cfsolve 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e16a4a51d964a033d8395a0757bf128554f4d5d3f52ae1ef914786e651218b62
-  data.tar.gz: d5645dcdb32e335adbc69a521b3aa8289993c41ccf03e6a9380c7a95d5054ab1
+  metadata.gz: 4828b2b3d60862c05be945e5ae1ca02c96c63889f39ad326759e01702b54d75e
+  data.tar.gz: bd34543669e65937407d5670ad0bfdb679cfb0fd2211ac8176de0d1f9d85d563
 SHA512:
-  metadata.gz: 075eb4eed86e21dd138d95714355792e456c8535c8ec87f76dd49cec4c19f753add411319472dc2a85950938f3722f0bff9cb9f7ce993bace80a9413400b7c50
-  data.tar.gz: 6e1575b02b5f658c79c4dc3d7159edded8a15637974e12b67a0578ddb5c6c457b898318210968523947dd20c9666c2b22444f478264c8423d543bb5f876eee69
+  metadata.gz: d03f438c214dfa30a921c9e015a087155fdf8c74b192b705ce8d338c5e8868d6bebe22c8977f824ac69127a1d687a4b5cd587d071f253d0cc5dddf40e7c3f232
+  data.tar.gz: b8eb750a28710676dcdb2671d5fc1168200d6c749981c9418d54a01dd1299facc40a0f0e1144bee16f3d9ece694aafa0b56d7a889b0446cc6f4b4481fc3d5628

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.1
+
+Update the native engine to rebased upstream PR #5 (`0f97eb7`). Adopt upstream's
+regional worker-host discovery, copied-option recovery, and lower probe-matching
+threshold while retaining the fixes for replay across challenge builds.
+
 ## 0.1.0
 
 Initial Ruby interface based on cfsolve PR #5. Includes isolated native solves,

data/UPSTREAM.md

@@ -1,6 +1,6 @@
 The Rust engine is vendored from [chris124567/cfsolve](https://github.com/chris124567/cfsolve),
 including [PR #5](https://github.com/chris124567/cfsolve/pull/5), at commit
-`1ee7a203e2a9a17fbb82148b6707d2d82181f56a`.
+`0f97eb7ccfea54f445b60a624ad8949beae95e95`.
 
 `vendor/cfsolve` is an unmodified archive of that revision. Its three patched
 dependencies are applied by the extension's top-level Cargo manifest. The Ruby

data/lib/cfsolve/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Cfsolve
-  VERSION = "0.1.0"
-  UPSTREAM_REVISION = "1ee7a203e2a9a17fbb82148b6707d2d82181f56a"
+  VERSION = "0.1.1"
+  UPSTREAM_REVISION = "0f97eb7ccfea54f445b60a624ad8949beae95e95"
 end

data/vendor/cfsolve/src/challenge/merge.rs

@@ -1,12 +1,9 @@
 //! Recovers how the iframe copies the embedding page's `extraParams` message fields into
 //! randomly named `_cf_chl_opt` options.
 
-use std::collections::HashMap;
-
 use anyhow::{Context, Result};
 use swc_core::ecma::ast::{
-    AssignOp, AssignTarget, BinaryOp, CallExpr, Callee, Decl, Expr, FnDecl, Pat,
-    SimpleAssignTarget, Stmt, UnaryOp,
+    AssignTarget, BinaryOp, CallExpr, Callee, Decl, Expr, FnDecl, SimpleAssignTarget, Stmt, UnaryOp,
 };
 use swc_core::ecma::visit::{Visit, VisitWith};
 
