endojs / endo

Endo is a distributed secure JavaScript sandbox, based on SES
Apache License 2.0
761 stars 68 forks source link

expose captureFromMap() #2308

Closed boneskull closed 3 weeks ago

boneskull commented 4 weeks ago

Description

This exposes captureFromMap() in capture-lite.js.

This function is similar to e.g., makeArchiveFromMap() in archive-lite.js; but rather than creating a .zip archive, it simply returns the fully-completed CompartmentMapDescriptor, Sources, and a mapping of filename to compartment map name.

This information is needed for next-gen-lavamoat-node ("endomoat")'s automatic policy generation.

Another commit disables the hardcoded check for parsers in the compartment map validation functions (which are no longer necessary after #2304).

Questions

Security Considerations

None that I'm aware of.

Scaling Considerations

If anything, it may shave a few nanoseconds off of compartment map validation.

Documentation Considerations

Probably should be added to NEWS.md.

Testing Considerations

Compatibility Considerations

None

Upgrade Considerations

None

boneskull commented 3 weeks ago

@kriskowal I've added some tests: https://github.com/endojs/endo/pull/2308/files#diff-83a914c4839dc5f99eee550a04270efaa250a614f292da572b717e3cde1db18f

Noting that a snapshot would be inappropriate for captureFromMap()'s output, since it contains many absolute paths.