Merge pull request #275 from XmiliaH/fix-260

Require helpers statically in main.

lib/helpers.js

@@ -0,0 +1,12 @@
+// source: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
+function escapeRegExp(string) {
+	return string.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
+}
+
+function match(wildcard, s) {
+	const regexString = escapeRegExp(wildcard).replace(/\\\*/g, '\\S*').replace(/\\\?/g, '.');
+	const regex = new RegExp(regexString);
+	return regex.test(s);
+}
+
+module.exports = {match};

lib/main.js

@@ -25,6 +25,7 @@ const vm = require('vm');
 const pa = require('path');
 const {EventEmitter} = require('events');
 const {INSPECT_MAX_BYTES} = require('buffer');
+const helpers = require('./helpers.js');
 
 /**
  * Load a script from a file and compile it.
@@ -1181,7 +1182,8 @@ const HOST = {
 	Symbol,
 	INSPECT_MAX_BYTES,
 	VM,
-	NodeVM
+	NodeVM,
+	helpers
 };
 
 exports.VMError = VMError;

lib/sandbox.js

@@ -6,7 +6,6 @@
 const {Script} = host.require('vm');
 const fs = host.require('fs');
 const pa = host.require('path');
-const {match} = host.require('../lib/wildcard');
 
 const BUILTIN_MODULES = host.process.binding('natives');
 const parseJSON = JSON.parse;
@@ -265,7 +264,7 @@ return ((vm, host) => {
 				if (typeof vm.options.require.external === 'object') {
 					const { external, transitive } = _parseExternalOptions(vm.options.require.external);
 
-					const isWhitelisted = external.some(ext => match(ext, moduleName)) || (transitive && parentAllowsTransitive);
+					const isWhitelisted = external.some(ext => host.helpers.match(ext, moduleName)) || (transitive && parentAllowsTransitive);
 					if (!isWhitelisted) {
 						throw new VMError(`The module '${moduleName}' is not whitelisted in VM.`, 'EDENIED');
 					}

test/wildcard.js → test/helpers.js

@@ -1,6 +1,6 @@
 /* eslint-env mocha */
 
-const {match} = require('../lib/wildcard');
+const {match} = require('../lib/helpers');
 const assert = require('assert');
 
 describe('wildcard matching', () => {