fix: isolate API token from user code scope (#25)

mattzcarey · web-flow · commit 8aad3edaebb8 · 2026-02-20T00:08:50.000Z
* security: isolate API token from user code scope

Move user code execution from evaluate() into a separate private #run()
method. The apiToken parameter is only accessible within evaluate(),
where it gets captured by the cloudflare.request() closure and stored
on a private class field. User code in #run() can access the cloudflare
helper but not the raw token value.

* test: update assertions for token isolation and GraphQL path fix
diff --git a/src/executor.ts b/src/executor.ts
@@ -24,8 +24,10 @@ const apiBase = ${JSON.stringify(apiBase)};
 const accountId = ${JSON.stringify(accountId)};
 
 export default class CodeExecutor extends WorkerEntrypoint {
+  #cloudflare = null;
+
   async evaluate(apiToken) {
-    const cloudflare = {
+    this.#cloudflare = {
       async request(options) {
         const { method, path, query, body, contentType, rawBody } = options;
 
@@ -114,6 +116,11 @@ export default class CodeExecutor extends WorkerEntrypoint {
       }
     };
 
+    return this.#run();
+  }
+
+  async #run() {
+    const cloudflare = this.#cloudflare;
     try {
       const result = await (${code})();
       return { result, err: undefined };
diff --git a/src/tests/executor.test.ts b/src/tests/executor.test.ts
@@ -220,7 +220,7 @@ describe('GraphQL Support', () => {
       const workerConfig = loaderCall.mock.calls[0][1]()
       const workerCode = workerConfig.modules['worker.js']
 
-      expect(workerCode).toContain('const cloudflare = {')
+      expect(workerCode).toContain('this.#cloudflare = {')
       expect(workerCode).toContain('async request(options)')
     })
 
