poe-code 14.0.74 → 14.0.75

package/packages/safe-js/dist/interp/values.js

@@ -19,7 +19,7 @@ import { invokeCancelableClosure, readPromiseCancellation, registerPromiseCancel
 import { parseRegex } from "./regex/parse.js";
 import { assertSandboxDataDepth } from "../graph-depth.js";
 import { sandboxErrorTypes } from "../error/shape.js";
-import { getGuestFunctionProperties, getSandboxPrototype, hasGuestObjectState, hasManagedDescriptors, isGuestClosure, isIntrinsicConstructor, registerGuestClosure } from "./object-model.js";
+import { getGuestFunctionProperties, getSandboxPrototype, hasGuestObjectState, hasManagedDescriptors, hasNullObjectPrototype, isGuestClosure, isIntrinsicConstructor, registerGuestClosure, setSandboxPrototype } from "./object-model.js";
 import { copySandboxArgumentProperties, createSandboxArguments, getSandboxArgumentEntries, isSandboxArguments } from "./arguments.js";
 export { createSandboxArguments, isSandboxArguments } from "./arguments.js";
 export { isSandboxMap, isSandboxSet } from "./collection-brands.js";
@@ -612,7 +612,7 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
         const copy = restoreSandboxRegExpIterator({ matcher: undefined, input: undefined, exhausted: true });
         state.seen.set(value, copy);
         const matcher = copyToSandbox(snapshot.matcher, state, `${path}.<matcher>`, true, depth + 1);
-        if (matcher !== undefined && !isSandboxRegex(matcher))
+        if (matcher !== undefined && (snapshot.global === undefined ? !isSandboxRegex(matcher) : matcher === null || typeof matcher !== "object"))
             throw new TypeError("Invalid RegExp iterator matcher.");
         restoreSandboxRegExpIterator({ ...snapshot, matcher }, copy);
         for (const entry of getEnumerableObjectEntries(value, path)) {
@@ -781,6 +781,8 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
             return existing;
         }
         const copy = createPlainObject(!cloneSandboxCollections || Object.getPrototypeOf(value) === null);
+        if (!state.structuredClone && hasNullObjectPrototype(value))
+            setSandboxPrototype(copy, null);
         state.seen.set(value, copy);
         const errorType = sandboxErrorTypes.get(value);
         if (errorType !== undefined)
@@ -978,7 +980,7 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
         if (existing !== undefined) {
             return existing;
         }
-        const copy = createPlainObject(Object.getPrototypeOf(value) === null);
+        const copy = createPlainObject(hasNullObjectPrototype(value) || Object.getPrototypeOf(value) === null);
         state.seen.set(value, copy);
         for (const entry of getEnumerableObjectEntries(value, path)) {
             defineOwnDataProperty(copy, entry.key, copyFromSandbox(entry.value, state, joinPath(path, entry.key), options, depth + 1));

package/packages/safe-js/dist/snapshot/dump-format.js

@@ -4,7 +4,7 @@ import { isSandboxRegExpIterator, regexpIteratorState } from "../interp/regexp-i
 import { hasCustomRegexProperties, serializeRegexProperties } from "./regexp-properties.js";
 export const EXECUTION_SEMANTICS = "jobs-v8";
 import { assertSnapshotGraphDepth } from "../graph-depth.js";
-import { hasGuestObjectState } from "../interp/object-model.js";
+import { hasGuestObjectState, hasNullObjectPrototype } from "../interp/object-model.js";
 import { sandboxErrorTypes } from "../error/shape.js";
 import { getSandboxArgumentEntries, isSandboxArguments } from "../interp/arguments.js";
 import { serializeArguments } from "./arguments.js";
@@ -110,10 +110,16 @@ function serializeHeapReference(value, path, state) {
         if (isSandboxRegExpIterator(value)) {
             const snapshot = regexpIteratorState(value);
             const matcher = snapshot.matcher;
+            const serializedMatcher = snapshot.global === undefined && isSandboxRegex(matcher)
+                ? { kind: "regex", source: matcher.source, flags: matcher.flags, lastIndex: Number(matcher.lastIndex) }
+                : serializeDumpValue(matcher, `${path}.<matcher>`, state);
+            if (serializedMatcher === SKIP_VALUE)
+                throw new TypeError("Unsupported RegExp iterator matcher in public dump.");
             const entries = Object.create(null);
             state.heap[String(id)] = {
                 kind: "regexp-iterator", exhausted: snapshot.exhausted,
-                matcher: matcher === undefined ? { kind: "undefined" } : { kind: "regex", source: matcher.source, flags: matcher.flags, lastIndex: Number(matcher.lastIndex) },
+                matcher: serializedMatcher,
+                ...(snapshot.global === undefined ? {} : { global: snapshot.global, unicode: snapshot.unicode }),
                 input: snapshot.input ?? { kind: "undefined" }, entries,
                 symbolEntries: serializeSymbolProperties(value, entry => {
                     const serialized = serializeDumpValue(entry, `${path}.[symbol]`, state);
@@ -192,6 +198,7 @@ function serializeHeapReference(value, path, state) {
             });
             state.heap[String(id)] = {
                 kind: "object",
+                ...(hasNullObjectPrototype(value) ? { sandboxNullPrototype: true } : {}),
                 entries: serializeObjectEntries(value, path, state),
                 ...(symbolEntries.length === 0 ? {} : { symbolEntries }),
                 ...(errorType === undefined ? {} : { errorType })
@@ -227,6 +234,7 @@ function indexHeapContainers(snapshot) {
     for (const [value, stat] of stats.entries()) {
         if (stat.count > 1 ||
             stat.cyclic ||
+            hasNullObjectPrototype(value) ||
             ownSerializableSymbolKeys(value).length > 0 ||
             isSandboxBox(value) ||
             isSandboxRegExpIterator(value) ||

