security: avoid cross-realm objects

lib/dependencies/ImportParserPlugin.js

@@ -137,7 +137,7 @@ class ImportParserPlugin {
 				if (importOptions.webpackInclude !== undefined) {
 					if (
 						!importOptions.webpackInclude ||
-						importOptions.webpackInclude.constructor.name !== "RegExp"
+						!(importOptions.webpackInclude instanceof RegExp)
 					) {
 						parser.state.module.addWarning(
 							new UnsupportedFeatureWarning(
@@ -146,13 +146,13 @@ class ImportParserPlugin {
 							)
 						);
 					} else {
-						include = new RegExp(importOptions.webpackInclude);
+						include = importOptions.webpackInclude;
 					}
 				}
 				if (importOptions.webpackExclude !== undefined) {
 					if (
 						!importOptions.webpackExclude ||
-						importOptions.webpackExclude.constructor.name !== "RegExp"
+						!(importOptions.webpackExclude instanceof RegExp)
 					) {
 						parser.state.module.addWarning(
 							new UnsupportedFeatureWarning(
@@ -161,7 +161,7 @@ class ImportParserPlugin {
 							)
 						);
 					} else {
-						exclude = new RegExp(importOptions.webpackExclude);
+						exclude = importOptions.webpackExclude;
 					}
 				}
 				if (importOptions.webpackExports !== undefined) {

lib/javascript/JavascriptParser.js

@@ -3635,17 +3635,27 @@ class JavascriptParser extends Parser {
 			return EMPTY_COMMENT_OPTIONS;
 		}
 		let options = {};
+		/** @type {unknown[]} */
 		let errors = [];
 		for (const comment of comments) {
 			const { value } = comment;
 			if (value && webpackCommentRegExp.test(value)) {
 				// try compile only if webpack options comment is present
 				try {
-					const val = vm.runInNewContext(`(function(){return {${value}};})()`);
-					Object.assign(options, val);
+					for (let [key, val] of Object.entries(
+						vm.runInNewContext(`(function(){return {${value}};})()`)
+					)) {
+						if (typeof val === "object" && val !== null) {
+							if (val.constructor.name === "RegExp") val = new RegExp(val);
+							else val = JSON.parse(JSON.stringify(val));
+						}
+						options[key] = val;
+					}
 				} catch (e) {
-					e.comment = comment;
-					errors.push(e);
+					const newErr = new Error(String(e.message));
+					newErr.stack = String(e.stack);
+					Object.assign(newErr, { comment });
+					errors.push(newErr);
 				}
 			}
 		}