secrets.mjs 645 B

1234567891011121314151617181920
  1. /**
  2. * @license
  3. * SPDX-License-Identifier: Apache-2.0
  4. */
  5. /**
  6. * A secret token that must be passed to safe type constructors. It is only
  7. * accessible from within safevalues, ensuring that unrestricted safe type
  8. * creation is only possible within safevalues. In particular, this prevents
  9. * forgery such as `safeHtmlValue.constructor('javascript:evil')`.
  10. */
  11. export const secretToken = {};
  12. /**
  13. * Asserts that the given token matches the secret safevalues token. An
  14. * exception is thrown if that is not the case.
  15. */
  16. export function ensureTokenIsValid(token) {
  17. if (token !== secretToken) {
  18. throw new Error('Bad secret');
  19. }
  20. }