Endowments are not on the global

Since endowments are not accessible on the global it is not possible to match some unsandboxed behavior.

browser example:

this.postMessage === postMessage
//=> true
SES.makeSESRootRealm().evaluate('this.postMessage === postMessage', { postMessage })
//=> false

nodejs example

this.process === process
//=> true
SES.makeSESRootRealm().evaluate('this.process === process', { process })
//=> false

[erights]

Yes, only a compartment’s global. The global of an SES root realm must be immutable.

[erights]

Yes. I’ve been meaning to mention that (especially as this is currently a difference with the XS/tc53 Compartment API).

background:

The endowments are per-evaluation, and emulate the so-called “global lexical scope”, which is closer than the global scope, and which does not correspond to properties on any reified object. (In our shim implementation, they are properties on an internal object, but this object is never revealed.) Outside of the realms and SES shims, AFAIK, no one has ever used the global lexical scope on purpose. It was introduced to the EcmaScript spec to account for top-level let, const, and IIRC class declarations, so that they can be shared between scripts without becoming global properties. (Personal note: IMO this entire design was probably a very bad idea, but I did not object at the time, when it would have made a difference.)

end background

It is important for us that different evaluations can share the same global while having different endowments. This makes it possible for us to emulate the CommonJS module system, where different modules at different locations in the relative module naming system can be endowed with different require functions and module objects while sharing the same global.

The workaround for now: After you make a root realm or compartment, but before you evaluate user code in that root realm or compartment, copy the desired global properties onto that global object:

Object.assign(realm.global, globalEndowments);

or

Object.defineProperties(realm.global, Object.getPropertyDescriptors(globalEndowments));

The first will only copy enumerable properties, and will invoke getters of accessor properties of the globalEndowments. The latter with copy all own properties, and will create new accessors that mimic the old accessors, by reusing the old accessor’s getter and setter functions. I would generally recommend the latter, though it should rarely make a difference.

Please let me know if this helps.