package/packages/safe-js/dist/snapshot/replay-data.d.ts

@@ -32,6 +32,8 @@ type DataNode = {
     matcher: Atom;
     input: Atom;
     exhausted: boolean;
+    global?: boolean;
+    unicode?: boolean;
     properties: Properties;
     extensible: boolean;
     symbolEntries?: Array<SerializedSymbolProperty<Atom>>;
@@ -69,6 +71,7 @@ type DataNode = {
     symbolProperties?: Array<SerializedSymbolProperty<Atom>>;
     extensible: boolean;
     nullPrototype: boolean;
+    sandboxNullPrototype?: true;
     errorType?: SandboxErrorName;
 } | {
     kind: "arguments";

package/packages/safe-js/dist/snapshot/replay-data.js

@@ -4,7 +4,7 @@ import { wellKnownSymbols } from "../interp/symbols.js";
 import { symbolData, serializeSymbolProperties } from "./symbols.js";
 import { isSandboxCollectionIterator, restoreSandboxCollectionIterator, snapshotCollectionIterator } from "../interp/collection-iterator.js";
 import { isSandboxRegExpIterator, regexpIteratorState, restoreSandboxRegExpIterator } from "../interp/regexp-iterator.js";
-import { hasGuestObjectState } from "../interp/object-model.js";
+import { hasGuestObjectState, hasNullObjectPrototype, setSandboxPrototype } from "../interp/object-model.js";
 import { CompileScope } from "../interp/regex/compile-guard.js";
 import { float32DataProperties, isFloat32Array } from "../interp/float32.js";
 import { decodeFloat32Storage, encodeFloat32Storage } from "./float32array.js";
@@ -134,7 +134,8 @@ export function encodeReplayData(value, options = {}) {
             }
             let symbolIndex = 0;
             const symbolEntries = serializeSymbolProperties(entry, value => encode(value, depth + 1, [...path, { symbol: Math.floor(symbolIndex++ / 2) }]));
-            nodes[id] = { kind: "regexp-iterator", matcher: child(snapshot.matcher, "<matcher>"), input: child(snapshot.input, "<input>"), exhausted: snapshot.exhausted, properties, extensible: Object.isExtensible(entry), symbolEntries };
+            nodes[id] = { kind: "regexp-iterator", matcher: child(snapshot.matcher, "<matcher>"), input: child(snapshot.input, "<input>"), exhausted: snapshot.exhausted, properties, extensible: Object.isExtensible(entry), symbolEntries,
+                ...(snapshot.global === undefined ? {} : { global: snapshot.global, unicode: snapshot.unicode }) };
         }
         else if (isSandboxCollectionIterator(entry)) {
             const snapshot = snapshotCollectionIterator(entry);
@@ -195,6 +196,7 @@ export function encodeReplayData(value, options = {}) {
             nodes[id] = {
                 kind: Array.isArray(entry) ? "array" : "object",
                 nullPrototype: prototype === null,
+                ...(hasNullObjectPrototype(entry) ? { sandboxNullPrototype: true } : {}),
                 ...(errorType === undefined ? {} : { errorType }),
                 extensible: Object.isExtensible(entry),
                 properties,
@@ -365,11 +367,14 @@ export function decodeReplayData(input, options = {}, parent) {
                 restored.set(id, result);
                 const matcher = child(own(node, "matcher"));
                 const input = child(own(node, "input"));
-                if (matcher !== undefined && !isSandboxRegex(matcher))
+                if ((node.global !== undefined || node.unicode !== undefined) && (typeof node.global !== "boolean" || typeof node.unicode !== "boolean"))
+                    throw new TypeError("Invalid replay RegExp iterator modes.");
+                if (matcher !== undefined && (node.global === undefined ? !isSandboxRegex(matcher) : matcher === null || typeof matcher !== "object"))
                     throw new TypeError("Invalid replay RegExp iterator matcher.");
                 if (input !== undefined && typeof input !== "string")
                     throw new TypeError("Invalid replay RegExp iterator input.");
-                restoreSandboxRegExpIterator({ matcher, input, exhausted }, result);
+                restoreSandboxRegExpIterator({ matcher, input, exhausted,
+                    ...(node.global === undefined ? {} : { global: node.global, unicode: node.unicode }) }, result);
                 defineProperties(result, record(own(node, "properties")), child, node.symbolEntries);
                 if (!node.extensible)
                     Object.preventExtensions(result);
@@ -450,6 +455,11 @@ export function decodeReplayData(input, options = {}, parent) {
                 throw new TypeError("Invalid replay object metadata.");
             }
             const result = kind === "array" ? [] : Object.create(node.nullPrototype ? null : Object.prototype);
+            if (Object.hasOwn(node, "sandboxNullPrototype")) {
+                if (kind !== "object" || node.sandboxNullPrototype !== true)
+                    throw new TypeError("Invalid replay object prototype.");
+                setSandboxPrototype(result, null);
+            }
             if (Object.hasOwn(node, "errorType")) {
                 sandboxErrorTypes.set(result, node.errorType);
             }

