chore!: stop transpiling webhook integration scripts with Babel (#40142)

Author: ggazzo

.changeset/integration-scripts-no-babel.md

@@ -0,0 +1,13 @@
+---
+'@rocket.chat/meteor': major
+---
+
+**Breaking:** Stopped transpiling webhook integration scripts with Babel. Scripts now run as-is inside `isolated-vm` (modern V8).
+
+Class method bodies are now in strict mode per the ES2015 spec. Scripts that relied on sloppy-mode behaviors provided by the previous Babel transpilation must be updated:
+
+- **Implicit globals** — `msg = buildMessage(...)` inside a class method now throws `ReferenceError`. Add `let`, `const`, or `var`.
+- **`this` in nested regular functions** — `function helper() { this.JSON.stringify(...) }` now has `this === undefined` instead of `globalThis`. Use arrow functions or pass the dependency explicitly.
+- **`arguments.callee`** — Throws `TypeError`. Use a named function expression instead.
+- **Octal literals** — `0777` is now a `SyntaxError`. Use `0o777`.
+- **Duplicate parameter names** — `function(a, a) {}` is now a `SyntaxError`.

apps/meteor/app/integrations/server/lib/validateOutgoingIntegration.ts

@@ -3,8 +3,8 @@ import { Subscriptions, Users, Rooms } from '@rocket.chat/models';
 import { Match } from 'meteor/check';
 import { Meteor } from 'meteor/meteor';
 
-import { compileIntegrationScript } from './compileIntegrationScript';
 import { isScriptEngineFrozen } from './validateScriptEngine';
+import { validateScriptSyntax } from './validateScriptSyntax';
 import { parseCSV } from '../../../../lib/utils/parseCSV';
 import { hasPermissionAsync, hasAllPermissionAsync } from '../../../authorization/server/functions/hasPermission';
 import { outgoingEvents } from '../../lib/outgoingEvents';
@@ -181,7 +181,9 @@ export const validateOutgoingIntegration = async function (
 		integration.script &&
 		integration.script.trim() !== ''
 	) {
-		const { script, error } = compileIntegrationScript(integration.script, { transpile: !skipTranspile });
+		// isolated-vm embeds modern V8 and runs the script natively, so no
+		// transpilation is needed. Syntax is still validated at save time.
+		const { script, error } = validateScriptSyntax(integration.script);
 		integrationData.scriptCompiled = script;
 		integrationData.scriptError = error;
 	}

apps/meteor/app/integrations/server/lib/validateScriptSyntax.ts

@@ -0,0 +1,37 @@
+import vm from 'node:vm';
+
+/**
+ * Validate the syntax of a user-supplied integration script and return it
+ * as-is for storage in `scriptCompiled`.
+ *
+ * Integration scripts run inside `isolated-vm`, which embeds modern V8 and
+ * handles ES2023+ natively. Transpilation via Babel is no longer performed.
+ *
+ * ⚠️  **Breaking change (9.0.0):** Class method bodies are now in strict
+ * mode per the ES2015 spec. Scripts that relied on sloppy-mode behaviors
+ * (e.g. implicit globals, `arguments.callee`, `this === globalThis` inside
+ * regular nested functions) must be updated. See the migration guide in the
+ * PR description.
+ *
+ * Returns `{ script }` on success or `{ error }` when the input has a
+ * syntax error. `error` has the same `{ name, message, stack }` shape the
+ * previous flow persisted in `scriptError`.
+ */
+export function validateScriptSyntax(
+	script: string,
+): { script: string; error?: undefined } | { script?: undefined; error: Pick<Error, 'name' | 'message' | 'stack'> } {
+	try {
+		// Wrap so top-level return/declarations parse the same way as in
+		// getCompatibilityScript at runtime. vm.Script only parses — it does
+		// not execute the code here.
+		// eslint-disable-next-line no-new
+		new vm.Script(`(function(){${script}})`);
+		return { script };
+	} catch (e) {
+		if (e instanceof SyntaxError) {
+			const { name, message, stack } = e;
+			return { error: { name, message, stack } };
+		}
+		throw e;
+	}
+}

