Closes: #1891 (tracker), tested on #2334, Endo Sync: 2025-01-29

Previous iterations: #2723 (comment)

TODO

• add new lockdown option
  • legacyHermesTaming: safe (default), unsafe
  • hostEvaluators: '_legacy' (default), 'all' (regular), 'none' (strict csp), 'no-direct' (hermes)
  • fail on safe-eval (default) and no-direct (hermes) early
    • i.e. require unsafe-eval and no-direct on hermes (since with not supported)
  • add assertions (on non _legacy options) and types
  • update ses/error-codes/SES_DIRECT_EVAL.md
  • update lockdown.md
  • refactor assertDirectEvalAvailable to probeHostEvaluators
    • return results, now used for further assertions
    • test Function() constructor and eval() separately then together
  • ensure backwards compatibility (lockdown({}) - no option provided)
    • before: worked with a strict CSP (assertDirectEvalAvailable swallows strict CSP error then skips SES_DIRECT_EVAL error)
    • after: 'all' as default (breaking change) with a strict CSP will error, 'none' is now required
    • endo sync: 4th option undefined, warn (with new error reporter) to use the new lockdown option
    • since getEnvironmentOption default must be a string ('all'), warn instead of SES_DIRECT_EVAL error with a strict CSP
    • default to '_legacy' under-the-hood if lockdown({}), warn to use new option; SES_DIRECT_EVAL error with a normal CSP, also when set to 'all'
    • document TODOs to replace '_legacy' with 'all' as default in future (the breaking change)
  • disable compartment-shim when bundling ses for hermes
  • disable: globalThis Compartment and testCompartmentHooks
  • disable compartmentInstance.evaluate instead of deleting compartment
    • makeCompartmentConstructor setGlobalObjectEvaluators safeEvaluate is the default (no evalTaming yet)
    • CompartmentPrototype.evaluate returns compartmentEvaluate safeEvaluate is the default (no evalTaming)
    • endo sync: throw error on usage, if env lacks direct eval support
• test on hermes
  • evalTaming: no-eval/safe-eval/unsafe-eval
  • hostEvaluators: all/none/no-direct
  • post-lockdown: eval(42), eval('42'), Function('return 42')()
• check prev test branch (below)
• fix typos
• update smoke test with Hermes eval assertions
• enable Hermes VM in CI
• fix(ses): lockdown options should be kebob-case #2739 merged 🎉 resolve conflicts
• endo sync
  • lockdown options enum values kebab-case vs camelCase
  • could make no-direct a new evalTaming option instead, however this would mean no longer being able to choose unsafe-eval or no-eval, one would have to be the assumed default
  • could use no-eval instead of unsafe-eval (example added in docs)
  • dynamic no-direct instead of via lockdown option? no since we don't know the user intention, whether to throw SES_DIRECT_EVAL or allow SES to init
  • why not error on safe-eval? did this originally, but better to fail earlier when there are incompatible lockdown options (safe-eval requires direct eval)
  • no-compartment-eval instead of no-direct? maybe not since we also now allow SES to init w/o direct eval
  • --disallow-code-generation-from-strings useful node flag to emulate a strict csp runtime in tests
• re-review

Follow-up: new Compartment() fails on removeUnpermittedIntrinsics at

• Tolerating undeletable intrinsics.%CompartmentPrototype%.importNow.prototype === undefined
• Uncaught TypeError: property is not configurable

test branch https://github.com/endojs/endo/tree/ses-hermes-p2 (from #2334)

• yarn build:hermes bundle ses for hermes
• yarn test:hermes run ses/test/_hermes-smoke.js

Hermes eval behaviour on bin/hermesc (standalone compiler) and bin/hermes (vm, eshost)

// Hermes direct eval cannot access or modify variables within its closure scope (sloppy and indirect)

eval = globalThis.eval; // remains direct eval, compiler: "error: invalid assignment left-hand side"

// calling globalThis.eval(...) uses indirect eval

// calling eval on Hermes VM emits: "warning: Direct call to eval(), but lexical scope is not supported."

print(eval(1 + 1));
print(eval("1 + 1"));

function a(eval, TEST) {
  // compiler: "error: cannot declare 'eval'"
  eval("TEST=true");
  return TEST;
}
print(a(eval, false)); // vm: false

function b(eval) {
  // compiler: "error: cannot declare 'eval'"
  var TEST = false;
  eval("TEST=true");
  return TEST;
}
print(b(eval)); // vm: false

function c() {
  var TEST = false;
  eval("TEST=true");
  return TEST;
}
print(c()); // vm: false

function d() {
  var TEST2 = 42;
  return eval("TEST2");
}
print(d()); // ReferenceError: Property 'TEST2' doesn't exist

// Note: eshost only runs bin/hermes (vm), not bin/hermesc (compiler)