Skip to content

feat(evasive-transform)!: allow returns outside functions in CommonJS sources #2763

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 9, 2025

Conversation

boneskull
Copy link
Member

@boneskull boneskull commented Apr 9, 2025

Description

return statements outside of functions are valid in CommonJS (sloppy-mode only? not sure), but Babel doesn't allow this by default. Unfortunately, people do this and We need to support it.

This behavior is enabled by passing a flag into Babel when parsing. This flag is only enabled when the sourceType option (for evadeCensor and evadeCensorSycn) is set to script.

To discourage use of non-portable syntax, we now restrict the possible values of sourceType to script and module only (which is the BREAKING CHANGE).

The types were changed to reflect this. While updating the types, I noted that they were wrong, so I fixed them using overloads. Note that @endo/evasive-transform does not ship declarations (yet).

Security Considerations

No

Scaling Considerations

No

Documentation Considerations

I have updated README.md with a little bit of information, but there are no such comprehensive API docs for this package.

Testing Considerations

I've added tests to cover the new behavior.

Compatibility Considerations

If someone is using this package and supplying a sourceType option of unambiguous (which I believe is Babel's default behavior), they will get a TypeScript error. We will not throw an exception, since this is a valid option for Babel, after all—but we do not claim to support it. This will not affect any existing consumers using sourceType of script, because if they were parsing sources that had bare return statements, it would have broken already.

The new (correct) return types of the public APIs may cause TypeScript type errors if they were manually fixing the types themselves.

Upgrade Considerations

If using an explicit sourceType of unambiguous, omit it. It is encouraged to use module or script if possible.

@boneskull boneskull self-assigned this Apr 9, 2025
@boneskull
Copy link
Member Author

I'm calling it breaking (and I've covered my bases) but others may disagree.

@@ -38,6 +36,7 @@ export function parseAst(source, opts = {}) {
return parseBabel(source, {
tokens: true,
createParenthesizedExpressions: true,
allowReturnOutsideFunction: opts.sourceType === 'script',
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
allowReturnOutsideFunction: opts.sourceType === 'script',
allowReturnOutsideFunction: opts.sourceType !== 'module',

^ this would cover cases of sourceType not being set/known

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

paraphrasing @kriskowal, it is only for script because we do not want to be toxic enablers of non-portable syntax

… sources

BREAKING CHANGE: This restricts the possible values of the `sourceType` option to `script` and `module` only. Types have been changed to reflect this.

*BREAKING*: Do not provide a `sourceType` of `unambiguous`; use `module`, `script`, or omit.
@boneskull boneskull force-pushed the boneskull/transform-top-lvl-return branch from f6712c1 to df96b6c Compare April 9, 2025 23:23
@boneskull boneskull merged commit 1d47e08 into master Apr 9, 2025
16 checks passed
@boneskull boneskull deleted the boneskull/transform-top-lvl-return branch April 9, 2025 23:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants