[v5.4.0 prerelease] Critical Problem with VM

[pmario]

@Jermolene @saqimtiaz

In boot.js we need this test back, because it did "bite" me hard.

See: 4765b4a

/*
Determine if a value is a date
*/
$tw.utils.isDate = function(value) {
	return Object.prototype.toString.call(value) === "[object Date]";
};

[pmario]

Issue:

$tw.utils.isDate fails across module sandbox boundaries

Summary

$tw.utils.isDate uses instanceof Date which fails when a Date object is created in a different TiddlyWiki module sandbox than where the check is performed. This causes created and modified fields to be silently lost when creating tiddlers from certain contexts (e.g. CLI command modules).

Root Cause

$tw.utils.isDate at boot/boot.js:128 is defined as:

$tw.utils.isDate = (value) => value instanceof Date;

TiddlyWiki's module system ($tw.modules.execute) runs modules in a sandboxed context. Each sandbox gets its own Date constructor. When instanceof Date is used, it compares against the Date from the context where isDate was defined (boot.js), not the context where the Date object was created.

Chain of Events

1. getCreationFields() in core/modules/wiki.js:277 creates new Date() using the sandbox's Date constructor
2. new $tw.Tiddler(...) constructor at boot/boot.js:1031 calls fieldModule.parse → parseDate()
3. parseDate at boot/boot.js:372 checks $tw.utils.isDate(value) → value instanceof Date → false (cross-realm)
4. parseDate returns null → field stored as null → serialized as empty string

[Jermolene]

Thanks @pmario you’re on a roll for these subtle sandboxing bugs, much appreciated.

[saqimtiaz]

We should try to add tests for these issues so that we don't inadvertently reintroduce them in the future.

[pmario]

I think the TW CLI is "under utilised". Especially using STDIN and STDOUT, as you discussed elsewhere already. The main problem I have is: Windows and Powershell ... Where nothing is as we are used to :/

[pmario]

We should try to add tests for these issues so that we don't inadvertently reintroduce them in the future.

I think with the "Chain of Events" info it should be possible to crate a test-case.

[pmario]

@Jermolene @saqimtiaz ... IMO this needs to be a bugfix for v5.4.0 -- It's a regression that was not there in v5.3.8

[pmario]

It should be easy to revert that 3 liner and fix the regression