[acl][commonjs] ACL for function calls to CommonJS module is treated as module.prototype.constructor

[t2ym]

[acl][commonjs] ACL for function calls to CommonJS module is treated as module.prototype.constructor

Root Cause

• Function calls to X() in const X = require("commonjs-module") with module.exports = function X() {} are treated as those to commonjs-module.prototype.constructor in ACL
• Modules are not globals and thus not treated as properties of the global object

Reproducible Code

• Bundled with webpack or browserify

const add = require('commonjs-module');
add(1,2);

// commonjs-module.js
module.exports = function add(a, b) { return a + b; }

Workaround

• Use acl["/node_modules/commonjs-module/index.js"][S_PROTOTYPE]["$constructor$"] : ACL instead

Possible Fix

• Research in progress in sync with ES modules support

Ad-hoc Fix (Not Verified Well)

• Apply acl["/node_modules/module-name/index.js"]

diff --git a/demo/hook-callback.js b/demo/hook-callback.js
index 06aef2a3..dd284bf2 100644
--- a/demo/hook-callback.js
+++ b/demo/hook-callback.js
@@ -6341,8 +6341,14 @@ else {
         }
       }
       else {
-        let name = _globalMethods.get(f);
-        if (name) {
+        let name;
+        if ((name = _globalObjects.get(f))) {
+          if (!applyAcl(name, true, false, S_UNSPECIFIED, 'x', context, normalizedThisArg, _args, arguments)) {
+            result = [ name, true, false, S_UNSPECIFIED, 'x', context, normalizedThisArg, _args, arguments ];
+            throw new Error('Permission Denied: Cannot access ' + SetMap.getStringValues(name));
+          }
+        }
+        else if ((name = _globalMethods.get(f))) {
           // call of a native method
           let forName;
           let forProp;
@@ -7767,8 +7773,14 @@ else {
         }
       }
       else {
-        let name = _globalMethods.get(f);
-        if (name) {
+        let name;
+        if ((name = _globalObjects.get(f))) {
+          if (!applyAcl(name, true, false, S_UNSPECIFIED, 'x', context, normalizedThisArg, _args, arguments)) {
+            result = [ name, true, false, S_UNSPECIFIED, 'x', context, normalizedThisArg, _args, arguments ];
+            throw new Error('Permission Denied: Cannot access ' + SetMap.getStringValues(name));
+          }
+        }
+        else if ((name = _globalMethods.get(f))) {
           // call of a native method
           let rawProp = name[name.length - 1];
           let prop = _escapePlatformProperties.get(rawProp) || rawProp;

Note

• I do not prefer _globalMethods and I am investigating whether it is possible to integrate _globalMethods map with _globalObjects map