Internal utility functions shared across Vue.js packages for DOM manipulation, type checking, and general utilities
—
Cross-environment utilities for accessing global objects, handling platform differences, and managing allowed global variables in Vue templates.
Functions for safely accessing the global object across different JavaScript environments.
/**
* Get the global object in a cross-environment way
* Handles globalThis, self, window, global, and fallback cases
* @returns The global object for the current environment
*/
function getGlobalThis(): any;Functions for controlling which global variables can be accessed in Vue templates for security.
/**
* Check if a global variable name is allowed in Vue templates
* Prevents access to potentially dangerous globals
* @param key - Global variable name to check
* @returns True if the global is safe to access
*/
function isGloballyAllowed(key: string): boolean;
/**
* @deprecated Use isGloballyAllowed instead
* Legacy name for isGloballyAllowed function
*/
function isGloballyWhitelisted(key: string): boolean;Additional environment-related utilities.
/**
* Create a map-based lookup function from comma-separated string
* Used internally for creating fast lookup functions
* @param str - Comma-separated string of keys
* @returns Function that checks if key exists in the map
*/
function makeMap(str: string): (key: string) => boolean;Usage Examples:
import {
getGlobalThis,
isGloballyAllowed,
isGloballyWhitelisted,
makeMap
} from "@vue/shared";
// Global object access across environments
const globalObj = getGlobalThis();
// In browser environment
if (typeof window !== 'undefined') {
console.log(globalObj === window); // true
}
// In Node.js environment
if (typeof global !== 'undefined') {
console.log(globalObj === global); // true
}
// In Web Worker environment
if (typeof self !== 'undefined') {
console.log(globalObj === self); // true
}
// Modern environments with globalThis
if (typeof globalThis !== 'undefined') {
console.log(globalObj === globalThis); // true
}
// Global variable allowlist checking
console.log(isGloballyAllowed("Math")); // true - Math is allowed
console.log(isGloballyAllowed("console")); // true - console is allowed
console.log(isGloballyAllowed("Date")); // true - Date is allowed
console.log(isGloballyAllowed("Array")); // true - Array is allowed
console.log(isGloballyAllowed("Object")); // true - Object is allowed
// Security - potentially dangerous globals are blocked
console.log(isGloballyAllowed("eval")); // false - eval is not allowed
console.log(isGloballyAllowed("Function")); // false - Function constructor blocked
console.log(isGloballyAllowed("window")); // false - direct window access blocked
console.log(isGloballyAllowed("document")); // false - document access blocked
console.log(isGloballyAllowed("localStorage")); // false - localStorage blocked
// Template usage simulation
function evaluateTemplateExpression(expr: string, globals: Record<string, any>) {
// Check if global variables in expression are allowed
const globalRefs = extractGlobalReferences(expr); // hypothetical function
for (const ref of globalRefs) {
if (!isGloballyAllowed(ref)) {
throw new Error(`Global '${ref}' is not allowed in templates`);
}
}
// Safe to evaluate expression
return evaluateExpression(expr, globals);
}
// Legacy function (deprecated)
console.log(isGloballyWhitelisted("Math")); // true - same as isGloballyAllowed
// Note: This function is deprecated, use isGloballyAllowed instead
// Creating custom lookup maps
const allowedProps = makeMap("id,class,style,title,alt");
console.log(allowedProps("class")); // true
console.log(allowedProps("onclick")); // false
const htmlTags = makeMap("div,span,p,h1,h2,h3,button,input");
console.log(htmlTags("div")); // true
console.log(htmlTags("custom-element")); // falseThe following global variables are permitted in Vue templates:
JavaScript Built-ins:
Infinity, undefined, NaNisFinite, isNaN, parseFloat, parseIntdecodeURI, decodeURIComponent, encodeURI, encodeURIComponentStandard Objects:
Math, Number, Date, Array, Object, Boolean, String, RegExpMap, Set, JSON, Intl, BigIntDebugging:
console, ErrorSymbols:
SymbolThe allowlist prevents template injection attacks by blocking access to:
eval, Function, setTimeout, setIntervalwindow, document, locationlocalStorage, sessionStorage, indexedDBfetch, XMLHttpRequest, WebSocketprocess, require, module, exports// Safe global access pattern
const global = getGlobalThis();
// Feature detection
if ('fetch' in global) {
// Fetch API available
}
if ('process' in global && global.process?.env) {
// Node.js environment
}
// Environment-specific setup
function setupEnvironment() {
const global = getGlobalThis();
if (typeof window !== 'undefined') {
// Browser environment
setupBrowser(global);
} else if (typeof global.process !== 'undefined') {
// Node.js environment
setupNode(global);
} else {
// Other environment (Web Worker, etc.)
setupGeneric(global);
}
}makeMapObject.create(null) for fast property accessThese utilities enable Vue's secure template system:
Install with Tessl CLI
npx tessl i tessl/npm-vue--shared