Skip to content

Commit e6d7638

Browse files
committed
Limit global resolution to globalThis
Historically we've supported old platforms with a variety of fallback options for determining a global object. However, our use of Function('return this') is essentially an eval, which causes issues for strict CSP. On consulation with other teams, we think we can just rely on globalThis at this point in time.
1 parent 3050f03 commit e6d7638

File tree

2 files changed

+2
-22
lines changed

2 files changed

+2
-22
lines changed

generator/js_generator.cc

Lines changed: 1 addition & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -3641,26 +3641,7 @@ void Generator::GenerateFile(const GeneratorOptions& options,
36413641
if (options.import_style == GeneratorOptions::kImportCommonJsStrict) {
36423642
printer->Print("var proto = {};\n\n");
36433643
} else {
3644-
// To get the global object we call a function with .call(null), this will
3645-
// set "this" inside the function to the global object. This does not work
3646-
// if we are running in strict mode ("use strict"), so we fallback to the
3647-
// following things (in order from first to last):
3648-
// - globalThis: cross-platform standard, might not be defined in older
3649-
// versions of browsers
3650-
// - window: defined in browsers
3651-
// - global: defined in most server side environments like NodeJS
3652-
// - self: defined inside Web Workers (WorkerGlobalScope)
3653-
// - Function('return this')(): this will work on most platforms, but it
3654-
// may be blocked by things like CSP.
3655-
// Function('') is almost the same as eval('')
3656-
printer->Print(
3657-
"var global =\n"
3658-
" (typeof globalThis !== 'undefined' && globalThis) ||\n"
3659-
" (typeof window !== 'undefined' && window) ||\n"
3660-
" (typeof global !== 'undefined' && global) ||\n"
3661-
" (typeof self !== 'undefined' && self) ||\n"
3662-
" (function () { return this; }).call(null) ||\n"
3663-
" Function('return this')();\n\n");
3644+
printer->Print("var global = globalThis;\n\n");
36643645
}
36653646

36663647
for (int i = 0; i < file->dependency_count(); i++) {

internal_options.js

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,13 @@
2828
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
2929
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
3030
/**
31-
* @fileoverview Internal options for.
31+
* @fileoverview Internal options.
3232
*/
3333
goog.module('jspb.internal_options');
3434

3535
/**
3636
* @return {boolean} True if BigInt is permitted for use and supported by the
3737
* platform.
38-
* @nosideeffects
3938
*/
4039
function isBigIntAvailable() {
4140
return goog.FEATURESET_YEAR >= 2021 || (typeof BigInt === 'function');

0 commit comments

Comments
 (0)