sscoble/pi-mono
1
0
Fork 0
mirror of https://github.com/badlogic/pi-mono.git synced 2026-11-05 23:37:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix(codemode): survive scripts that patch built-ins

Browse source 
Freeze built-ins and make built-in globals read-only before the script
runs, keeping instance overrides working via accessors. Validate all
worker payloads on the host and fail malformed ones as sandbox errors
instead of crashing the host process.

closes #10444
This commit is contained in:
Armin Ronacher 2026-10-05 17:28:46 +02:00
parent 04b97ef000
commit b223082bb2
5 changed files with 264 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

8
packages/codemode/CHANGELOG.md
View file

@ -2,6 +2,14 @@
## [Unreleased]
### Changed
- Built-ins are frozen and built-in globals are read-only before the script runs, so patches such as `Array.prototype.toJSON = ...` have no effect. Instances can still override `constructor`, `name`, `message`, `toString`, `toLocaleString`, `valueOf`, `toJSON`, and `Object.prototype` members ([#10444](https://github.com/earendil-works/pi/issues/10444))
### Fixed
- Fixed a script that patched built-ins crashing the host process and leaving `execute()` unsettled. Malformed payloads from the worker now fail the execution with a `sandbox` error ([#10444](https://github.com/earendil-works/pi/issues/10444))
## [1.0.3] - 2026-10-05
## [1.0.2] - 2026-10-04