feat(ses): Support global lexicals

As distinct from endowments, extra properties of `globalThis`, global lexicals are constant free variables that are not reachable by computing properties of `globalThis`.

Author: kriskowal

packages/ses/src/compartment-shim.js

@@ -82,7 +82,12 @@ const assertModuleHooks = compartment => {
 export class Compartment {
   constructor(endowments = {}, modules = {}, options = {}) {
     // Extract options, and shallow-clone transforms.
-    const { transforms = [], resolveHook, importHook } = options;
+    const {
+      transforms = [],
+      globalLexicals = {},
+      resolveHook,
+      importHook,
+    } = options;
     const globalTransforms = [...transforms];
 
     const realmRec = getCurrentRealmRec();
@@ -133,6 +138,11 @@ export class Compartment {
       instances,
       globalTransforms,
       globalObject,
+      // The caller continues to own the globalLexicals object they passed to
+      // the compartment constructor, but the compartment only respects the
+      // original values and they are constants in the scope of evaluated
+      // programs and executed modules.
+      globalLexicals: Object.freeze({ ...globalLexicals }),
     });
   }
 
@@ -162,12 +172,17 @@ export class Compartment {
     } = options;
     const localTransforms = [...transforms];
 
-    const { globalTransforms, globalObject } = privateFields.get(this);
+    const {
+      globalTransforms,
+      globalObject,
+      globalLexicals,
+    } = privateFields.get(this);
     const realmRec = getCurrentRealmRec();
     return performEval(realmRec, source, globalObject, endowments, {
       globalTransforms,
       localTransforms,
       sloppyGlobalsMode,
+      globalLexicals,
     });
   }
 

packages/ses/src/evaluate.js

@@ -21,6 +21,7 @@ export function performEval(
   {
     localTransforms = [],
     globalTransforms = [],
+    globalLexicals = {},
     sloppyGlobalsMode = false,
   } = {},
 ) {
@@ -33,12 +34,13 @@ export function performEval(
   ]);
 
   const scopeHandler = createScopeHandler(realmRec, globalObject, endowments, {
+    globalLexicals,
     sloppyGlobalsMode,
   });
   const scopeProxyRevocable = proxyRevocable(immutableObject, scopeHandler);
   // Ensure that "this" resolves to the scope proxy.
 
-  const constants = getScopeConstants(globalObject, endowments);
+  const constants = getScopeConstants(globalObject, endowments, globalLexicals);
   const evaluateFactory = makeEvaluateFactory(realmRec, constants);
   const evaluate = apply(evaluateFactory, scopeProxyRevocable.proxy, []);
 

packages/ses/src/module-instance.js

@@ -30,9 +30,11 @@ export const makeModuleInstance = (
     exportAlls,
   } = moduleRecord;
 
+  const compartmentFields = privateFields.get(compartment);
+
   const { exportsProxy, proxiedExports, activate } = getDeferredExports(
     compartment,
-    privateFields.get(compartment),
+    compartmentFields,
     moduleAliases,
     moduleSpecifier,
   );
@@ -301,6 +303,8 @@ export const makeModuleInstance = (
     activate();
   }
 
+  const { globalLexicals } = compartmentFields;
+
   const realmRec = getCurrentRealmRec();
   let optFunctor = performEval(
     realmRec,
@@ -310,6 +314,7 @@ export const makeModuleInstance = (
     {
       localTransforms: [],
       globalTransforms: [],
+      globalLexicals,
       sloppyGlobalsMode: false,
     },
   );

packages/ses/src/scope-constants.js

@@ -141,16 +141,25 @@ function isImmutableDataProperty(obj, name) {
  * service if any of the names are keywords or keyword-like. This is
  * safe and only prevent performance optimization.
  */
-export function getScopeConstants(globalObject, localObject = {}) {
+export function getScopeConstants(
+  globalObject,
+  localObject = {},
+  globalLexicals = {},
+) {
   // getOwnPropertyNames() does ignore Symbols so we don't need to
   // filter them out.
   const globalNames = getOwnPropertyNames(globalObject);
   const localNames = getOwnPropertyNames(localObject);
 
+  // All lexical globals are constants.
+  const lexicalConstants = getOwnPropertyNames(globalLexicals);
+
   // Collect all valid & immutable identifiers from the endowments.
   const localConstants = localNames.filter(
     name =>
-      isValidIdentifierName(name) && isImmutableDataProperty(localObject, name),
+      !lexicalConstants.includes(name) &&
+      isValidIdentifierName(name) &&
+      isImmutableDataProperty(localObject, name),
   );
 
   // Collect all valid & immutable identifiers from the global that
@@ -164,5 +173,5 @@ export function getScopeConstants(globalObject, localObject = {}) {
       isImmutableDataProperty(globalObject, name),
   );
 
-  return [...globalConstants, ...localConstants];
+  return [...globalConstants, ...localConstants, ...lexicalConstants];
 }

packages/ses/src/scope-handler.js

@@ -38,7 +38,7 @@ export function createScopeHandler(
   realmRec,
   globalObject,
   endowments = {},
-  { sloppyGlobalsMode = false } = {},
+  { globalLexicals = {}, sloppyGlobalsMode = false } = {},
 ) {
   return {
     // The scope handler throws if any trap other than get/set/has are run
@@ -67,6 +67,13 @@ export function createScopeHandler(
         // fall through
       }
 
+      // Global lexicals.
+      if (prop in globalLexicals) {
+        // Use reflect to defeat accessors that could be present on the
+        // globalLexicals object itself as `this`. XXX?
+        return reflectGet(globalLexicals, prop, globalObject);
+      }
+
       // Properties of the global.
       if (prop in endowments) {
         // Use reflect to defeat accessors that could be
@@ -96,7 +103,7 @@ export function createScopeHandler(
       return reflectSet(globalObject, prop, value);
     },
 
-    // we need has() to return false for some names to prevent the lookup  from
+    // we need has() to return false for some names to prevent the lookup from
     // climbing the scope chain and eventually reaching the unsafeGlobal
     // object (globalThis), which is bad.
 
