What is the current status of SES, tinySES and Jessie?

ShadowRealm is useful but orthogonal to Hardened JavaScript. The ses package in npm is what we are calling a Hardened JavaScript shim at this point. It includes everything necessary to harden a Realm, including a ShadowRealm. Every compartment in a realm shares the same batch of intrinsics, but within the compartment, evaluated code and modules can only see the subset of shared and frozen intrinsics and any other objects they have been endowed. So, still one batch of intrinsics per realm but unique evaluators per compartment.

We are currently engaged with a the new “Modules Harmony” group at TC39 to take the part of the compartments proposal that pertains to module loading and getting that integrated into the language along with related proposals for module blocks, module fragments, and deferred module evaluate, all in a way that must be harmonious with the web’s content security policy model in addition to providing a suitable foundation for implementing Compartment, Lockdown, and Harden in user code.

The map is not the terrain, so I won’t speculate on what will come of module harmony at TC39, but I do think we’re finally going to get the missing module loader in one form or another. We will probably decouple a proposal for reifying ExecutionContexts. Compartments can be implemented in user code given a module loader API and separable execution contexts.

The TC39 proposal for Hardened JavaScript née SES remains at Stage 1 and will need to be updated to reflect all the new foundations we will have to work with.

3 Likes