Evasive transform for apparent HTML comments in quoted strings

bundleSource contains “evasive transforms”, that is, it transforms JavaScript modules into JavaScript modules that can get past the SES censorship regular expressions. The soundness of this design is that the SES shim runtime can’t afford to carry a full JavaScript parser, and assumes significantly less risk by not including a JS parser in its trusted compute base (TCB). However, the build step for an archive or bundle can afford to perform transformations that allow code to evade the censor with full awareness of the syntax tree.

One additional transform we could include would allow HTML comments to appear inside JavaScript strings, as described by @naugtur in https://github.com/endojs/endo/issues/1207.

"<!--" is safe, but censored.

"<!" + "--" is equivalent, safe, and not censored.

The same can be achieved in template literals, as in:

const before = `<!--`;
const after = `${'<'}!--`;

[gibson042]

I don’t think so, because escape sequences are observable by the function being called:

(strings => {
  const [raw] = strings.raw, [cooked] = strings;
  console.log(JSON.stringify({raw, cooked}));
  return cooked === raw;
})`<!-- \x3C!--`;
// returns: false
// logs: {"raw":"<!-- \\x3C!--","cooked":"<!-- <!--"}

[naugtur]

As for the evasive transform’s code itself, it’d be nice to get them out of bundleSource where it’s coupled with the surrounding code and offer a bunch of string to string and/or Babel AST evasive transforms to mix and match.

Having trouble reaching those and selecting only the ones I want to use I ended up writing a separate transform here packages/experiment-run-cli/src/sesEvasionTransform.js