feat(bundle-source): Apply evasive transforms to Endo archives #2768
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
refs: #2684
Description
SES censors any script or module that appears to use dynamic import.
Since the SES runtime is lightweight and risk averse, it uses a regular expression to detect this pattern, but there are many false positives, particularly apparent dynamic import within comments.
These are common especially in JSDoc comments with TypeScript imports.
The
getExports
andnestedEvaluate
bundle formats apply a parser-based transform that rewrites comments such that SES won't censor them.This change brings these existing transforms to bear on the individual files of an Endo compartment when using the new
endoZipBase64
bundle type.To facilitate this, a new version of the compartment mapper provides a "module transforms" hook.
The
getExports
andnestedEvaluate
bundle formats also give Rollup a turn at transforming the input sources.This alters the shape of the AST such that "inner comments" never occur.
An "inner comment" is a comment that neither leads nor follows non-comment code.
Such comments are common specifically in files like the conventional types.js that consists entirely of TypeScript JSDocs.
Since Endo doesn't preprocess files with Rollup, the comment rewriting transform needs to traverse this previously unexplored branch of the syntax trees.
Security Considerations
This change alters the presentation of client code to SES.
It should do so in a way that is semantically equivalent.
SES does not rely on these transformations to enforce integrity.
Documentation Considerations
This change does not require further documentation.
Users may notice in their debugger that comments with import will see Ximport instead.
The intention is to relieve the concern of SES censorship from the authors of client code, particularly third-party module authors who do not anticipate their code being executed in a SES environment.
Testing Considerations
This change introduces a new test for the inner comments.
Sufficient coverage of Endo should occur through real usage throughout the Agoric SDK, as we shift from using
nestedEvaluate
toendoZipBase64
.