Reference error in 1.12.0

[AlbinHoxha]

Hello everyone, based on the release notes (from version 1.12.0) it seems that endo-ses doesn't throw a ReferenceError anymore when trying to access variables that don't exist but instead returns undefined. This causes a problem for us as we can't know if the undefined was returned because of an error or if the value was actually undefined.
Would it be possible to have this somehow configurable to throw a different Error which doesn't have security vulnerabilities.

[kriskowal]

Thanks for reporting. We’ll put our heads together and try to think of a way. I would not rule out the possibility, but considerable thought has been put into this already. This problem will of course not exist for a native implementation of Hardened JavaScript like Moddable’s XS and we do attempt to provide a high-fidelity emulation when possible.

The mechanism we use for confining evaluated code is a waterfall of with blocks around a direct eval, each tier revealing some lexical names, the last of which is a Proxy that’s purpose is to deny access to arbitrary globals. If there’s a solution, it will be here https://github.com/endojs/endo/blob/master/packages/ses/src/make-evaluate.js#L92-L107

[kriskowal]

We discussed this briefly and believe we can offer an option to choose which fidelity compromise is tolerable on a per-compartment basis:

When x is not in scope, ideally:

• the expression x throws a ReferenceError
• the value of typeof x is "undefined"

Currently, and by default going forward

• the value of x is undefined
• the value of typeof x is "undefined"

With an option threaded through an individual Compartment constructor, we can change the behavior to:

• the expression x throws ReferenceError
• the expression typeof x also throws ReferenceError