endojs / endo

Endo is a distributed secure JavaScript sandbox, based on SES
Apache License 2.0
829 stars 72 forks source link

New evaluators should always have suffix clarifying their start production #186

Closed erights closed 4 years ago

erights commented 6 years ago

Both realm.evaluate(src, endowments) and SES.confine(src, endowments) parse source as a Program and evaluate it to its completion value. Because many JS expressions, when parsed as Programs, will parse as expression-statements, and because the completion value of an expression statement is the value of the expression, we often mistakenly use them to evaluate expressions. We have repeatedly stubbed our toe on expressions that begin with { or function. These expressions, when parsed as programs, parse as programs that mean something else and have different completion values.

Even after introducing the SES.confineExpr(exprSrc, endowments) convenience, we still accidentally used SES.confine on an inappropriate expression. Suggestion:

All new evaluators should come overloaded by explicit suffix clarifying what their start symbol is. Retire realm.evaluate and SES.confine and instead have:

jfparadis commented 4 years ago

Also discussed here: https://github.com/Agoric/agoric-sdk/issues/602

Apart from modules and Function(), we are dealing with three different types of evaluation in JavaScript:

new Compartment().evaluate() is proposed normative to:

The reason are:

Closing, reasons documented.