fix: utilize a js helper dynamic-import.js for trying await import and require (#9299)

Author: mmaietta

.changeset/clever-buttons-double.md

@@ -0,0 +1,5 @@
+---
+"app-builder-lib": patch
+---
+
+fix: removes dynamic eval and utilizes a js helper file for trying `await import` and `require` that is then copied into the final npm package

eslint.config.mjs

@@ -20,6 +20,7 @@ export default [{
       "**/out",
       // used for CLI
       "**/main.js",
+      "packages/app-builder-lib/helpers",
       "packages/electron-builder/cli.js",
       "packages/electron-builder/install-app-deps.js"
     ],

packages/app-builder-lib/helpers/dynamic-import.d.ts

@@ -0,0 +1,3 @@
+export declare function dynamicImport(path: string): Promise<any>;
+/** Like {@link dynamicImport()}, except it tries out {@link require()} first. */
+export declare function dynamicImportMaybe(path: string): Promise<any>;

packages/app-builder-lib/helpers/dynamic-import.js

@@ -0,0 +1,23 @@
+const url = require("url")
+const fs = require("fs")
+
+exports.dynamicImport = async function dynamicImport(path) {
+  try {
+    return await import(fs.existsSync(path) ? url.pathToFileURL(path).href : path)
+  } catch (error) {
+    return Promise.reject(error)
+  }
+}
+
+exports.dynamicImportMaybe = async function dynamicImportMaybe(path) {
+  try {
+    return require(path)
+  } catch (e1) {
+    try {
+      return await exports.dynamicImport(path)
+    } catch (e2) {
+      e1.message = "\n1. " + e1.message + "\n2. " + e2.message
+      throw e1
+    }
+  }
+}

packages/app-builder-lib/package.json

@@ -6,6 +6,7 @@
   "files": [
     "out",
     "templates",
+    "helpers",
     "scheme.json",
     "certs/root_certs.keychain"
   ],

packages/app-builder-lib/src/util/resolve.ts

@@ -1,24 +1,14 @@
 import { log } from "builder-util/out/log"
 import debug from "debug"
 import * as path from "path"
-import { pathToFileURL } from "url"
+import * as requireMaybe from "../../helpers/dynamic-import"
 
 export async function resolveModule<T>(type: string | undefined, name: string): Promise<T> {
-  const extension = path.extname(name).toLowerCase()
-  const isModuleType = type === "module"
   try {
-    if (extension === ".mjs" || (extension === ".js" && isModuleType)) {
-      const fileUrl = pathToFileURL(name).href
-      return await eval("import ('" + fileUrl + "')")
-    }
+    return requireMaybe.dynamicImportMaybe(name)
   } catch (error: any) {
-    log.debug({ moduleName: name, message: error.message ?? error.stack }, "Unable to dynamically import , falling back to `require`")
-  }
-  try {
-    return require(name)
-  } catch (error: any) {
-    log.error({ moduleName: name, message: error.message ?? error.stack }, "Unable to `require`")
-    throw new Error(error.message ?? error.stack)
+    log.error({ moduleName: name, message: error.message ?? error.stack }, "Unable to dynamically `import` or `require`")
+    throw error
   }
 }
 

tsconfig-base.json

@@ -10,6 +10,7 @@
     "noUnusedLocals": true,
     "noFallthroughCasesInSwitch": true,
     "noImplicitReturns": true,
+    "allowJs": true,
 
     "inlineSources": true,
     "sourceMap": true,