Allow globals to be injected into the runtime

packages/runtime/src/execute/context.ts

@@ -15,11 +15,14 @@ const freezeAll = (
 
 // Build a safe and helpful execution context
 // This will be shared by all jobs
-export default (state: State, options: Pick<Options, 'jobLogger'>) => {
+export default (state: State, options: Pick<Options, 'jobLogger' | 'globals'>) => {
   const logger = options.jobLogger ?? console;
+  const globals = options.globals || {};
   const context = vm.createContext(
     freezeAll(
       {
+        ...globals,
+        // Note that these globals will be overridden
         console: logger,
         clearInterval,
         clearTimeout,

packages/runtime/src/execute/expression.ts

@@ -23,7 +23,7 @@ export default (
 
     const { operations, execute } = await prepareJob(expression, context, opts);
     // Create the main reducer function
-    const reducer = (execute || defaultExecute)(
+    const reducer = (execute || opts.globals?.execute || defaultExecute)(
       ...operations.map((op, idx) =>
         wrapOperation(op, logger, `${idx + 1}`, opts.immutableState)
       )

packages/runtime/src/runtime.ts

@@ -27,6 +27,11 @@ export type Options = {
   forceSandbox?: boolean;
 
   linker?: LinkerOptions;
+
+  // inject stuff into the environment
+  // aka globals
+  // Used by unit tests. any security concerns?
+  globals?: any;
 };
 
 const defaultState = { data: {}, configuration: {} };

packages/runtime/test/runtime.test.ts

@@ -269,3 +269,40 @@ test('stuff written to state before an error is preserved', async (t) => {
 
   t.is(result.x, 1);
 });
+
+test('inject globals', async (t) => {
+  const expression = 'export default [(s) => Object.assign(s, { data: { x } })]';
+
+  const result: any = await run(expression, {}, {
+    globals: {
+      x: 90210
+    }
+  });
+  t.is(result.data.x, 90210);
+});
+
+test('injected globals can\'t override special functions', async (t) => {
+  const panic = () => { throw new Error('illegal override') }
+
+  const globals = {
+    console: panic,
+    clearInterval: panic,
+    clearTimeout: panic,
+    parseFloat: panic,
+    parseInt: panic,
+    setInterval: panic,
+    setTimeout: panic,
+  }
+  const expression = `export default [(s) => {
+    parseFloat();
+    parseInt();
+    const i = setInterval(() => {}, 1000);
+    clearInterval(i);
+    const t = setTimeout(() => {}, 1000);
+    clearTimeout(t);
+    return s;
+  }]`;
+
+  const result: any = await run(expression, {}, { globals });
+  t.falsy(result.errors);
+});