-
Notifications
You must be signed in to change notification settings - Fork 309
Expand file tree
/
Copy pathevalScript.ts
More file actions
189 lines (168 loc) 路 4.43 KB
/
Copy pathevalScript.ts
File metadata and controls
189 lines (168 loc) 路 4.43 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
import log from "loglevel";
import _ from "lodash";
const window = { _ } as any;
// global variables black list, forbidden to use
const blacklist = new Set<PropertyKey>([
"top",
"parent",
"document",
"location",
"chrome",
"setTimeout",
"fetch",
"setInterval",
"clearInterval",
"setImmediate",
"XMLHttpRequest",
"importScripts",
"Navigator",
"MutationObserver",
]);
const globalVarNames = new Set<PropertyKey>(["window", "globalThis", "self"]);
export function createBlackHole(): any {
return new Proxy(
function () {
return createBlackHole();
},
{
get(t, p, r) {
if (p === "toString") {
return function () {
return "";
};
}
if (p === Symbol.toPrimitive) {
return function () {
return "";
};
}
log.log(`[Sandbox] access ${String(p)} on black hole, return mock object`);
return createBlackHole();
},
}
);
}
function createMockWindow() {
return new Proxy(
{},
{
has() {
return true;
},
set(target, p, newValue) {
return Reflect.set(target, p, newValue);
},
get(target, p) {
if (p in target) {
return Reflect.get(target, p);
}
if (typeof p === "string" && blacklist.has(p)) {
log.log(`[Sandbox] access ${String(p)} on mock window, return mock object`);
return createBlackHole();
}
const ret = Reflect.get(window, p);
if (typeof ret === "function" && !ret.prototype) {
return ret.bind(window);
}
// get DOM element by id, serializing may cause error
//if (isDomElement(ret)) {
// return undefined;
//}
return ret;
},
}
);
}
let mockWindow: any = createMockWindow();
export function clearMockWindow() {
mockWindow = createMockWindow();
}
interface SandBoxOption {
/**
* disable all limit, like running in host
*/
disableLimit?: boolean;
}
function proxySandbox(context: any, options?: SandBoxOption) {
const { disableLimit = false } = options || {};
const isProtectedVar = (key: PropertyKey) => {
return key in context || globalVarNames.has(key);
};
const cache = {};
return new Proxy(mockWindow, {
has(target, p) {
// proxy all variables
return true;
},
get(target, p, receiver) {
if (p === Symbol.unscopables) {
return undefined;
}
if (p === "toJSON") {
return target;
}
if (globalVarNames.has(p)) {
return disableLimit ? window : target;
}
if (p in context) {
if (p in cache) {
return Reflect.get(cache, p);
}
let value = Reflect.get(context, p, receiver);
if (typeof value === "object" && value !== null) {
Object.freeze(value);
Object.values(value).forEach(Object.freeze);
}
Reflect.set(cache, p, value);
return value;
}
if (disableLimit) {
return Reflect.get(window, p);
}
return Reflect.get(target, p, receiver);
},
set(target, p, value, receiver) {
if (isProtectedVar(p)) {
throw new Error(p.toString() + " can't be modified");
}
return Reflect.set(target, p, value, receiver);
},
defineProperty(target, p, attributes) {
if (isProtectedVar(p)) {
throw new Error("can't define property:" + p.toString());
}
return Reflect.defineProperty(target, p, attributes);
},
deleteProperty(target, p) {
if (isProtectedVar(p)) {
throw new Error("can't delete property:" + p.toString());
}
return Reflect.deleteProperty(target, p);
},
setPrototypeOf(target, v) {
throw new Error("can't invoke setPrototypeOf");
},
});
}
export function getErrorMessage(err: unknown) {
const errorMesasge =
err instanceof Error
? err.name + ": " + err.message
: typeof err === "string"
? err
: "UnknownError: unknown exception during eval";
return errorMesasge;
}
export async function evalFunc(functionBody: string, context: any, options?: SandBoxOption) {
const code = `with(this){
return (async function() {
'use strict';
${functionBody};
}).call(this);
}`;
// eslint-disable-next-line no-new-func
const vm = new Function(code);
const sandbox = proxySandbox(context, options);
const result = await vm.call(sandbox);
return result;
}