Bugfixes

* Fix #41 (using an aborted sandbox in the browser doesn't result in an error)
* Fix an issue with `file://` ancestors preventing sandbox init
* Fix an issue with only the first argument of external methods working
* Update dependencies

Author: corrideat

package-lock.json

@@ -1,6 +1,6 @@
 {
 	"name": "@exact-realty/lot",
-	"version": "0.0.24",
+	"version": "0.0.25",
 	"description": "Sandbox for isolating ECMAScript code",
 	"main": "./dist/index.cjs",
 	"types": "./dist/index.d.cts",
@@ -136,15 +136,15 @@
 		"@exact-realty/esbuild-plugin-closure-compiler": "^1.0.4",
 		"@exact-realty/esbuild-plugin-inline-js": "^1.1.7",
 		"@types/selenium-webdriver": "^4.1.23",
-		"@typescript-eslint/eslint-plugin": "^7.12.0",
-		"@typescript-eslint/parser": "^7.12.0",
-		"esbuild": "^0.21.4",
+		"@typescript-eslint/eslint-plugin": "^7.13.0",
+		"@typescript-eslint/parser": "^7.13.0",
+		"esbuild": "^0.21.5",
 		"eslint": "^8.56.0",
 		"eslint-config-prettier": "^9.1.0",
 		"eslint-plugin-prettier": "^5.1.3",
 		"glob": "^10.4.1",
 		"google-closure-compiler": "^20240317.0.0",
-		"prettier": "^3.3.1",
+		"prettier": "^3.3.2",
 		"selenium-webdriver": "^4.21.0",
 		"ts-node": "^10.9.2",
 		"ts-patch": "^3.2.0",

package.json

@@ -82,7 +82,12 @@ const setupSandboxListeners = <T>(
 					return;
 				}
 
-				requestHandler(externalMethods, data[1], data[2], data[3]);
+				requestHandler(
+					externalMethods,
+					data[1],
+					data[2],
+					...data.slice(3),
+				);
 
 				return;
 			}

src/trusted/lib/setupSandboxListeners.ts

@@ -75,7 +75,9 @@ const parentOrigin =
 	'ancestorOrigins' in location &&
 	location['ancestorOrigins'] &&
 	location['ancestorOrigins'][0] &&
-	location['ancestorOrigins'][0] !== 'null'
+	location['ancestorOrigins'][0] !== 'null' &&
+	// `file://` URLs seem to be problematic as window.origin can be `null`
+	/^https?:/i.test(location['ancestorOrigins'][0])
 		? location['ancestorOrigins'][0]
 		: '*';
 

src/untrusted/impl/browser/iframeSandboxInit.inline.ts

@@ -106,16 +106,18 @@ const performTaskFactory = <T>(
 		return taskPromise;
 	};
 
-	const performTaskProxy = proxyMaybeRevocable(
+	const [performTaskProxy, revoke] = proxyMaybeRevocable(
 		revocable || null,
 		performTask,
 		{},
 	);
 
 	return [
-		performTaskProxy['proxy'],
+		performTaskProxy,
 		() => {
-			performTaskProxy.revoke();
+			if (revoke) {
+				revoke();
+			}
 			const e = new E('Task aborted');
 			// Abort all pending tasks
 			unresolved.splice(0).forEach((x) => {

src/untrusted/lib/performTaskFactory.ts

@@ -24,9 +24,10 @@ describe('proxyMaybeRevocable', () => {
 			get: (obj, prop) => (prop in obj ? obj[prop] : 42),
 		};
 
-		const { proxy, revoke } = proxyMaybeRevocable(true, target, handler);
+		const [proxy, revoke] = proxyMaybeRevocable(true, target, handler);
 
 		assert.equal(proxy.someNonExistentProp, 42);
+		assert.ok(typeof revoke === 'function');
 
 		revoke();
 
@@ -41,10 +42,9 @@ describe('proxyMaybeRevocable', () => {
 			get: (obj, prop) => (prop in obj ? obj[prop] : 42),
 		};
 
-		const { proxy, revoke } = proxyMaybeRevocable(false, target, handler);
+		const [proxy, revoke] = proxyMaybeRevocable(false, target, handler);
 		assert.equal(proxy.someNonExistentProp, 42);
-
-		revoke();
+		assert.ok(!revoke);
 
 		assert.equal(proxy.someNonExistentProp, 42);
 	});
@@ -53,6 +53,6 @@ describe('proxyMaybeRevocable', () => {
 		const someObject = {};
 		const result = proxyMaybeRevocable(null, someObject, someObject);
 
-		assert.strictEqual(result.proxy, someObject);
+		assert.strictEqual(result[0], someObject);
 	});
 });

src/untrusted/lib/proxyMaybeRevocable.spec.ts

@@ -20,10 +20,7 @@ type TProxyMaybeRevocable = {
 		revocable: boolean | null,
 		target: T,
 		handler: ProxyHandler<T>,
-	): {
-		proxy: T;
-		revoke: () => void;
-	};
+	): [T] | [T, () => void];
 };
 
 /**
@@ -43,12 +40,11 @@ type TProxyMaybeRevocable = {
  */
 const proxyMaybeRevocable: TProxyMaybeRevocable = (revocable, ...args) => {
 	if (revocable) {
-		return Proxy.revocable(...args);
+		const r = Proxy.revocable(...args);
+		return [r['proxy'], r['revoke'].bind(r)];
 	}
-	return {
-		['proxy']: revocable === null ? args[0] : new PX(...args),
-		['revoke']: Boolean,
-	};
+
+	return [revocable === null ? args[0] : new PX(...args)];
 };
 
 export default proxyMaybeRevocable;