dperini / nwsapi

Fast CSS Selectors API Engine
MIT License
105 stars 36 forks source link

Remove use of `Function` constructor #51

Closed sno2 closed 2 years ago

sno2 commented 2 years ago

Hello, deno-dom uses this library to emulate the DOM in Deno. However, executing JavaScript from strings can result in possible insecure security flaws within code. As a result, secure web platforms such as Deno Deploy have disabled string code execution, which makes nwsapi.js unusable in secure contexts due to its use of the Function constructor for codegen in nwsapi.js, I am going to try and fix this later today after I get home but just going to create an issue in response to another issue in the deno-dom repo about deno-dom not working on Deno Deploy.

rokoucha commented 2 years ago

Cloudflare Workers also does not allow eval() or Function constructor. https://developers.cloudflare.com/workers/runtime-apis/web-standards#javascript-standards

sno2 commented 2 years ago

Here's an update: I spent a couple of days trying to refactor the code. However, basically 700+ lines are built with generating the code that is executed in the Function so it took a lot of work to even get 200 lines changed to using a lexer-like system. It was terrible debugging for me as I am used to TypeScript so I then tried to just port the code to TypeScript but there were so many styles used in the code that were above TypeScript's checker (e.g. assign var in if condition, codegen). Therefore, I'm just going to build my own query parser that will implement all of the functionality of nwsapi but with simple classes and no code generation (but still allow for functional on pre-parsed selectors). Going pretty well, but I'm going to close this issue and I expect to finish within two weeks.

Edit: I'm also going to use zero-copy immutable strings when parsing instead of the RegEx-based approach which will hopefully increase performance enough to compete with the speed of codegen.

Edit again: I failed at this :( Hopefully someone else can try and be more motivated than I.