PoC

https://github.com/LavaMoat/docs/blob/main/react-native-and-ses-lockdown.md

Discussion

Even after forfeiting certain plugins, creating a custom preset the following error appears:

failed to delete intrinsics.Promise.resolve.prototype

Tracking on which procedure is replacing the built-in promise takes us to the following chain of facts:

• node_modules/react-native/Libraries/Core/InitializeCore.js

require('./setUpSystrace');
require('./setUpErrorHandling');
require('./polyfillPromise');
require('./setUpRegeneratorRuntime');
require('./setUpTimers');

• node_modules/react-native/Libraries/Core/polyfillPromise.js

if (global?.HermesInternal?.hasPromise?.()) {

//  <snippet>

} else {
  polyfillGlobal('Promise', () => require('../Promise'));
}

• node_modules/react-native/Libraries/Promise.js

const Promise = require('promise/setimmediate/es6-extensions');

which calls the Promise polyfill at node_modules/promise/src/es6-extensions.js.

PoC Solution

• Patch node_modules/react-native/Libraries/Core/InitializeCore.js ommenting the line

// require('./polyfillPromise');

Items of Action

Similar to #4

• Find out which procedure is actually calling to polyfill Promise
  • Suggestion (by @naugtur) Instead of patching RN we need to look at how they are checking the built-in promise on the global object because they shouldn't be ovewriting this.
• Maybe we want to create a transform for the build package to prevent babel regenerator to put these monkey patches.
  • So, if RN is changing things, we could change them back!
  • This approach avoids patches, avoids creating a custom preset, and require us to just add a plugin at babel.config.js just after the preset.