fix(moduleLocations): use a Map internally to prevent attacks
MODIFY
README.md
README.md
@@ -33,7 +33,7 @@ const importer = makeImporter({
analyze, // (rs: ResourceStream) => Promise<ModuleStaticRecord> // cached by ModuleLocation
// interface ModuleLinkageRecord extends ModuleStaticRecord {
// moduleLocation: ModuleLocation,
- // moduleLocations: Record<string, ModuleLocation>,
+ // moduleLocations: Map<string, ModuleLocation>,
// }
rootLinker, // see below:
// {

MODIFY
src/link.js
src/link.js
@@ -25,7 +25,7 @@ export const makeEvaluateLinker = (evaluator, instanceCache = new Map()) => {
instanceCache.set(linkageRecord.moduleLocation, linkedInstance);
for (const specifier of keys(linkageRecord.imports)) {
- const moduleLocation = linkageRecord.moduleLocations[specifier];
+ const moduleLocation = linkageRecord.moduleLocations.get(specifier);
const importedInstance = recursiveLink(
moduleLocation,
linker,

MODIFY
src/moduleInstance.js
src/moduleInstance.js
@@ -219,7 +219,7 @@ export function makeModuleInstance(
const candidateAll = create(null);
candidateAll.default = false;
for (const [specifier, importUpdaters] of updateRecord.entries()) {
- const moduleLocation = linkageRecord.moduleLocations[specifier];
+ const moduleLocation = linkageRecord.moduleLocations.get(specifier);
const instance = importNS.get(moduleLocation);
instance.getNamespace(); // bottom up cycle tolerant
const { notifiers: modNotifiers } = instance;

MODIFY
src/pipeline.js
src/pipeline.js
@@ -62,7 +62,7 @@ export const makeImporter = (importHooks, moduleCache = new Map()) => {
// console.log(`rs`, rs);
const linkageRecord = {
...rs.staticRecord,
- moduleLocations: {},
+ moduleLocations: new Map(),
moduleLocation,
};
// console.log(`linkageRecord`, linkageRecord);
@@ -73,7 +73,7 @@ export const makeImporter = (importHooks, moduleCache = new Map()) => {
loadOne(spec, undefined, moduleLocation).then(
// Populate the record from the specifier to the moduleLocation.
subModuleLocation =>
- (linkageRecord.moduleLocations[spec] = subModuleLocation),
+ (linkageRecord.moduleLocations.set(spec, subModuleLocation)),
),
),
);

MODIFY
test/test-link.js
test/test-link.js
@@ -27,7 +27,7 @@ ${async ({ liveVar, imports }) => {
imports: { './def': ['def'] },
fixedExportMap: {},
liveExportMap: { abc: ['abc', false] },
- moduleLocations: { './def': 'https://www.example.com/foo/def' },
+ moduleLocations: new Map([['./def', 'https://www.example.com/foo/def']]),
moduleLocation: 'https://www.example.com/foo/abc',
},
],
@@ -40,7 +40,7 @@ async ({ imports, liveVar }) => { await imports(new Map()); liveVar.lo(456); lo
imports: {},
fixedExportMap: {},
liveExportMap: { def: ['lo', true] },
- moduleLocations: {},
+ moduleLocations: new Map(),
moduleLocation: 'https://www.example.com/foo/def',
},
],

fix(moduleLocations): use a Map internally to prevent attacks