mirror of
https://gitcode.com/GitHub_Trending/ji/jitsi-meet.git
synced 2025-12-30 11:22:31 +00:00
4a8f787519
We are downloading code off the Internet and executing it on the user's device, so run it sandboxed to avoid potential bad actors. Since it's impossible to eval() safely in JS and React Native doesn't offer something akin to Node's vm module, here we are rolling our own. On Android it uses the Duktape JavaScript engine and on iOS the builtin JavaScriptCore engine. The extra JS engine is *only* used for evaluating the downloaded code and returning a JSON string which is then passed back to RN.
37 lines
962 B
JavaScript
37 lines
962 B
JavaScript
// @flow
|
|
|
|
import { NativeModules } from 'react-native';
|
|
|
|
import { loadScript } from '../util';
|
|
import logger from './logger';
|
|
|
|
export * from './functions.any';
|
|
|
|
const { JavaScriptSandbox } = NativeModules;
|
|
|
|
/**
|
|
* Loads config.js from a specific remote server.
|
|
*
|
|
* @param {string} url - The URL to load.
|
|
* @returns {Promise<Object>}
|
|
*/
|
|
export async function loadConfig(url: string): Promise<Object> {
|
|
try {
|
|
const configTxt = await loadScript(url, 2.5 * 1000 /* Timeout in ms */, true /* skipeval */);
|
|
const configJson = await JavaScriptSandbox.evaluate(`${configTxt}\nJSON.stringify(config);`);
|
|
const config = JSON.parse(configJson);
|
|
|
|
if (typeof config !== 'object') {
|
|
throw new Error('config is not an object');
|
|
}
|
|
|
|
logger.info(`Config loaded from ${url}`);
|
|
|
|
return config;
|
|
} catch (err) {
|
|
logger.error(`Failed to load config from ${url}`, err);
|
|
|
|
throw err;
|
|
}
|
|
}
|