fix(sandbox): INS-2464 additional checks by kwburns-kong · Pull Request #9924 · Kong/insomnia

kwburns-kong · 2026-05-14T19:16:01Z

This PR adds a resolution for INS-2464, increases the existing unit test count and optimizes existing sandbox smoke test.

github-actions · 2026-05-14T19:21:02Z

✅ Circular References Report

Generated at: 2026-05-14T21:13:34.312Z
Status: ✅ NO CHANGE

Summary

Metric	Base (`develop`)	PR	Change
Total Circular References	19	19	0 (0.00%)

Click to view all circular references in PR (19)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts -> insomnia/src/network/network.ts
insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts -> insomnia/src/network/network.ts -> insomnia/src/network/cancellation.ts
insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts -> insomnia/src/network/network.ts -> insomnia/src/network/cancellation.ts -> insomnia/src/script-executor.ts
insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts -> insomnia/src/network/network.ts -> insomnia/src/network/cancellation.ts -> insomnia/src/script-executor.ts -> insomnia/src/scripting/require-interceptor.ts
insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts -> insomnia/src/network/network.ts -> insomnia/src/network/concurrency.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts -> insomnia/src/templating/index.ts -> insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/network/network.ts -> insomnia/src/main/network/get-auth-header.ts -> insomnia/src/main/network/o-auth-2/get-token.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/store.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts
insomnia/src/templating/base-extension-worker.ts -> insomnia/src/templating/worker.ts
insomnia/src/templating/index.ts -> insomnia/src/templating/base-extension.ts
insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/templating/types.ts -> insomnia/src/templating/utils.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Click to view all circular references in base branch (19)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts -> insomnia/src/network/network.ts
insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts -> insomnia/src/network/network.ts -> insomnia/src/network/cancellation.ts
insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts -> insomnia/src/network/network.ts -> insomnia/src/network/cancellation.ts -> insomnia/src/script-executor.ts
insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts -> insomnia/src/network/network.ts -> insomnia/src/network/cancellation.ts -> insomnia/src/script-executor.ts -> insomnia/src/scripting/require-interceptor.ts
insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts -> insomnia/src/network/network.ts -> insomnia/src/network/concurrency.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts -> insomnia/src/templating/index.ts -> insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/network/network.ts -> insomnia/src/main/network/get-auth-header.ts -> insomnia/src/main/network/o-auth-2/get-token.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/store.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts
insomnia/src/templating/base-extension-worker.ts -> insomnia/src/templating/worker.ts
insomnia/src/templating/index.ts -> insomnia/src/templating/base-extension.ts
insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/templating/types.ts -> insomnia/src/templating/utils.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Analysis

✅ No Change: This PR does not introduce or remove any circular references.

This report was generated automatically by comparing against the develop branch.

ihexxa

I was occupied by some other stuff.. but will accelerate to review this.. 🏃

ihexxa · 2026-05-21T09:59:33Z

    ({ names: maskNames, values: maskValues } = alwaysOnPolicy.buildMaskScope(checkSandboxViolations));
  }

+  // Wrap eval so user-supplied source is checked and then evaluated in a scope that inherits the same masked bindings as the outer sandbox.


Will we also cover expressions like const sum = new Function('a', 'b', 'return a + b');, or composition of them?

ihexxa

Just several comments and questions.

ihexxa · 2026-05-28T10:03:09Z

@@ -106,36 +151,22 @@
  };

  walk.simple(tree, {


Will it also collect names that blocked ones which alias are assigned after? e.g:

const b = a; // ← a not yet in blocked → b is missed const a = globalThis; // ← a added here b.require('...'); // ← NOT blocked

ihexxa · 2026-05-28T10:12:53Z

  }
  // We should evenutally drop non-valid JavaScript.   
  if (!tree) {
    // throw new Error();


Could the script be higher version (e,g., ecmaVersion 2025) which works but can't be parsed, then it is returned here.

kwburns-kong added 5 commits May 14, 2026 11:18

fix: Improvements to INS-2168

ab82835

chore(sandbox): removed redundant code

27e3a91

chore(sandbox): Added more smoke tests

a78fbd2

chore(sandbox): added more sandbox unit tests

97b23a4

chore(sandbox): added comments per unit test section

7bbb649

kwburns-kong requested a review from ihexxa May 14, 2026 19:17

Merge branch 'develop' into sec/sandbox-dynamic-property

8036353

kwburns-kong enabled auto-merge (squash) May 14, 2026 21:09

ihexxa reviewed May 21, 2026

View reviewed changes

ihexxa reviewed May 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(sandbox): INS-2464 additional checks #9924

fix(sandbox): INS-2464 additional checks #9924
kwburns-kong wants to merge 6 commits into
developfrom
sec/sandbox-dynamic-property

kwburns-kong commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026 •

edited

Loading

Uh oh!

ihexxa left a comment

Uh oh!

ihexxa May 21, 2026

Uh oh!

Uh oh!

ihexxa left a comment

Uh oh!

ihexxa May 28, 2026

Uh oh!

Uh oh!

ihexxa May 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

kwburns-kong commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Circular References Report

Summary

Analysis

Uh oh!

ihexxa left a comment

Choose a reason for hiding this comment

Uh oh!

ihexxa May 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ihexxa left a comment

Choose a reason for hiding this comment

Uh oh!

ihexxa May 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ihexxa May 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented May 14, 2026 •

edited

Loading