Allow whitelisted imports in babel

[mariusandra]

Changes

• PRs over issues, so here's a babel plugin to replace import anything from 'anywhere' with const anything = __pluginHostImports['anywhere']['anything']

Checklist

• Updated Settings section in README.md, if settings are affected
• Jest tests

[macobo]

This approach has its own set of versioning issues - basically it's guaranteed someone will be caught out by us using a different library version from what they have specified in package.json.

---

Looking at the implementation: So if I did import * from 'random-library' this would silently succeed until used?

Might a better approach be to throw during initialization as this should make loadPlugins fail.

Also we should have tests for running this style of plugin.

[mariusandra]

Addressing the feedback:

• Just like segment, we need to publish the list of versions that are installed. We'd have to do this anyway if the package is in a global or in meta.
• This will throw unless you import from a real library
• This does throw when initializing, there's even a test to catch this.
• For running tests with this type of plugin, I just added to vm.test.ts one test that imports and then uses fetch

[Twixes]

Possibly dumb question: by providing fetch outright, will nobody be able to access some properties in a way that affects other VMs (e.g. redefine fetch.isRedirect)?

[mariusandra]

Definitely not a dumb question. VM2 should wrap everything in proxies. Worth testing it out though. This PR won't really change anything security-wise though, so might be worth tackling after.

[macobo]

Implementation lgtm! :)

[mariusandra]

Thanks! Just some flaky tests being flaky here. I'll run them one more time (have to -> merged with master) and if it's just the pisinca.destroy line that fails, I'll merge this in.