Mastodon Feed: Post

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

The main unprivileged body of a Space is not supposed to access the filesystem. This is enforced by.... regex

[Typescript code, a series of regex tests for accessing process, Bun, imports, spawning processes or opening files, or calling eval] export function checkServerActionSource(content: string): string | null { const stripped = stripCommentsAndStrings(content); if (/\bprocess\b/.test(stripped)) { return REASON_PROCESS_GLOBAL; } if (/\bBun\b/.test(stripped)) { return REASON_BUN_GLOBAL; } if (/\brequire\s*(/.test(stripped)) { return REASON_REQUIRE_CALL; } if (/\bimport\s*(/.test(stripped)) { return REASON_DYNAMIC_IMPORT; } if ( /\b(spawn|spawnSync|exec|execFile|execFileSync|execSync)\s*(/.test( stripped, ) ) { return REASON_SUBPROCESS_API; } if (/\b(eval|Function)\s*(/.test(stripped)) { return REASON_EVAL_API; } return null; }