@@ -283,40 +280,37 @@ fn writes(function: &FnDecl) -> Vec<OptionWrite> {
         return Vec::new();
     };
     // Some options pass through a local so stored browser state can override them before they
-    // are written back. Keep only the latest straight-line value; `None` invalidates a copy.
-    let mut staged: HashMap<&str, Option<&str>> = HashMap::new();
+    // are written back.
+    let mut staged: Vec<(&str, &str)> = Vec::new();
     let mut writes = Vec::new();
     for statement in &body.stmts {
-        if let Stmt::Decl(Decl::Var(declaration)) = statement {
-            for binding in &declaration.decls {
-                if let Pat::Ident(local) = &binding.name
-                    && let Some(value) = &binding.init
-                {
-                    staged.insert(&local.id.sym, expression::option_key(value.unwrap_parens()));
-                }
-            }
-        }
         if let Some(write) = sampled(statement, &parameters) {
             writes.push(write);
             continue;
         }
+        if let Stmt::Decl(Decl::Var(declaration)) = statement {
+            staged.extend(declaration.decls.iter().filter_map(|declarator| {
+                let local = &*declarator.name.as_ident()?.id.sym;
+                Some((local, expression::option_key(declarator.init.as_deref()?)?))
+            }));
+            continue;
+        }
         let Some(assignment) = expression::assignment(statement) else {
             continue;
         };
-        let assigned =
-            (assignment.op == AssignOp::Assign).then_some(assignment.right.unwrap_parens());
-        if let AssignTarget::Simple(SimpleAssignTarget::Ident(local)) = &assignment.left {
-            staged.insert(&local.id.sym, assigned.and_then(expression::option_key));
+        if let AssignTarget::Simple(SimpleAssignTarget::Ident(local)) = &assignment.left
+            && let Some(option) = expression::option_key(&assignment.right)
+        {
+            staged.push((&local.id.sym, option));
             continue;
         }
         let Some(option) = expression::option_assignment(&assignment.left).map(str::to_owned)
         else {
             continue;
         };
-        let (mut value, default) =
-            assigned.map_or((Written::Other, None), |value| read(value, &parameters));
-        if let (Written::Other, Some(Expr::Ident(ident))) = (&value, assigned)
-            && let Some(Some(from)) = staged.get(&*ident.sym)
+        let (mut value, default) = read(&assignment.right, &parameters);
+        if let (Written::Other, Expr::Ident(ident)) = (&value, &*assignment.right)
+            && let Some((_, from)) = staged.iter().rfind(|(local, _)| *local == &*ident.sym)
         {
             value = Written::Copied((*from).to_owned());
         }
@@ -476,78 +470,29 @@ mod tests {
         }
     }
 
