Import of the watch repository from Pebble

sdk/tools/webpack/restricted-resource-loader.js

@@ -0,0 +1,40 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+var fs = require('fs');
+
+module.exports = function(source) {
+    // Set this loader to cacheable
+    this.cacheable();
+
+    // Whitelist files in the current project
+    var whitelisted_folders = [this.options.context];
+
+    // Whitelist files from the SDK-appended search paths
+    whitelisted_folders = whitelisted_folders.concat(this.options.resolve.root);
+
+    // Iterate over whitelisted file paths
+    for (var i=0; i<whitelisted_folders.length; i++) {
+        // If resource file is from a whitelisted path, return source
+        if (~this.resourcePath.indexOf(fs.realpathSync(whitelisted_folders[i]))) {
+            return source;
+        }
+    }
+
+    // If the resource file is not from a whitelisted path, emit an error and fail the build
+    this.emitError("Requiring a file outside of the current project folder is not permitted.");
+    return "";
+};

sdk/tools/webpack/webpack-config.js.pytemplate

@@ -0,0 +1,96 @@
+////////////////////////////////////////////////////////////////////////////////
+// Template vars injected by projess_js.py:
+
+// boolean
+const isSandbox = ${IS_SANDBOX};
+
+// Array with absolute file path strings
+const entryFilenames = ${ENTRY_FILENAMES};
+
+// folder path string
+const outputPath = ${OUTPUT_PATH};
+
+// file name string
+const outputFilename = ${OUTPUT_FILENAME};
+
+// Array with absolute folder path strings
+const resolveRoots = ${RESOLVE_ROOTS};
+
+// Object, { alias1: 'path1', ... }
+const resolveAliases = ${RESOLVE_ALIASES};
+
+// null or Object with key 'sourceMapFilename'
+const sourceMapConfig = ${SOURCE_MAP_CONFIG};
+
+////////////////////////////////////////////////////////////////////////////////
+// NOTE: Must escape dollar-signs, because this is a Python template!
+
+const webpack = require('webpack');
+
+module.exports = (() => {
+  // The basic config:
+  const config = {
+    entry: entryFilenames,
+    output: {
+        path: outputPath,
+        filename: outputFilename
+    },
+    target: 'node',
+    resolve: {
+        root: resolveRoots,
+        extensions: ['', '.js', '.json'],
+        alias: resolveAliases
+    },
+    resolveLoader: {
+        root: resolveRoots
+    }
+  };
+
+  if (sourceMapConfig) {
+    // Enable webpack's source map output:
+    config.devtool = 'source-map';
+    config.output.sourceMapFilename = sourceMapConfig.sourceMapFilename;
+    config.output.devtoolModuleFilenameTemplate = '[resource-path]';
+    config.output.devtoolFallbackModuleFilenameTemplate = '[resourcePath]?[hash]';
+  }
+
+  return config;
+})();
+
+module.exports.plugins = (() => {
+  const plugins = [
+    // Returns a non-zero exit code when webpack reports an error:
+    require('webpack-fail-plugin'),
+
+    // Includes _message_keys_wrapper in every build to mimic old loader.js:
+    new webpack.ProvidePlugin({ require: '_message_key_wrapper' })
+  ];
+
+  if (isSandbox) {
+    // Prevents using `require('evil_loader!mymodule')` to execute custom
+    // loader code during the webpack build.
+    const RestrictResourcePlugin = require('restrict-resource-webpack-plugin');
+    const plugin = new RestrictResourcePlugin(/!+/,
+      'Custom inline loaders are not permitted.');
+    plugins.push(plugin);
+  }
+
+  return plugins;
+})();
+
+module.exports.module = {
+  loaders: (() => {
+    const loaders = [{'test': /\.json$$/, 'loader': 'json-loader'}];
+
+    if (isSandbox) {
+      // See restricted-resource-loader.js, prevents loading files outside
+      // of the project folder, i.e. `require(../../not_your_business)`:
+      const restrictLoader = {
+        'test': /^.*/, 'loader': 'restricted-resource-loader'
+      };
+      loaders.push(restrictLoader);
+    }
+
+    return loaders;
+  })()
+};