facebook / facebook/hermes

Feature Request: local `eval` for SES (Secure EcmaScript) support

Open
#957 8 comments 6 reactions 0 assignees View on GitHub
enhancement
Dominant language
JavaScript
Stars
11.3k
Forks
859
Avg merge
1h 30m
Merged PRs (30d)
3

Description

## Problem

Hey there, Leo here from team [LavaMoat](https://github.com/LavaMoat) and [MetaMask](https://github.com/MetaMask) 👋

i'm working with the folks at [EndoJS](https://github.com/endojs) bringing [SES](https://github.com/endojs/endo/tree/master/packages/ses) (formerly [Agoric/SES](https://github.com/Agoric/SES)) support to RN and [metamask-mobile](https://github.com/MetaMask/metamask-mobile)

which runs on JSC and V8, but not Hermes as we [know](https://github.com/facebook/hermes/blob/main/doc/Features.md#excluded-from-support)
> Excluded From Support
> - Local mode `eval()` (use and introduce local variables)
> - `with` statements

```console
# RN: Android/iOS (Hermes) with SES
ERROR TypeError: SES cannot initialize unless 'eval' is the original intrinsic 'eval',
suitable for direct-eval (dynamically scoped eval) (SES_DIRECT_EVAL), js engine: hermes
# https://user-images.githubusercontent.com/1881059/232474795-666c83e9-53aa-4df0-a8cd-a5e45277392d.png
# https://user-images.githubusercontent.com/1881059/232477719-56c92715-b72d-4c5d-9756-a972cd88c6b1.png
```

stacktraces ^ from the SES lockdown shim (e.g. `curl -O https://npmfs.com/download/ses/0.18.4/dist/lockdown.umd.js`)
_also importable via `yarn add ses`, but needing [additional](https://github.com/LavaMoat/docs/issues/10) Metro and Babel config for `.cjs`_

i note potentially supporting this feature's been discussed in the past (cc @kumavis) and past convo's
- https://github.com/facebook/hermes/issues/102
- https://github.com/facebook/hermes/issues/785
- https://github.com/facebook/hermes/issues/674

is this a feature you guys looking to make happen anytime soon?
or still only accepting community contributions

## Solution

Describe the solution you'd like to happen: _local eval()_ support 🙏
Or `with` statements support (can be split into separate ft req)

Alternatives considered
- init SES without our original intrinsic `eval`
- then we'd run into unsupported `with` statements
- _facebook/hermes_ community contribution: local `eval()`
- _facebook/hermes_ community contribution: `with` statements
- couple further options we're exploring

## Additional Context

SES

https://github.com/endojs/endo/blob/master/packages/ses/error-codes/SES_DIRECT_EVAL.md

> The SES Hardened JavaScript shim captures the `eval` function when it is initialized. The `eval` function it finds must be the original `eval` because SES uses its dynamic scope to implement its isolated `eval`.

> If you see this error, something running before `ses` initialized, most likely another instance of `ses`, has replaced `eval` with something else.

+ https://github.com/endojs/endo/blob/master/packages/ses/src/commons.js#L277-L293
- https://github.com/endojs/endo/blob/master/packages/ses/src/lockdown-shim.js#L94-L124
- https://github.com/endojs/endo/blob/master/packages/ses/src/lockdown-shim.js#L195-L198
- https://github.com/endojs/endo/blob/master/packages/ses/src/lockdown-shim.js#L345-L362
+ https://github.com/endojs/endo/blob/master/packages/ses/src/make-evaluate.js#L92-L107
- https://github.com/endojs/endo/blob/master/packages/ses/error-codes/SES_NO_EVAL.md
- https://github.com/endojs/endo/blob/master/packages/ses/error-codes/SES_EVAL_REJECTED.md

React Native LavaMoat tracker
- https://github.com/LavaMoat/docs/issues/12

Hermes docs
- https://hermesengine.dev/docs/language-features
- https://hermesengine.dev/docs/ir/#directevalinst
- _https://hermesengine.dev/docs/vm/#repl_

hermesengine.dev/playground

```console
# eval(1)

/tmp/hermes-input.js:1:1: warning: Direct call to eval(), but lexical scope is not supported.

Function(1 params, 1 registers, 0 symbols):
Offset in debug table: source 0x0000, lexical 0x0000
LoadConstUInt8 r0, 1
DirectEval r0, r0
Ret r0
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.