socket-function 0.144.0 → 0.146.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "socket-function",
-	"version": "0.144.0",
+	"version": "0.146.0",
 	"main": "index.js",
 	"license": "MIT",
 	"dependencies": {

package/require/RequireController.ts

@@ -255,7 +255,7 @@ class RequireControllerBase {
                 originalId: module.id,
                 filename: module.filename,
                 // NOTE: Due to recursive sets of allowclient, it is very possible for allowclient && serveronly to be set.
-                allowclient: module.allowclient && !module.serveronly,
+                allowclient: getIsAllowClient(module),
                 serveronly: module.serveronly,
                 requests: Object.create(null),
                 seqNum: module.requireControllerSeqNum,
@@ -419,11 +419,7 @@ async function compressCached(bufferKey: string, buffer: () => Buffer): Promise<
 }
 
 export function getIsAllowClient(module: NodeJS.Module) {
-    // TODO: Support blacklisting private modules. 
-    if (module.filename.includes("node_modules")) {
-        // The packages are public anyway, so we might as well allow serving them client-side. They still need to be included server side, so this doesn't create any vulnerabilities.
-        return true;
-    }
+    // IMPORTANT! We do not allow everything in node modules by default, as most things in node modules, you don't want to import client-side, and it will break if you import it client-side. Many of these are imported, but will never end up being called client-side, so it's fine to exclude them.
     return module.allowclient && !module.serveronly;
 }