From e53927d940f2ab48929a6edd9c56e01102480366 Mon Sep 17 00:00:00 2001 From: tannevaled Date: Sat, 26 Sep 2026 18:32:01 +0200 Subject: [PATCH] esbuildsandbox, the leak the engine found MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three modules, two in the table. The missing one is the security fix: bundling a page's own script graph through esbuild looks sandboxed because every import in your tests goes through your plugin, and a glob dynamic import does not — the bundler walks ResolveDir on the real filesystem, following symlinks, with the plugin API never seeing it. A module that exists because somebody hit that is the one worth finding before hitting it, and it was on no page. Co-Authored-By: Claude Opus 5 --- profile/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/profile/README.md b/profile/README.md index 07f1b58..a597250 100644 --- a/profile/README.md +++ b/profile/README.md @@ -42,6 +42,7 @@ and [benchmark](https://github.com/go-webengine/engine/blob/main/bench/REPORT.md | Module | Kind | What it is | API | |---|---|---|:--:| | [`engine`](https://github.com/go-webengine/engine) | lib + cli | Fetch → DOM → CSS cascade → JavaScript → full box-model layout → paint text/gradients/images/SVG to `image.RGBA` / PNG. Pure Go, CGO=0. Ships a `render` CLI. | [ref](https://pkg.go.dev/github.com/go-webengine/engine) | +| [`esbuildsandbox`](https://github.com/go-webengine/esbuildsandbox) | lib | A safe `ResolveDir` for esbuild's `pkg/api`. The bundler expands a **glob dynamic import** — `` import(`./${lang}/index.js`) `` — by walking `ResolveDir` on the **real filesystem** through its internal resolver, bypassing every `OnResolve`/`OnLoad` plugin. Whatever that directory is (`"/"` is a common default) is what gets walked, following symlinks. | [ref](https://pkg.go.dev/github.com/go-webengine/esbuildsandbox) | | [`browserproxy`](https://github.com/go-webengine/browserproxy) | cli | Remote-browser WebSocket service: renders server-side with the engine, streams frames + a click hit-map to a thin client, forwards clicks/scrolls/keys. SSRF-guarded. | [ref](https://pkg.go.dev/github.com/go-webengine/browserproxy) | > This list reflects the repos that actually exist in the org.