ssrLoadModule executes code in non-strict mode

[Rich-Harris]

Describe the bug

A module like this...

foo = 1;
console.log(foo);

...should fail, because foo is not declared anywhere, and modules always run in strict mode. This works correctly in an app built by Vite. During development, however, the module is interpreted as a non-strict function, and the code above runs.

Reproduction

https://github.com/Rich-Harris/vite-ssrloadmodule-strict-repro

System Info

System:
    OS: macOS 12.0.1
    CPU: (10) arm64 Apple M1 Max
    Memory: 510.66 MB / 32.00 GB
    Shell: 5.8 - /bin/zsh
  Binaries:
    Node: 16.15.1 - ~/.nvm/versions/node/v16.15.1/bin/node
    Yarn: 1.22.19 - ~/.nvm/versions/node/v16.15.1/bin/yarn
    npm: 8.11.0 - ~/.nvm/versions/node/v16.15.1/bin/npm
  Browsers:
    Chrome: 103.0.5060.114
    Chrome Canary: 105.0.5187.0
    Firefox: 102.0.1
    Safari: 15.1
  npmPackages:
    vite: ^3.0.2 => 3.0.2

Used Package Manager

pnpm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[Rich-Harris]

Changing this line...

vite/packages/vite/src/node/ssr/ssrModuleLoader.ts

Line 197 in 60721ac

result.code + `\n//# sourceURL=${mod.url}`

...fixes it:

    const AsyncFunction = async function () {}.constructor as typeof Function
    const initModule = new AsyncFunction(
      `global`,
      ssrModuleExportsKey,
      ssrImportMetaKey,
      ssrImportKey,
      ssrDynamicImportKey,
      ssrExportAllKey,
-      result.code + `\n//# sourceURL=${mod.url}`
+      '"use strict";\n' + result.code + `\n//# sourceURL=${mod.url}`
    )

[patak-dev]

LGTM. @Rich-Harris if you don't mind I'll do the PR to change that line as we can run vite-ecosystem-ci if the PR branch is in the repo. If no ecosystem CI complaints I think it is safe to get this one in a patch