fix: avoid cross-realm objects

webpack · Nov 22, 2022 · 18c59c6 · 18c59c6
1 parent 8241da7
commit 18c59c6
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 15 deletions.
diff --git a/lib/dependencies/CommonJsImportsParserPlugin.js b/lib/dependencies/CommonJsImportsParserPlugin.js
@@ -236,8 +236,7 @@ class CommonJsImportsParserPlugin {
 					parser.parseCommentOptions(expr.range);
 
 				if (commentErrors) {
-					for (const e of commentErrors) {
-						const { comment } = e;
+					for (const { cause: e, comment } of commentErrors) {
 						parser.state.module.addWarning(
 							new CommentCompilationWarning(
 								`Compilation error while processing magic comment(-s): /*${comment.value}*/: ${e.message}`,

diff --git a/lib/dependencies/ImportParserPlugin.js b/lib/dependencies/ImportParserPlugin.js
@@ -55,8 +55,7 @@ class ImportParserPlugin {
 				parser.parseCommentOptions(expr.range);
 
 			if (commentErrors) {
-				for (const e of commentErrors) {
-					const { comment } = e;
+				for (const { cause: e, comment } of commentErrors) {
 					parser.state.module.addWarning(
 						new CommentCompilationWarning(
 							`Compilation error while processing magic comment(-s): /*${comment.value}*/: ${e.message}`,
@@ -137,7 +136,7 @@ class ImportParserPlugin {
 				if (importOptions.webpackInclude !== undefined) {
 					if (
 						!importOptions.webpackInclude ||
-						importOptions.webpackInclude.constructor.name !== "RegExp"
+						!(importOptions.webpackInclude instanceof RegExp)
 					) {
 						parser.state.module.addWarning(
 							new UnsupportedFeatureWarning(
@@ -146,13 +145,13 @@ class ImportParserPlugin {
 							)
 						);
 					} else {
-						include = new RegExp(importOptions.webpackInclude);
+						include = importOptions.webpackInclude;
 					}
 				}
 				if (importOptions.webpackExclude !== undefined) {
 					if (
 						!importOptions.webpackExclude ||
-						importOptions.webpackExclude.constructor.name !== "RegExp"
+						!(importOptions.webpackExclude instanceof RegExp)
 					) {
 						parser.state.module.addWarning(
 							new UnsupportedFeatureWarning(
@@ -161,7 +160,7 @@ class ImportParserPlugin {
 							)
 						);
 					} else {
-						exclude = new RegExp(importOptions.webpackExclude);
+						exclude = importOptions.webpackExclude;
 					}
 				}
 				if (importOptions.webpackExports !== undefined) {

diff --git a/lib/dependencies/WorkerPlugin.js b/lib/dependencies/WorkerPlugin.js
@@ -203,8 +203,7 @@ class WorkerPlugin {
 							parser.parseCommentOptions(expr.range);
 
 						if (commentErrors) {
-							for (const e of commentErrors) {
-								const { comment } = e;
+							for (const { cause: e, comment } of commentErrors) {
 								parser.state.module.addWarning(
 									new CommentCompilationWarning(
 										`Compilation error while processing magic comment(-s): /*${comment.value}*/: ${e.message}`,
@@ -246,7 +245,9 @@ class WorkerPlugin {
 								} else {
 									Object.assign(
 										entryOptions,
-										importOptions.webpackEntryOptions
+										JSON.parse(
+											JSON.stringify(importOptions.webpackEntryOptions)
+										)
 									);
 								}
 							}

diff --git a/lib/javascript/JavascriptParser.js b/lib/javascript/JavascriptParser.js
@@ -3641,11 +3641,18 @@ class JavascriptParser extends Parser {
 			if (value && webpackCommentRegExp.test(value)) {
 				// try compile only if webpack options comment is present
 				try {
-					const val = vm.runInNewContext(`(function(){return {${value}};})()`);
-					Object.assign(options, val);
+					let val = vm.runInNewContext(`(function(){return {${value}};})()`);
+					const key = Object.getOwnPropertyNames(val)[0];
+					if (!key) continue;
+					val = val[key];
+
+					if (typeof val === "object" && val !== null) {
+						if (val.constructor.name === "RegExp") val = new RegExp(val);
+						else val = JSON.parse(JSON.stringify(val));
+					}
+					options[key] = val;
 				} catch (e) {
-					e.comment = comment;
-					errors.push(e);
+					errors.push({ comment, cause: e });
 				}
 			}
 		}