apps/meteor/app/integrations/server/methods/incoming/addIncomingIntegration.ts

@@ -10,8 +10,8 @@ import { addUserRolesAsync } from '../../../../../server/lib/roles/addUserRoles'
 import { hasPermissionAsync, hasAllPermissionAsync } from '../../../../authorization/server/functions/hasPermission';
 import { methodDeprecationLogger } from '../../../../lib/server/lib/deprecationWarningLogger';
 import { notifyOnIntegrationChanged } from '../../../../lib/server/lib/notifyListener';
-import { compileIntegrationScript } from '../../lib/compileIntegrationScript';
 import { validateScriptEngine, isScriptEngineFrozen } from '../../lib/validateScriptEngine';
+import { validateScriptSyntax } from '../../lib/validateScriptSyntax';
 
 const validChannelChars = ['@', '#'];
 
@@ -108,13 +108,16 @@ export const addIncomingIntegration = async (userId: string, integration: INewIn
 		_createdBy: await Users.findOne({ _id: userId }, { projection: { username: 1 } }),
 	};
 
+	// Validate the script syntax if it is enabled and using a sandbox that is
+	// not frozen. isolated-vm embeds modern V8 and runs the script natively, so
+	// no transpilation is needed.
 	if (
 		!isScriptEngineFrozen(integrationData.scriptEngine) &&
 		integration.scriptEnabled === true &&
 		integration.script &&
 		integration.script.trim() !== ''
 	) {
-		const { script, error } = compileIntegrationScript(integration.script, { transpile: !skipTranspile });
+		const { script, error } = validateScriptSyntax(integration.script);
 		if (error) {
 			integrationData.scriptCompiled = undefined;
 			integrationData.scriptError = error;

apps/meteor/app/integrations/server/methods/incoming/updateIncomingIntegration.ts

@@ -8,8 +8,8 @@ import { addUserRolesAsync } from '../../../../../server/lib/roles/addUserRoles'
 import { hasAllPermissionAsync, hasPermissionAsync } from '../../../../authorization/server/functions/hasPermission';
 import { methodDeprecationLogger } from '../../../../lib/server/lib/deprecationWarningLogger';
 import { notifyOnIntegrationChanged } from '../../../../lib/server/lib/notifyListener';
-import { compileIntegrationScript } from '../../lib/compileIntegrationScript';
 import { isScriptEngineFrozen, validateScriptEngine } from '../../lib/validateScriptEngine';
+import { validateScriptSyntax } from '../../lib/validateScriptSyntax';
 
 const validChannelChars = ['@', '#'];
 
@@ -84,25 +84,23 @@ export const updateIncomingIntegration = async (
 
 	const isFrozen = isScriptEngineFrozen(scriptEngine);
 
-	// Default to transpiling with Babel for backwards compatibility; integrations
-	// can opt-out per-record by setting `skipTranspile: true` (removed in 9.0.0).
-	const skipTranspile = integration.skipTranspile === true;
-
 	if (!isFrozen && integration.scriptEnabled === true && integration.script && integration.script.trim() !== '') {
-		const { script, error } = compileIntegrationScript(integration.script, { transpile: !skipTranspile });
+		// isolated-vm embeds modern V8 and runs the script natively, so no
+		// transpilation is needed. Syntax is still validated at save time.
+		const { script, error } = validateScriptSyntax(integration.script);
 		if (error) {
 			await Integrations.updateOne(
 				{ _id: integrationId },
 				{
-					$set: { scriptError: error, skipTranspile },
+					$set: { scriptError: error },
 					$unset: { scriptCompiled: 1 as const },
 				},
 			);
 		} else {
 			await Integrations.updateOne(
 				{ _id: integrationId },
 				{
-					$set: { scriptCompiled: script, skipTranspile },
+					$set: { scriptCompiled: script },
 					$unset: { scriptError: 1 as const },
 				},
 			);
@@ -171,7 +169,6 @@ export const updateIncomingIntegration = async (
 							...(typeof integration.script !== 'undefined' && { script: integration.script }),
 							scriptEnabled: integration.scriptEnabled,
 							...(scriptEngine && { scriptEngine }),
-							skipTranspile,
 						}),
 				...(typeof integration.overrideDestinationChannelEnabled !== 'undefined' && {
 					overrideDestinationChannelEnabled: integration.overrideDestinationChannelEnabled,

