Configurable transforms

src/evaluators.js

@@ -15,7 +15,11 @@ import {
 } from './commons';
 import { getOptimizableGlobals } from './optimizer';
 import { createScopeHandler } from './scopeHandler';
-import { rejectDangerousSourcesTransform } from './sourceParser';
+import {
+  rejectImportExpressionsTransform,
+  rejectHtmlCommentsTransform,
+  rejectSomeDirectEvalExpressionsTransform
+} from './sourceParser';
 import { assert, throwTantrum } from './utilities';
 
 function buildOptimizer(constants) {
@@ -87,7 +91,20 @@ export function createSafeEvaluatorFactory(
     const localTransforms = options.transforms || [];
     const realmTransforms = transforms || [];
 
-    const mandatoryTransforms = [rejectDangerousSourcesTransform];
+    const mandatoryTransforms = [
+      { rejectImportExpressions: rejectImportExpressionsTransform },
+      { rejectHtmlComments: rejectHtmlCommentsTransform },
+      {
+        rejectSomeDirectEvalExpressions: rejectSomeDirectEvalExpressionsTransform
+      }
+    ].reduce((acc, v) => {
+      const prop = Object.keys(v)[0];
+      if (options[prop] !== false) {
+        acc.push(v[prop]);
+      }
+      return acc;
+    }, []);
+
     const allTransforms = [
       ...localTransforms,
       ...realmTransforms,

src/sourceParser.js

@@ -28,6 +28,14 @@ function rejectHtmlComments(s) {
   }
 }
 
+// Export a rewriter transform.
+export const rejectHtmlCommentsTransform = {
+  rewrite(rs) {
+    rejectHtmlComments(rs.src);
+    return rs;
+  }
+};
+
 // The proposed dynamic import expression is the only syntax currently
 // proposed, that can appear in non-module JavaScript code, that
 // enables direct access to the outside world that cannot be
@@ -62,6 +70,14 @@ function rejectImportExpressions(s) {
   }
 }
 
+// Export a rewriter transform.
+export const rejectImportExpressionsTransform = {
+  rewrite(rs) {
+    rejectImportExpressions(rs.src);
+    return rs;
+  }
+};
+
 // The shim cannot correctly emulate a direct eval as explained at
 // https://github.com/Agoric/realms-shim/issues/12
 // Without rejecting apparent direct eval syntax, we would
@@ -91,6 +107,14 @@ function rejectSomeDirectEvalExpressions(s) {
   }
 }
 
+// Export a rewriter transform.
+export const rejectSomeDirectEvalExpressionsTransform = {
+  rewrite(rs) {
+    rejectSomeDirectEvalExpressions(rs.src);
+    return rs;
+  }
+};
+
 export function rejectDangerousSources(s) {
   rejectHtmlComments(s);
   rejectImportExpressions(s);