
+        const text = String(error?.message ?? error);
+        if (/unsafe-eval|Content Security Policy/iu.test(text)) return true;
+        return false;
+      }
+    }
+
     /**
      * The startup list the desktop shell hands the next document, exactly as it hands it. The
      * shell reads that list once when the app starts and replays the same copy for every document
@@ -153,6 +176,8 @@ window.__ModuleLoader__.load({
       let frozen = null;
       for (const row of rows) {
         if (row === null || typeof row !== 'object') continue;
+        if (typeof row.kind !== 'string' || !STARTUP_ROW_KINDS.has(row.kind)) return false;
+        if (row.kind === 'script-src' && (typeof row.src !== 'string' || row.src === '')) return false;
         if (typeof row.src === 'string' && row.src !== '') scripts.push(row.src);
         if (row.kind !== 'global' || row.name !== '__DSH_BOOT__') continue; // ui-copy-ignore
         let value = row.value;
@@ -190,6 +215,7 @@ window.__ModuleLoader__.load({
           for (const id of bundledIds(target)) {
             if (!body.includes(id)) return false;
           }
+          if (!parsesAsClassicScript(body)) return false;
         } catch {
           return false;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.7.5",
+  "version": "1.7.7",
   "type": "module",
   "description": "One press applies plugin edits right away and brings a laggy interface back; running turns, queued messages and unsent input are untouched, and nothing restarts.",
   "license": "MIT",