fix: remove __allowUnsafeMonkeyPatching__
MODIFY
packages/ses/NEWS.md
packages/ses/NEWS.md
User-visible changes in SES:
+# TODO title vnext
+
+- Removes the `__allowUnsafeMonkeyPatching__` option to lockdown. As the name
+ should indicate, this was always an unsafe temporary kludge. Its only known
+ use was in agoric-sdk, now gone at
+ https://github.com/Agoric/agoric-sdk/pull/5922 . Without this option, a
+ successful `lockdown` will now always harden the primordials.
+
# v0.15.8 (2022-02-18)
- Harden now gives special treatment to typed arrays.

MODIFY
packages/ses/index.d.ts
packages/ses/index.d.ts
@@ -33,7 +33,6 @@ export interface LockdownOptions {
overrideTaming?: 'moderate' | 'min' | 'severe';
overrideDebug?: Array<string>;
domainTaming?: 'safe' | 'unsafe';
- __allowUnsafeMonkeyPatching__?: 'safe' | 'unsafe';
}
export type Lockdown = (options?: LockdownOptions) => void;

MODIFY
packages/ses/index.test-d.ts
packages/ses/index.test-d.ts
@@ -18,7 +18,6 @@ lockdown({
stackFiltering: 'verbose',
overrideTaming: 'moderate',
overrideDebug: ['ponies'],
- __allowUnsafeMonkeyPatching__: 'unsafe',
});
// @ts-expect-error
@@ -210,4 +209,3 @@ expectType<Error>(assert.error(X`details are ${stringable}`, TypeError));
expectType<Error>(assert.error(X`details are ${stringable}`, TypeError, { errorName: 'Nom de plum' }));
expectType<never>(assert.fail(X`details are ${stringable}`));
-

MODIFY
packages/ses/src/lockdown-shim.js
packages/ses/src/lockdown-shim.js
@@ -176,10 +176,6 @@ export const repairIntrinsics = (options = {}) => {
/** @param {string} debugName */
debugName => debugName !== '',
),
- __allowUnsafeMonkeyPatching__ = getenv(
- '__LOCKDOWN_ALLOW_UNSAFE_MONKEY_PATCHING__',
- 'safe',
- ),
dateTaming = 'safe', // deprecated
mathTaming = 'safe', // deprecated
...extraOptions
@@ -386,11 +382,9 @@ export const repairIntrinsics = (options = {}) => {
// @ts-ignore enablePropertyOverrides does its own input validation
enablePropertyOverrides(intrinsics, overrideTaming, overrideDebug);
- if (__allowUnsafeMonkeyPatching__ !== 'unsafe') {
// Finally register and optionally freeze all the intrinsics. This
// must be the operation that modifies the intrinsics.
harden(intrinsics);
- }
// Reveal harden after lockdown.
// Harden is dangerous before lockdown because hardening just

DELETE
packages/ses/test/test-unsafe-kludge-for-react.js
-/* global globalThis */
-
-import test from 'ava';
-import '../index.js';
-
-lockdown({
- __allowUnsafeMonkeyPatching__: 'unsafe',
- overrideTaming: 'min',
-});
-
-test('Unsafe kludge for monkey patching', t => {
- t.false(Object.isFrozen(Object.prototype));
-
- const x = {};
- x.toString = () => 'foo';
- x.constructor = 'Foo';
- t.is(`${x}`, 'foo');
- t.is(x.constructor, 'Foo');
-
- harden(x);
- // Because harden is tranisitively contagious up inheritance chain,
- // hardening x also hardens Object.prototype and other primordials
- // reachable from it.
- for (const reachable of [
- Object.prototype,
- Object,
- Function.prototype,
- Function.prototype.constructor,
- Function.prototype.apply,
- ]) {
- t.true(Object.isFrozen(reachable));
- }
- for (const unreachable of [
- Function,
- // eslint-disable-next-line no-eval
- eval,
- globalThis,
- Reflect,
- Reflect.apply,
- ]) {
- t.false(Object.isFrozen(unreachable));
- }
-
- const y = {};
- // Under even the 'min' override taming, we still enable
- // Object.prototype.toString to be overridden by assignment.
- y.toString = () => 'bar';
- t.throws(
- () => {
- // At the 'min' override taming, we do not enable
- // Object.prototype.constructor to be overridden by
- // assignment. This did not matter before hardening
- // x because the override mistake only applies to
- // non-writable properties and Object.prototype had
- // not yet been frozen.
- y.constructor = 'Bar';
- },
- undefined,
- 'Override should not be enabled for "constructor".',
- );
- t.is(`${y}`, 'bar');
- t.is(y.constructor, Object);
-});

fix: remove __allowUnsafeMonkeyPatching__