formio:vm Error setting global t: TypeError: (text)

[andrewsignori-aot]

We are currently trying to build the most updated version of the server using the approach below, where we are downloading Formio at a specific commit and building the server, replacing the "#main" references with their versions.

• formio: f92dc5feab5cd0ff3ee30965141f11a8e552fe51
• @formio/core: 2.6.5
• @formio/js: 5.3.5
• @formio/vm: 2.0.2

During any "dry run" submission, we are facing the following issue.

formio:validator Starting validation +0ms
formio:vm Error setting global t: TypeError: (text) => {
            return text;
        } could not be cloned.
    at IsolateVM.evaluateSync (/formio/node_modules/@formio/vm/build/IsolateVM.js:89:36)
    at IsolateVMEvaluator.evaluate (/formio/src/vm/index.js:89:26)
    at evaluate (/formio/node_modules/@formio/core/lib/utils/utils.js:135:34)
    at calculateProcessSync (/formio/node_modules/@formio/core/lib/process/calculation/index.js:36:43)
    at /formio/node_modules/@formio/core/lib/process/calculation/index.js:56:45
    at Generator.next (<anonymous>)
    at /formio/node_modules/@formio/core/lib/process/calculation/index.js:8:71
    at new Promise (<anonymous>)
    at __awaiter (/formio/node_modules/@formio/core/lib/process/calculation/index.js:4:12)
    at Object.calculateProcess [as process] (/formio/node_modules/@formio/core/lib/process/calculation/index.js:55:39)

Possible Root Cause

I am not sure which layer a possible fix (if one really exists) should be executed, since the formio, calls the @formio/core, which then would call the @formio/vm. In a quick (and shallow) analysis, the root cause of this error lies in how the evaluation context is passed to the isolated VM sandbox:

Function Injection: @formio/core provides a normalizeContext method which injects a translation helper function, t, into the global evaluation context: (text) => { return text; }.
Serialization Failure: @formio/vm uses a library called isolated-vm to securely execute form logic. isolated-vm relies on the structured clone algorithm to securely copy global variables from the Node environment into the isolated VM environment.
The Crash: The structured clone algorithm, by design, cannot serialize JavaScript functions. When isolated-vm encounters the injected t function in the arguments, it fails to clone it and throws the TypeError: ... could not be cloned.

Maybe this commit in formio repo would resolve it, but it did not handle this specific t function?

[brendanbond]

The Crash

Correct me if I'm wrong but this doesn't crash, right? We have a ticket to address this issue, but all things considered it's a pretty minor one - we bake the instance methods including t() into the evaluation context in the Isolate, so this is just trying to clone a function into the isolate, failing, and moving on with its life. In other words, if this were causing some kind of runtime instability we'd set the priority higher, but as is it's ready for development on our backlog and hopefully will have a fix in a coming version of the platform.

[lane-formio]

@andrewsignori-aot
Do you know what version of formio that commit refers to?
The tags (and main) are up-to-date now, so this might actually already be resolved.

[andrewsignori-aot]

@andrewsignori-aot Do you know what version of formio that commit refers to? The tags (and main) are up-to-date now, so this might actually already be resolved.

Hi @lane-formio, the combination below is what we ended up using, with a small workaround to stop the error from happening.
We were trying to replicate the Form.io version targeting the API Server Version 9.7.7

We were using the following:

• formio: f92dc5feab5cd0ff3ee30965141f11a8e552fe51
• @formio/core: 2.6.5
• @formio/js: 5.3.5
• @formio/vm: 2.0.2

We have one more update planned for this fall, when we will be able to take a new look at it.

[andrewsignori-aot]

The Crash

Correct me if I'm wrong but this doesn't crash, right? We have a ticket to address this issue, but all things considered it's a pretty minor one - we bake the instance methods including t() into the evaluation context in the Isolate, so this is just trying to clone a function into the isolate, failing, and moving on with its life. In other words, if this were causing some kind of runtime instability we'd set the priority higher, but as is it's ready for development on our backlog and hopefully will have a fix in a coming version of the platform.

@brendanbond
Sorry if using the words "the crash" sidetracked the conversation. I will be mindful of it next time.
Once we have the next planned upgrade this fall, I can update this issue with the findings.
We are currently using some limited features from Form.io, which may be working for us but could be a potential issue in some other features; that is why we thought that it would be worth sharing it.

Thanks for looking into it.