question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

"ses-lite" missing permit for %InertStaticModuleRecord%

See original GitHub issue

Using ses@0.10.3, I call require('ses/dist/lockdown.cjs') and then lockdown(). The following error is thrown:

Uncaught Error: Expected permit object at whitelist.%InertStaticModuleRecord%
  at Object.completePrototypes (...)
  at repairIntrinsics (...)
  at assign.lockdown (...)

If I remove the line '%InertStaticModuleRecord%': InertStaticModuleRecord, from the intrinsics object inside ses/dist/lockdown.cjs, the error no longer occurs and everything appears to work, although the following messages appear in the console:

Toggle console message visibility
Removing intrinsics.Promise.any
Removing intrinsics.%InertFunction%.arguments
Removing intrinsics.%InertFunction%.caller
Removing intrinsics.%InertGeneratorFunction%.arguments
Removing intrinsics.%InertGeneratorFunction%.caller
Removing intrinsics.%InertAsyncFunction%.arguments
Removing intrinsics.%InertAsyncFunction%.caller
Removing intrinsics.%InertAsyncGeneratorFunction%.arguments
Removing intrinsics.%InertAsyncGeneratorFunction%.caller
Removing intrinsics.%InitialDate%.arguments
Removing intrinsics.%InitialDate%.caller
Removing intrinsics.%SharedDate%.arguments
Removing intrinsics.%SharedDate%.caller
Removing intrinsics.%InitialError%.arguments
Removing intrinsics.%InitialError%.caller
Removing intrinsics.%SharedError%.arguments
Removing intrinsics.%SharedError%.caller
Removing intrinsics.%InitialRegExp%.arguments
Removing intrinsics.%InitialRegExp%.caller
Removing intrinsics.%SharedRegExp%.arguments
Removing intrinsics.%SharedRegExp%.caller
Removing intrinsics.%InertCompartment%.arguments
Removing intrinsics.%InertCompartment%.caller
Removing intrinsics.%StringPrototype%.replaceAll

My execution environment is a Web Worker using the latest version of Google Chrome. The error is not thrown if I require('ses') using ses@0.10.3 or ses@0.9.1.

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Comments:5 (5 by maintainers)

github_iconTop GitHub Comments

1reaction
erightscommented, Sep 23, 2020

Core problem diagnosed, but with some remaining mysteries.

We recently divided the whitelist into whitelist which applies to ses-without modules, and moduleWhitelist with the additional elements to be added to whitelist when doing ses-with-modules. Loading just lockdown runs ses-without-modules. The non-module whitelist doesn’t have %InertStaticModuleRecord%. But the intrinsics do. completePrototypes goes through the intrinsics, looking up their entry in the whitelist, to figure out how to do its thing (add in the appropriate prototype objects). %InertStaticModuleRecord% is in the intrinsics it starts with.

No idea yet why this fails on the web but works on Node. So far, the bug seems like it should be host-independent.

1reaction
kriskowalcommented, Sep 23, 2020

I’ve been able to reproduce this error with this script in Chrome 85.

<!doctype html>
<script src="dist/lockdown.umd.js"></script>
<script>
  lockdown({
    errorTaming: "unsafe"
  });
</script>

I’ve also reproduced it separately in a web worker, but that appears to not be germane.

Read more comments on GitHub >

github_iconTop Results From Across the Web

No results found

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found