Module loader ignores import attributes: JSON modules fail, and `with { type: "json" }` executes a JavaScript file

Abierto
  • ¿Algo no está bien?
#356 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
55/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
c
Área
backend

Línea de trabajo

Start in runtime/script_loader.cpp at module_load_hook, then read how get_module compiles modules and how moduleRegistry keys them. Compare that flow with SpiderMonkey's GetModuleRequestType and CompileJsonModule APIs cited in the issue. Run the listed JSON import reproductions and test262 json-* tests; done means JSON imports export parsed values, invalid JSON and unknown types error, and imports with different attributes remain distinct.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

module_load_hook never looks at the import attributes of a request, so every module is compiled as JavaScript:

  • import data from "./data.json" with { type: "json" } fails (an object is parsed as a JS block; an array has no
    default export).
  • A file imported with type: "json" that actually contains JavaScript is executed.
  • Unknown type values are accepted silently.

Environment

  • StarlingMonkey v0.4.0 release starling.wasm, wasmtime 50.0.1, module mode (wasmtime run -S http --dir . starling.wasm main.js).
  • runtime/script_loader.cpp is unchanged on main (54b3329b).
  • Checked on 2026-11-03. Reference: SpiderMonkey jsshell 147.0.4 (the SpiderMonkey version StarlingMonkey v0.4.0 embeds), js -m.

Reproduction

data.json: {"a": 1, "n": -1.5e-3} · arr.json: [1,2] · evil.json: console.log("JS CODE EXECUTED"); export default 42;

// main.js
import obj from "./data.json" with { type: "json" };
console.log(JSON.stringify(obj));
import StarlingMonkey jsshell 147.0.4
./data.json with type: "json" data.json:1:5 SyntaxError: unexpected token: ':' {"a":1,"n":-0.0015}
./arr.json with type: "json" SyntaxError: The requested module 'arr.json' doesn't provide an export named: 'default' [1,2]
./evil.json with type: "json" prints JS CODE EXECUTED, then imported 42 SyntaxError: JSON.parse: unexpected character at line 1 column 1
./b.js with type: "bogus" attribute ignored TypeError: invalid module type

test262: language/import/import-attributes/json-value-object.js, json-idempotency.js and the other json-* tests in
that directory fail.

Expected

ECMA-262 HostLoadImportedModule: "If moduleRequest.[[Attributes]]
has an entry entry such that entry.[[Key]] is "type" and entry.[[Value]] is "json", … result must either be the
Completion Record returned by an invocation of ParseJSONModule or a
throw completion." So a JSON import yields a module whose default export is the parsed value, and non-JSON content
is an error, never executed. ModuleRequestsEqual also compares
attributes, so ./x with and without type: "json" are different requests.

The point of type: "json" is that importing data cannot run code; currently that guarantee does not hold.

Cause

module_load_hook in runtime/script_loader.cpp resolves the specifier and always calls get_module(...), which
compiles the source as a JavaScript module. It never reads the request's module type, and moduleRegistry is keyed by
resolved path only.

Suggested fix (sketch)

In module_load_hook, read the module type from the request (JS::GetModuleRequestType(cx, moduleRequest) returns
JS::ModuleType::JSON for type: "json"). For JSON, compile with JS::CompileJsonModule(cx, opts, source), as
jsshell's ModuleLoader::loadAndParse does. Key the registry by (resolved path, module type), and reject unknown
types with a TypeError.

Lenguaje dominante
C
Estrellas
297
Forks
64
Merge medio
2 d 2 h
PR fusionados (30 d)
19

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de bytecodealliance/StarlingMonkey

Todos los issues de bytecodealliance/StarlingMonkey

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.