@@ -124,7 +131,8 @@ export function createScopeHandler(
         prop === 'eval' ||
         prop in endowments ||
         prop in globalObject ||
-        prop in globalThis
+        prop in globalThis ||
+        prop in globalLexicals
       ) {
         return true;
       }

packages/ses/test/global-lexicals-evaluate.test.js

@@ -0,0 +1,134 @@
+/* global Compartment */
+import test from 'tape';
+import '../src/main.js';
+
+test('endowments own properties are mentionable', t => {
+  t.plan(1);
+
+  const endowments = { hello: 'World!' };
+  const modules = {};
+  const compartment = new Compartment(endowments, modules);
+
+  const whom = compartment.evaluate('hello');
+  t.equal(whom, 'World!');
+});
+
+test('endowments own properties are enumerable', t => {
+  t.plan(1);
+
+  const endowments = { hello: 'World!' };
+  const modules = {};
+  const compartment = new Compartment(endowments, modules);
+
+  const keys = compartment.evaluate('Object.keys(globalThis)');
+  t.deepEqual(keys, ['hello']);
+});
+
+test('endowments prototypically inherited properties are not mentionable', t => {
+  t.plan(1);
+
+  const endowments = { __proto__: { hello: 'World!' } };
+  const modules = {};
+  const compartment = new Compartment(endowments, modules);
+
+  t.throws(() => compartment.evaluate('hello'), /hello is not defined/);
+});
+
+test('endowments prototypically inherited properties are not enumerable', t => {
+  t.plan(1);
+
+  const endowments = { __proto__: { hello: 'World!' } };
+  const modules = {};
+  const compartment = new Compartment(endowments, modules);
+
+  const keys = compartment.evaluate('Object.keys(globalThis)');
+  t.deepEqual(keys, []);
+});
+
+test('global lexicals are mentionable', t => {
+  t.plan(1);
+
+  const endowments = {};
+  const modules = {};
+  const globalLexicals = { hello: 'World!' };
+  const compartment = new Compartment(endowments, modules, { globalLexicals });
+
+  const whom = compartment.evaluate('hello');
+  t.equal(whom, 'World!');
+});
+
+test('global lexicals are not reachable from global object', t => {
+  t.plan(1);
+
+  const endowments = {};
+  const modules = {};
+  const globalLexicals = { hello: 'World!' };
+  const compartment = new Compartment(endowments, modules, { globalLexicals });
+
+  const keys = compartment.evaluate('Object.keys(globalThis)');
+  t.deepEqual(keys, []);
+});
+
+test('global lexicals prototypically inherited properties are not mentionable', t => {
+  t.plan(1);
+
+  const endowments = {};
+  const modules = {};
+  const globalLexicals = { __proto__: { hello: 'World!' } };
+  const compartment = new Compartment(endowments, modules, { globalLexicals });
+
+  t.throws(() => compartment.evaluate('hello'), /hello is not defined/);
+});
+
+test('global lexicals prototypically inherited properties are not enumerable', t => {
+  t.plan(1);
+
+  const endowments = {};
+  const modules = {};
+  const globalLexicals = { __proto__: { hello: 'World!' } };
+  const compartment = new Compartment(endowments, modules, { globalLexicals });
+
+  const keys = compartment.evaluate('Object.keys(globalThis)');
+  t.deepEqual(keys, []);
+});
+
+test('global lexicals overshadow global object', t => {
+  t.plan(1);
+
+  const endowments = { hello: 'Your name here' };
+  const modules = {};
+  const globalLexicals = { hello: 'World!' };
+  const compartment = new Compartment(endowments, modules, { globalLexicals });
+
+  const whom = compartment.evaluate('hello');
+  t.equal(whom, 'World!');
+});
+
+test('global lexicals are constant', t => {
+  t.plan(1);
+
+  const endowments = {};
+  const modules = {};
+  const globalLexicals = { hello: 'World!' };
+  const compartment = new Compartment(endowments, modules, { globalLexicals });
+
+  t.throws(
+    () => compartment.evaluate('hello = "Dave."'),
+    /Assignment to constant/,
+  );
+});
+
+test('global lexicals are captured on construction', t => {
+  t.plan(1);
+
+  const endowments = {};
+  const modules = {};
+  const globalLexicals = { hello: 'World!' };
+  const compartment = new Compartment(endowments, modules, { globalLexicals });
+
+  // Psych!
+  globalLexicals.hello = 'Something else';
+
+  const whom = compartment.evaluate('hello');
+  t.equal(whom, 'World!');
+});