test: restrict iife helpers injection (#13918)

playground/lib/__tests__/lib.spec.ts

@@ -39,6 +39,15 @@ describe.runIf(isBuild)('build', () => {
     )
   })
 
+  test('restrisct-helpers-injection', async () => {
+    const code = readFile(
+      'dist/helpers-injection/my-lib-custom-filename.iife.js',
+    )
+    expect(code).toMatch(
+      `'"use strict"; return (' + expressionSyntax + ").constructor;"`,
+    )
+  })
+
   test('Library mode does not include `preload`', async () => {
     await untilUpdated(
       () => page.textContent('.dynamic-import-message'),

playground/lib/__tests__/serve.ts

@@ -67,6 +67,15 @@ export async function serve(): Promise<{ close(): Promise<void> }> {
       configFile: path.resolve(__dirname, '../vite.nominify.config.js'),
     })
 
+    await build({
+      root: rootDir,
+      logLevel: 'warn', // output esbuild warns
+      configFile: path.resolve(
+        __dirname,
+        '../vite.helpers-injection.config.js',
+      ),
+    })
+
     // start static file server
     const serve = sirv(path.resolve(rootDir, 'dist'))
     const httpServer = http.createServer((req, res) => {

playground/lib/src/main-helpers-injection.js

@@ -0,0 +1,11 @@
+// Trigger wrong helpers injection if not properly constrained
+;(function () {
+  var getEvalledConstructor = function (expressionSyntax) {
+    try {
+      return $Function(
+        '"use strict"; return (' + expressionSyntax + ').constructor;',
+      )()
+    } catch (e) {}
+  }
+  console.log(getEvalledConstructor(0))
+})()

playground/lib/vite.helpers-injection.config.js

@@ -0,0 +1,19 @@
+import path from 'node:path'
+import { defineConfig } from 'vite'
+
+// Check that helpers injection is properly constrained
+
+export default defineConfig({
+  build: {
+    lib: {
+      entry: path.resolve(__dirname, 'src/main-helpers-injection.js'),
+      name: 'MyLib',
+      formats: ['iife'],
+      fileName: 'my-lib-custom-filename',
+    },
+    minify: false,
+    outDir: 'dist/helpers-injection',
+  },
+  plugins: [],
+  cacheDir: 'node_modules/.vite-helpers-injection',
+})