addressed comments on PR
MODIFY
src/evaluators.js
src/evaluators.js
@@ -142,6 +142,10 @@ export function createSafeEvaluatorFactory(unsafeRec, safeGlobal) {
// this to a plain arrow function. Now that we have safeEval, use it.
defineProperties(safeEval, {
toString: {
+ // We break up the following literal string so that an
+ // apparent direct eval syntax does not appear in this
+ // file. Thus, we avoid rejection by the overly eager
+ // rejectDangerousSources.
value: safeEval("() => 'function eval' + '() { [shim code] }'"),
writable: false,
enumerable: false,

MODIFY
src/sourceParser.js
src/sourceParser.js
// source file is written strangely to avoid mentioning these
// character strings explicitly.
+// We do not write the regexp in a straightforward way, so that an
+// apparennt html comment does not appear in this file. Thus, we avoid
+// rejection by the overly eager rejectDangerousSources.
const htmlCommentPattern = new RegExp(`(?:${'<'}!--|--${'>'})`);
function rejectHtmlComments(s) {
@@ -76,7 +79,7 @@ function rejectImportExpressions(s) {
// occurrences, not malicious one. In particular, `(eval)(...)` is
// direct eval syntax that would not be caught by the following regexp.
-const someDirectEvalPattern = /\beval\s*(?:\(|\/\/|\/\*)/m;
+const someDirectEvalPattern = /\beval\s*(?:\(|\/[/*])/;
function rejectSomeDirectEvalExpressions(s) {
const index = s.search(someDirectEvalPattern);

MODIFY
src/stdlib.js
src/stdlib.js
@@ -127,7 +127,10 @@ export function getSharedGlobalDescs(unsafeGlobal) {
describe(frozenGlobalPropertyNames, false, false, false);
// The following is correct but expensive.
// describe(stableGlobalPropertyNames, true, false, true);
- // Instead, for now, we let these get optimized
+ // Instead, for now, we let these get optimized.
+ //
+ // TODO: We should provide an option to turn this optimization off,
+ // by feeding "true, false, true" here instead.
describe(stableGlobalPropertyNames, false, false, false);
// These we keep replaceable and removable, because we expect
// others, e.g., SES, may want to do so.

MODIFY
test/realm/test-import-expression.js
test/realm/test-import-expression.js
@@ -55,6 +55,10 @@ const comment = `const a = import/*hah*/('evil')`;
const doubleSlashComment = `const a = import // hah
('evil')`;
+// We break up the following literal strings so that an apparent html
+// comment does not appear in this file. Thus, we avoid rejection by
+// the overly eager rejectDangerousSources.
+
const htmlOpenComment = `const a = import ${'<'}!-- hah
('evil')`;
@@ -131,10 +135,8 @@ test('reject import expressions in evaluate', t => {
SyntaxError,
'doubleSlashComment'
);
- // TODO: Why does the following test case fail even though all the
- // similar ones succeed?
- // t.throws(() => r.evaluate(wrap(htmlOpenComment)),
- // SyntaxError, 'htmlOpenComment');
+ t.throws(() => r.evaluate(wrap(htmlOpenComment)),
+ SyntaxError, 'htmlOpenComment');
t.throws(
() => r.evaluate(wrap(htmlCloseComment)),
SyntaxError,

addressed comments on PR