search

rscarson / rustyscript

Effortless JS integration for rust
MIT License
168 stars 18 forks source link

The deno core exposes an `op_panic` in the base runtime which can force a panic in the runtime's containing thread #174

Closed rscarson closed 2 months ago

rscarson commented 2 months ago

A new review of available-by-default ops has revealed Deno.core.ops.op_panic, which when called forces a panic in the thread containing the runtime.

This can be fixed by stubbing out the panic op:

Deno.core.ops.op_panic = (msg) => { throw new Error(msg) };

Other ops, such as op_read can only be used on resource-ids loaded into a table on the rust side, and therefore do not violate sandboxing

Affects 0.4.x up-to and including 0.6.0

rscarson commented 2 months ago

Fixed in v0.6.1