isolated-function 0.1.47 → 0.1.49

package/README.md

@@ -155,7 +155,7 @@ await fn('🙌') // => true
 await teardown()
 ```
 
-If the code tries to require a package not in the allowed list, an `UntrustedDependencyError` is thrown **before** any npm install happens:
+If the code tries to require a package not in the allowed list, a `DependencyUnallowedError` is thrown **before** any npm install happens:
 
 ```js
 const [fn, teardown] = isolatedFunction(
@@ -169,7 +169,7 @@ const [fn, teardown] = isolatedFunction(
 )
 
 await fn()
-// => UntrustedDependencyError: Dependency 'malicious-package' is not in the allowed list
+// => DependencyUnallowedError: Dependency 'malicious-package' is not in the allowed list
 ```
 
 > **Security Note**: Even with the sandbox, arbitrary package installation is dangerous because npm packages can execute code during installation via `preinstall`/`postinstall` scripts. The `--ignore-scripts` flag is used to mitigate this, but providing an `allow.dependencies` whitelist is the recommended approach for running untrusted code.

package/package.json

@@ -2,11 +2,12 @@
   "name": "isolated-function",
   "description": "Runs untrusted code in a Node.js v8 sandbox.",
   "homepage": "https://github.com/Kikobeats/isolated-function",
-  "version": "0.1.47",
+  "version": "0.1.49",
   "types": "src/index.d.ts",
   "main": "src/index.js",
   "exports": {
-    ".": "./src/index.js"
+    ".": "./src/index.js",
+    "./errors": "./src/errors.js"
   },
   "author": {
     "email": "hello@microlink.io",
@@ -35,7 +36,7 @@
   ],
   "dependencies": {
     "@kikobeats/time-span": "~1.0.5",
-    "acorn": "~8.15.0",
+    "acorn": "~8.16.0",
     "acorn-walk": "~8.3.4",
     "debug-logfmt": "~1.4.0",
     "ensure-error": "~3.0.1",

package/src/compile/index.js

@@ -41,4 +41,3 @@ module.exports = async (snippet, { tmpdir = tmpdirDefault, allow = {} } = {}) =>
 
 module.exports.detectDependencies = detectDependencies
 module.exports.transformDependencies = transformDependencies
-module.exports.UntrustedDependencyError = installDependencies.UntrustedDependencyError

package/src/compile/install-dependencies.js

@@ -3,6 +3,8 @@
 const { execSync } = require('child_process')
 const $ = require('tinyspawn')
 
+const { DependencyNameError, DependencyUnallowedError } = require('../errors')
+
 const install = (() => {
   try {
     execSync('which pnpm', { stdio: ['pipe', 'pipe', 'ignore'] })
@@ -14,14 +16,6 @@ const install = (() => {
   }
 })()
 
-class UntrustedDependencyError extends Error {
-  constructor (dependency) {
-    super(`Dependency '${dependency}' is not in the allowed list`)
-    this.name = 'UntrustedDependencyError'
-    this.dependency = dependency
-  }
-}
-
 const extractPackageName = dependency => {
   if (dependency.startsWith('@')) {
     const slashIndex = dependency.indexOf('/')
@@ -41,12 +35,19 @@ const extractPackageName = dependency => {
 }
 
 const validateDependencies = (dependencies, allowed) => {
+  // Always check for command injection, regardless of allow list
+  for (const dependency of dependencies) {
+    if (dependency.includes(' ')) {
+      throw new DependencyNameError(dependency)
+    }
+  }
+
   if (!allowed) return
 
   for (const dependency of dependencies) {
     const packageName = extractPackageName(dependency)
     if (!allowed.includes(packageName)) {
-      throw new UntrustedDependencyError(packageName)
+      throw new DependencyUnallowedError(packageName)
     }
   }
 }
@@ -55,5 +56,3 @@ module.exports = async ({ dependencies, cwd, allow = {} }) => {
   validateDependencies(dependencies, allow.dependencies)
   return $(`${install} ${dependencies.join(' ')}`, { cwd, env: { ...process.env, CI: true } })
 }
-
-module.exports.UntrustedDependencyError = UntrustedDependencyError

package/src/errors.js

@@ -0,0 +1,32 @@
+'use strict'
+
+class IsolatedFunctionError extends Error {
+  constructor (message) {
+    super(message)
+    this.name = 'IsolatedFunctionError'
+  }
+}
+
+class DependencyNameError extends IsolatedFunctionError {
+  constructor (dependency) {
+    super(`Dependency '${dependency}' is not a valid npm package name`)
+    this.name = 'DependencyNameError'
+    this.code = 'EDEPENDENCYNAME'
+    this.dependency = dependency
+  }
+}
+
+class DependencyUnallowedError extends IsolatedFunctionError {
+  constructor (dependency) {
+    super(`Dependency '${dependency}' is not in the allowed list`)
+    this.name = 'DependencyUnallowedError'
+    this.code = 'EDEPENDENCYUNALLOWED'
+    this.dependency = dependency
+  }
+}
+
+module.exports = {
+  IsolatedFunctionError,
+  DependencyNameError,
+  DependencyUnallowedError
+}