apps/meteor/package.json

@@ -68,8 +68,6 @@
 		"@aws-sdk/client-s3": "^3.862.0",
 		"@aws-sdk/lib-storage": "^3.862.0",
 		"@aws-sdk/s3-request-presigner": "^3.862.0",
-		"@babel/core": "~7.29.0",
-		"@babel/preset-env": "~7.29.5",
 		"@babel/runtime": "~7.29.2",
 		"@bugsnag/js": "~7.20.2",
 		"@bugsnag/plugin-react": "~7.19.0",

apps/meteor/tests/end-to-end/api/incoming-integrations.ts

@@ -367,9 +367,8 @@ describe('[Incoming Integrations]', () => {
 		describe('Script integration tests', () => {
 			let withScript: IIntegration;
 			let withScriptDefaultContentType: IIntegration;
-			let withSkipTranspile: IIntegration;
 
-			const sloppyModeScript =
+			const strictModeScript =
 				'const buildMessage = (obj) => {\n' +
 				'  \n' +
 				'    const template = `[#VALUE](${ obj.test })`;\n' +
@@ -381,7 +380,7 @@ describe('[Incoming Integrations]', () => {
 				'  \n' +
 				'  class Script {\n' +
 				'    process_incoming_request({ request }) {\n' +
-				'      msg = buildMessage(request.content);\n' +
+				'      const msg = buildMessage(request.content);\n' +
 				'  \n' +
 				'      return {\n' +
 				'        content:{\n' +
@@ -434,38 +433,14 @@ describe('[Incoming Integrations]', () => {
 						scriptEnabled: true,
 						overrideDestinationChannelEnabled: false,
 						channel: '#general',
-						script: sloppyModeScript,
+						script: strictModeScript,
 					})
 					.expect(200);
 				withScriptDefaultContentType = res2.body.integration;
-
-				// Same script but with skipTranspile: true — no Babel, class methods
-				// run in strict mode so `msg = buildMessage(...)` throws ReferenceError.
-				const res3 = await request
-					.post(api('integrations.create'))
-					.set(credentials)
-					.send({
-						type: 'webhook-incoming',
-						name: 'Incoming test with skipTranspile',
-						enabled: true,
-						alias: 'test',
-						username: 'rocket.cat',
-						scriptEnabled: true,
-						skipTranspile: true,
-						overrideDestinationChannelEnabled: false,
-						channel: '#general',
-						script: sloppyModeScript,
-					})
-					.expect(200);
-				withSkipTranspile = res3.body.integration;
 			});
 
 			after(async () => {
-				await Promise.all([
-					removeIntegration(withScript._id, 'incoming'),
-					removeIntegration(withScriptDefaultContentType._id, 'incoming'),
-					removeIntegration(withSkipTranspile._id, 'incoming'),
-				]);
+				await Promise.all([removeIntegration(withScript._id, 'incoming'), removeIntegration(withScriptDefaultContentType._id, 'incoming')]);
 			});
 
 			it('should send a message if the payload is a application/x-www-form-urlencoded JSON AND the integration has a valid script', async () => {
@@ -513,22 +488,6 @@ describe('[Incoming Integrations]', () => {
 				expect(messagesResult.body).to.have.property('messages').and.to.be.an('array');
 				expect(!!(messagesResult.body.messages as IMessage[]).find((m) => m.msg === '[#VALUE](test)')).to.be.true;
 			});
-
-			it('should create the skipTranspile integration with scriptCompiled and no scriptError', () => {
-				expect(withSkipTranspile).to.have.property('scriptCompiled');
-				expect(withSkipTranspile).to.not.have.property('scriptError');
-				expect(withSkipTranspile).to.have.property('skipTranspile', true);
-			});
-
-			it('should fail to execute the same sloppy-mode script when skipTranspile is true', async () => {
-				const payload = { test: 'test' };
-
-				await request
-					.post(`/hooks/${withSkipTranspile._id}/${withSkipTranspile.token}`)
-					.set('Content-Type', 'application/json')
-					.send(JSON.stringify(payload))
-					.expect(400);
-			});
 		});
 
 		describe('With manage-own-incoming-integrations permission', () => {