Merge pull request #1454 from endojs/ses-util

feat(ses): publish utils bundle

packages/ses/package.json

@@ -42,6 +42,7 @@
       "import": "./index.js",
       "require": "./dist/ses.cjs"
     },
+    "./tools.js": "./tools.js",
     "./package.json": "./package.json"
   },
   "scripts": {
@@ -85,6 +86,7 @@
     "dist",
     "index.d.ts",
     "index.js",
+    "tools.js",
     "src"
   ],
   "private": false,

packages/ses/package.json.md

@@ -115,6 +115,10 @@ is deprecated.
 
 The value is the same as for `"."` above.
 
+## "./tools.js": ...
+
+Exposes tools that are useful for creating hardened JavaScript environments that move certain responsibilities from `eval` to generated code.
+
 ## "./package.json": "./package.json"
 
 Tools like Svelte need to access the `package.json` of every package in an

packages/ses/src/sloppy-globals-scope-terminator.js

@@ -51,3 +51,4 @@ export const createSloppyGlobalsScopeTerminator = globalObject => {
 
   return sloppyGlobalsScopeTerminator;
 };
+freeze(createSloppyGlobalsScopeTerminator);

packages/ses/src/transforms.js

@@ -7,6 +7,7 @@ import {
   stringSearch,
   stringSlice,
   stringSplit,
+  freeze,
 } from './commons.js';
 import { getSourceURL } from './get-source-url.js';
 
@@ -252,3 +253,14 @@ export const applyTransforms = (source, transforms) => {
   }
   return source;
 };
+
+// export all as a frozen object
+export const transforms = freeze({
+  rejectHtmlComments: freeze(rejectHtmlComments),
+  evadeHtmlCommentTest: freeze(evadeHtmlCommentTest),
+  rejectImportExpressions: freeze(rejectImportExpressions),
+  evadeImportExpressionTest: freeze(evadeImportExpressionTest),
+  rejectSomeDirectEvalExpressions: freeze(rejectSomeDirectEvalExpressions),
+  mandatoryTransforms: freeze(mandatoryTransforms),
+  applyTransforms: freeze(applyTransforms),
+});

packages/ses/tools.js

@@ -0,0 +1,25 @@
+// Copyright (C) 2018 Agoric
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { freeze } from './src/commons.js';
+import { transforms } from './src/transforms.js';
+import { strictScopeTerminator } from './src/strict-scope-terminator.js';
+import { createSloppyGlobalsScopeTerminator } from './src/sloppy-globals-scope-terminator.js';
+
+export { transforms };
+
+export const scopeTerminators = freeze({
+  strictScopeTerminator,
+  createSloppyGlobalsScopeTerminator,
+});