package/packages/safe-js/dist/snapshot/restore.js

@@ -439,11 +439,12 @@ function restoreHeapValue(id, state) {
         state.heapValueById.set(id, iterator);
         const matcher = deserializeValue(serialized.matcher, state);
         const input = deserializeValue(serialized.input, state);
-        if (matcher !== undefined && !isSandboxRegex(matcher))
+        if (matcher !== undefined && (serialized.global === undefined ? !isSandboxRegex(matcher) : matcher === null || typeof matcher !== "object"))
             throw new TypeError("Invalid RegExp iterator matcher.");
         if (input !== undefined && typeof input !== "string")
             throw new TypeError("Invalid RegExp iterator input.");
-        restoreSandboxRegExpIterator({ matcher, input, exhausted: serialized.exhausted }, iterator);
+        restoreSandboxRegExpIterator({ matcher: matcher, input, exhausted: serialized.exhausted,
+            ...(serialized.global === undefined ? {} : { global: serialized.global, unicode: serialized.unicode }) }, iterator);
         for (const [key, entry] of Object.entries(serialized.entries))
             Object.defineProperty(iterator, key, { value: deserializeValue(entry, state), enumerable: true, configurable: true, writable: true });
         restoreSymbolProperties(iterator, serialized.symbolEntries, entry => deserializeValue(entry, state));
@@ -478,6 +479,11 @@ function restoreHeapValue(id, state) {
     }
     const object = Object.create(null);
     state.heapValueById.set(id, object);
+    if (Object.hasOwn(serialized, "sandboxNullPrototype")) {
+        if (serialized.sandboxNullPrototype !== true)
+            throw new TypeError("Invalid object prototype.");
+        setSandboxPrototype(object, null);
+    }
     if (serialized.errorType !== undefined)
         sandboxErrorTypes.set(object, serialized.errorType);
     for (const [key, entry] of Object.entries(serialized.entries)) {

package/packages/safe-js/dist/snapshot/serialize.d.ts

@@ -54,6 +54,8 @@ export type SerializedHeapValue = {
     matcher: SerializedSnapshotValue;
     input: SerializedSnapshotValue;
     exhausted: boolean;
+    global?: boolean;
+    unicode?: boolean;
     entries: Record<string, SerializedSnapshotValue>;
     symbolEntries?: Array<SerializedSymbolProperty<SerializedSnapshotValue>>;
 } | SerializedSymbol | BoxedData<SerializedSnapshotValue> | ({
@@ -73,6 +75,7 @@ export type SerializedHeapValue = {
     entries: Record<string, SerializedSnapshotValue>;
 }) | SerializedArguments<SerializedSnapshotValue> | SerializedArray<SerializedSnapshotValue> | {
     kind: "object";
+    sandboxNullPrototype?: true;
     entries: Record<string, SerializedSnapshotValue>;
     symbolEntries?: Array<SerializedSymbolProperty<SerializedSnapshotValue>>;
     errorType?: SandboxErrorName;

