fix(check-bundle)!: Verify immutability of checked bundle
*BREAKING CHANGE*: check-bundle would previously allow bundles with
accessor properties or extraneous non-string properties.
These are now expressly disallowed.
MODIFY
packages/check-bundle/lite.js
packages/check-bundle/lite.js
@@ -14,13 +14,13 @@ const { details: d, quote: q } = assert;
*
* @param {any} bundle
* @param {(bytes: Uint8Array) => string} computeSha512
- * @param {string} name
+ * @param {string} bundleName
* @returns {Promise<void>}
*/
export const checkBundle = async (
bundle,
computeSha512,
- name = '<unknown-bundle>',
+ bundleName = '<unknown-bundle>',
) => {
assert.typeof(
bundle,
@@ -36,6 +36,23 @@ export const checkBundle = async (
bundle,
)}`,
);
+ const properties = Object.entries(Object.getOwnPropertyDescriptors(bundle));
+ const nonValues = properties.filter(
+ ([, property]) => typeof property.get === 'function',
+ );
+ const nonStrings = properties.filter(
+ ([, property]) => typeof property.value !== 'string',
+ );
+ assert(
+ nonValues.length === 0 && nonStrings.length === 0,
+ `checkBundle cannot vouch for the ongoing integrity of a bundle ${q(
+ bundleName,
+ )} with getter properties (has ${nonValues.map(
+ ([name]) => name,
+ )}) or non-string value properties (has ${nonStrings.map(
+ ([name]) => name,
+ )})`,
+ );
const { moduleFormat } = bundle;
assert.typeof(
@@ -57,7 +74,7 @@ export const checkBundle = async (
d`checkBundle cannot bundle without the property 'endoZipBase64Sha512', which must be a string, got ${typeof endoZipBase64Sha512}`,
);
const bytes = decodeBase64(endoZipBase64);
- const { sha512: parsedSha512 } = await parseArchive(bytes, name, {
+ const { sha512: parsedSha512 } = await parseArchive(bytes, bundleName, {
computeSha512,
expectedSha512: endoZipBase64Sha512,
});

fix(check-bundle)!: Verify immutability of checked bundle

*BREAKING CHANGE*: check-bundle would previously allow bundles with
accessor properties or extraneous non-string properties.
These are now expressly disallowed.