What would be the sane behaviour for the following situation? my app imports an http request library and gives it net permissions my app imports a templating library and gives it no permissions the templating library is malicious and tries to import well known http request libraries, and finds the one i imported, which has been given net permissions. or what if you give the templating library a mixin of some sort whi…
This is a really good question. You would want to ensure that the templating library cannot get access to the http request library unless the templating library is explicitly given a reference to it. So even though both libraries are imported, they can't access each other by default. Realms (the standards track proposal [1]) lets you do this, and Salesforce uses it right now as the security kernel that ensures that t…
We're not focused on security (yet), but any help we can get to move the ecosystem towards a stricter model will help you in the long term (by ensuring that common tools will be compatible with the even stricter model you're advocating).