Hardened URL vetted shim

[kriskowal]

What is the Problem Being Solved?

harden(URL) is not sufficient to make URL safe to share among fearlessly coöperating compartments because some methods return objects with prototypes that are not among the shared intrinsics, particularly the search param iterator.

Description of the Design

I propose the creation of an @endo/url package with an @endo/url/shim.js exported module that can be included in @endo/init and harden the entirety of URL if it is present, to the extent it is implemented. The module will need its own notion of permits and should remove unknown properties. This might entail ejection of a utility package from ses.

Security Considerations

harden(URL) is not sufficient to make URL safe to share between fearlessly coöperating compartments. This change should make it safe to endow URL in globals.

XS does not provide URL and Agoric’s platform on XS does not rely on a URL being present. There are no plans to introduce one.

Scaling Considerations

Some overhead for vat initialization.

Test Plan

To be designed.

Compatibility Considerations

Some, to be enumerated.

Upgrade Considerations

Some, to be enumerated.