package/packages/safe-js/dist/snapshot/serialize.js

@@ -3,7 +3,7 @@ import { hasCustomRegexProperties, serializeRegexProperties } from "./regexp-pro
 import { ownSerializableSymbolKeys, serializeSymbol, serializeSymbolProperties } from "./symbols.js";
 import { collectionIteratorState, isSandboxCollectionIterator, snapshotCollectionIterator } from "../interp/collection-iterator.js";
 import { isSandboxRegExpIterator, regexpIteratorState } from "../interp/regexp-iterator.js";
-import { hasGuestObjectState } from "../interp/object-model.js";
+import { hasGuestObjectState, hasNullObjectPrototype } from "../interp/object-model.js";
 import { sandboxErrorTypes } from "../error/shape.js";
 import { assertSnapshotGraphDepth } from "../graph-depth.js";
 import { serializeArguments } from "./arguments.js";
@@ -220,6 +220,7 @@ function serializeHeapReference(value, path, state) {
             const entries = Object.create(null);
             state.heap[String(id)] = {
                 kind: "regexp-iterator", matcher: serializeValue(snapshot.matcher, `${path}.<matcher>`, state),
+                ...(snapshot.global === undefined ? {} : { global: snapshot.global, unicode: snapshot.unicode }),
                 input: serializeValue(snapshot.input, `${path}.<input>`, state), exhausted: snapshot.exhausted, entries,
                 symbolEntries: serializeSymbolProperties(value, entry => serializeValue(entry, `${path}.[symbol]`, state))
             };
@@ -283,6 +284,7 @@ function serializeHeapReference(value, path, state) {
             const errorType = sandboxErrorTypes.get(value);
             const serializedObject = {
                 kind: "object",
+                ...(hasNullObjectPrototype(value) ? { sandboxNullPrototype: true } : {}),
                 entries,
                 ...(errorType === undefined ? {} : { errorType })
             };
@@ -359,6 +361,7 @@ function indexHeapContainers(input) {
     for (const [value, stat] of stats.entries()) {
         if (stat.count > 1 ||
             stat.cyclic ||
+            hasNullObjectPrototype(value) ||
             ownSerializableSymbolKeys(value).length > 0 ||
             (isSandboxRegex(value) && (hasCustomRegexProperties(value) || !Number.isSafeInteger(value.lastIndex) ||
                 (typeof value.lastIndex === "number" && value.lastIndex < 0) || Object.is(value.lastIndex, -0))) ||

package/packages/safe-js/dist/snapshot/validation.js

@@ -115,6 +115,8 @@ function validateDumpHeap(root, state) {
             continue;
         }
         if (entry.kind === "object") {
+            if (Object.hasOwn(entry, "sandboxNullPrototype") && entry.sandboxNullPrototype !== true)
+                fail("invalidValue", `${path}.sandboxNullPrototype`, "invalid object prototype");
             requireRecord(entry.entries, `${path}.entries`);
             continue;
         }
@@ -394,7 +396,11 @@ function validateTaggedValue(record, path, state) {
             return;
         case "array":
         case "arguments":
+            return;
         case "object":
+            if (Object.hasOwn(record, "sandboxNullPrototype") && record.sandboxNullPrototype !== true)
+                fail("invalidValue", `${path}.sandboxNullPrototype`, "invalid object prototype");
+            return;
         case "map":
         case "set":
         case "collection-iterator":
@@ -474,6 +480,8 @@ function validateHeapValue(value, path, state, heap) {
     if (record.kind === "set")
         requireArray(record.values, `${path}.values`, state);
     if (record.kind === "regexp-iterator") {
+        if ((record.global !== undefined || record.unicode !== undefined) && (typeof record.global !== "boolean" || typeof record.unicode !== "boolean"))
+            fail("invalidValue", path, "invalid RegExp iterator modes");
         if (typeof record.exhausted !== "boolean")
             fail("invalidValue", `${path}.exhausted`, "invalid iterator exhaustion");
         if (!Object.hasOwn(record, "matcher") || !Object.hasOwn(record, "input"))