Patch lodash template

src/setup_node_env/harden.js

@@ -22,3 +22,7 @@ var hook = require('require-in-the-middle');
 hook(['child_process'], function(exports, name) {
   return require(`./patches/${name}`)(exports); // eslint-disable-line import/no-dynamic-require
 });
+
+hook(['lodash'], function(exports, name) {
+  return require(`./patches/${name}`)(exports); // eslint-disable-line import/no-dynamic-require
+});

src/setup_node_env/patches/lodash.js

@@ -0,0 +1,39 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+module.exports = function(lodash) {
+  lodash.template = new Proxy(lodash.template, {
+    apply: function(target, thisArg, args) {
+      var options;
+      if (args.length === 1) {
+        options = {
+          sourceURL: '',
+        };
+      } else {
+        options = { ...args[1] };
+        options.sourceURL = (options.sourceURL + '').replace(/\s/g, ' ');
+      }
+
+      args[1] = options;
+      return target.apply(thisArg, args);
+    },
+  });
+
+  return lodash;
+};

test/harden/lodash.js

@@ -0,0 +1,93 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+require('../../src/setup_node_env');
+const _ = require('elasticsearch/node_modules/lodash'); // our fork has been patched already, using a non-patched version
+const test = require('tape');
+
+Object.prototype.sourceURL = '\u2028\u2029\n;global.whoops=true'; // eslint-disable-line no-extend-native
+
+test.onFinish(() => {
+  delete Object.prototype.sourceURL;
+});
+
+test('test setup ok', t => {
+  t.equal({}.sourceURL, '\u2028\u2029\n;global.whoops=true');
+  t.end();
+});
+
+test(`_.template('<%= foo %>')`, t => {
+  const output = _.template('<%= foo %>')({ foo: 'bar' });
+  t.equal(output, 'bar');
+  t.equal(global.whoops, undefined);
+  t.end();
+});
+
+test(`_.template('<%= foo %>', {})`, t => {
+  const output = _.template('<%= foo %>', Object.freeze({}))({ foo: 'bar' });
+  t.equal(output, 'bar');
+  t.equal(global.whoops, undefined);
+  t.end();
+});
+
+test(`_.template('<%= data.foo %>', { variable: 'data' })`, t => {
+  const output = _.template('<%= data.foo %>', Object.freeze({ variable: 'data' }))({ foo: 'bar' });
+  t.equal(output, 'bar');
+  t.equal(global.whoops, undefined);
+  t.end();
+});
+
+test(`_.template('<%= foo %>', { sourceURL: '/foo/bar' })`, t => {
+  // throwing errors in the template and parsing the stack, which is a string, is super ugly, but all I know to do
+  const template = _.template('<% throw new Error() %>', Object.freeze({ sourceURL: '/foo/bar' }));
+  t.plan(2);
+  try {
+    template();
+  } catch (err) {
+    const path = parsePathFromStack(err.stack);
+    t.equal(path, '/foo/bar');
+    t.equal(global.whoops, undefined);
+  }
+});
+
+test(`_.template('<%= foo %>', { sourceURL: '\\u2028\\u2029\\nglobal.whoops=true' })`, t => {
+  // throwing errors in the template and parsing the stack, which is a string, is super ugly, but all I know to do
+  const template = _.template(
+    '<% throw new Error() %>',
+    Object.freeze({ sourceURL: '\u2028\u2029\nglobal.whoops=true' })
+  );
+  t.plan(2);
+  try {
+    template();
+  } catch (err) {
+    const path = parsePathFromStack(err.stack);
+    t.equal(path, 'global.whoops=true');
+    t.equal(global.whoops, undefined);
+  }
+});
+
+function parsePathFromStack(stack) {
+  const lines = stack.split('\n');
+  // the frame starts at the second line
+  const frame = lines[1];
+
+  // the path is in parathensis, and ends with a colon before the line/column numbers
+  const [, path] = /\(([^:]+)/.exec(frame);
+  return path;
+}