socket-function 0.143.0 → 0.145.0

package/hot/HotReloadController.ts

@@ -11,6 +11,7 @@ import { isNode } from "../src/misc";
 import { magenta, red } from "../src/formatting/logColors";
 import { formatTime } from "../src/formatting/format";
 import { batchFunction } from "../src/batching";
+import { getIsAllowClient } from "../require/RequireController";
 
 /** Enables some hot reload functionality.
  *      - Triggers a refresh clientside
@@ -142,7 +143,7 @@ const hotReloadModule = cache((module: NodeJS.Module) => {
         }
         //module.sourceSHA256;
         // crypto.createHash("sha256").update(contents).digest("hex")
-        if (module.allowclient) {
+        if (getIsAllowClient(module)) {
             triggerClientSideReload({
                 files: [module.filename],
                 changeTime,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "socket-function",
-	"version": "0.143.0",
+	"version": "0.145.0",
 	"main": "index.js",
 	"license": "MIT",
 	"dependencies": {

package/require/RequireController.ts

@@ -18,7 +18,9 @@ module.allowclient = true;
 declare global {
     namespace NodeJS {
         interface Module {
-            /** Indicates the module is allowed clientside. */
+            /** Indicates the module is allowed clientside.
+             *  NOTE: Set with `module.allowclient = true`. HOWEVER, access via getIsAllowClient, which will check 
+             */
             allowclient?: boolean;
 
             /** Causes the module to not preload, requiring `await import()` for it to load correctly
@@ -136,8 +138,8 @@ class RequireControllerBase {
                     if (fs.existsSync(resolved)) {
                         let rootResolved = path.resolve(resolved);
                         let finalResolved = path.resolve(rootResolved);
-                        if (!finalResolved.startsWith(root)) {
-                            throw new Error(`Invalid access, did not stay in namespace: ${JSON.stringify(root)}, but escaped: ${JSON.stringify(finalResolved)}`);
+                        if (!finalResolved.startsWith(rootResolved)) {
+                            throw new Error(`Invalid access, did not stay in namespace: ${JSON.stringify(rootResolved)}, but escaped: ${JSON.stringify(finalResolved)}`);
                         }
                         result = await fs.promises.readFile(resolved);
                         break;
@@ -253,7 +255,7 @@ class RequireControllerBase {
                 originalId: module.id,
                 filename: module.filename,
                 // NOTE: Due to recursive sets of allowclient, it is very possible for allowclient && serveronly to be set.
-                allowclient: module.allowclient && !module.serveronly,
+                allowclient: getIsAllowClient(module),
                 serveronly: module.serveronly,
                 requests: Object.create(null),
                 seqNum: module.requireControllerSeqNum,
@@ -416,6 +418,15 @@ async function compressCached(bufferKey: string, buffer: () => Buffer): Promise<
     return cached;
 }
 
+export function getIsAllowClient(module: NodeJS.Module) {
+    // TODO: Support blacklisting private modules. 
+    if (module.filename.includes("node_modules")) {
+        // The packages are public anyway, so we might as well allow serving them client-side. They still need to be included server side, so this doesn't create any vulnerabilities.
+        return true;
+    }
+    return module.allowclient && !module.serveronly;
+}
+
 type ClientRemapCallback = (args: GetModulesArgs) => Promise<GetModulesArgs>;
 declare global {
     /** Must be set clientside BEFORE requests are made (so you likely want to use RequireController.addMapGetModules