+    /// Stored state may override an option copied through a local. Some builds declare the local
+    /// with its value; others assign it separately.
     #[test]
-    fn copies_bootstrap_values_staged_by_a_declaration_or_assignment() {
-        for initial in [
-            "var saved = e._cf_chl_opt.seed;",
-            "let saved = e._cf_chl_opt.seed;",
-            "const saved = e._cf_chl_opt.seed;",
-            "var unused, saved = (e._cf_chl_opt.seed);",
-            "saved = e._cf_chl_opt.seed;",
-            "saved = (e._cf_chl_opt.seed);",
-            "var saved = e._cf_chl_opt.other; saved = e._cf_chl_opt.seed;",
-            "saved = e._cf_chl_opt.other; var saved = e._cf_chl_opt.seed;",
-            "var saved = e._cf_chl_opt.seed; var saved;",
+    fn recovers_options_copied_through_locals() {
+        for staging in [
+            "var z8 = e._cf_chl_opt.qBdzw2;",
+            "z8 = e._cf_chl_opt.qBdzw2;",
         ] {
             let source = SOURCE.replace(
                 "e._cf_chl_opt.WbdgY0 = z2;",
                 &format!(
-                    r#"
-                {initial}
-                try {{
-                    var cached = localStorage.getItem("visitor");
-                    if (cached) {{ saved = cached; }}
-                }} catch (error) {{}}
-                e._cf_chl_opt.WbdgY0 = (saved);
-            "#
+                    "{staging} try {{ z8 = localStorage.getItem(`u`) || z8; }} catch (z9) {{}} e._cf_chl_opt.WbdgY0 = z8;"
                 ),
             );
-            let mapping = Mapping::from_javascript(&source).unwrap();
-            let entry = mapping
-                .0
-                .iter()
-                .find(|entry| entry.option == "WbdgY0")
-                .unwrap();
-            assert_eq!(
-                entry.source,
-                OptionSource::Copied("seed".into()),
-                "{initial}"
-            );
-            let mut options = Options::from_iter([("seed".into(), json!("synthetic-visitor"))]);
+            let mapping = Mapping::from_javascript(&source).expect("modified source parses");
+            let copied = OptionSource::Copied("qBdzw2".into());
             assert!(
                 mapping
-                    .merge(&mut options, &json!({}), "https://example.com", 1)
-                    .is_empty()
-            );
-            assert_eq!(options["WbdgY0"], json!("synthetic-visitor"));
-        }
-    }
-
-    #[test]
-    fn does_not_reuse_copies_after_overwrites_or_compound_assignments() {
-        for body in [
-            "saved = undefined; e._cf_chl_opt.WbdgY0 = saved;",
-            "var saved = undefined; e._cf_chl_opt.WbdgY0 = saved;",
-            "saved += e._cf_chl_opt.other; e._cf_chl_opt.WbdgY0 = saved;",
-            "e._cf_chl_opt.WbdgY0 += saved;",
-        ] {
-            let source = SOURCE.replace(
-                "e._cf_chl_opt.WbdgY0 = z2;",
-                &format!("var saved = e._cf_chl_opt.seed; {body}"),
-            );
-            let mapping = Mapping::from_javascript(&source).unwrap();
-            assert_eq!(
-                mapping.0.last().unwrap().source,
-                OptionSource::Runtime,
-                "{body}"
-            );
-            let mut options = Options::from_iter([("seed".into(), json!("synthetic-visitor"))]);
-            assert_eq!(
-                mapping.merge(&mut options, &json!({}), "https://example.com", 1),
-                ["WbdgY0"],
-                "{body}",
+                    .0
+                    .iter()
+                    .any(|entry| entry.option == "WbdgY0" && entry.source == copied),
+                "WbdgY0 is not copied from qBdzw2 after {staging}"
             );
-            assert!(!options.contains_key("WbdgY0"), "{body}");
         }
     }
 

data/vendor/cfsolve/src/stage2/probes/worker_fetch.rs

@@ -7,7 +7,6 @@ use url::Url;
 use crate::js::{self, JsObject, Options, json};
 use crate::stage2::analysis::recognize::ProbeView;
 use crate::stage2::reference;
-use crate::{candidates, listing};
 
 pub(crate) const OUTPUTS: [&str; 2] = [
     reference::WORKER_FETCH_STATUS,
@@ -16,11 +15,14 @@ pub(crate) const OUTPUTS: [&str; 2] = [
 
 /// The response header whose value the probe reports as its token.
 const HEADER: &str = "cf-chl-peek";
-/// The worker endpoint's protocol path. The host comes from the current program:
-/// Cloudflare rotates it independently of the iframe's host.
+/// Explicit host and path prefix for the worker fetch. Builds may store them as one string or two.
+/// The host's first label varies by region, such as `brunhild` or `hagen`.
+/// [`super::platform::url`] builds URLs relative to the iframe instead.
+const HOST_SUFFIX: &str = ".challenges.cloudflare.com";
 const PATH: &str = "/cdn-cgi/challenge-platform/h/";
 
-/// The worker's host and session options naming its platform segment, ray and nonce.
+/// The fetched host and the session's options naming the request path's platform segment, ray
+/// and nonce.
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct Fields {
     pub host: String,
@@ -90,154 +92,44 @@ pub(crate) fn recognize(probe: &ProbeView<'_>) -> Option<Fields> {
         "omit",
         "no-store",
     ];
-    if !(strings.stores_all(&OUTPUTS) && strings.has_all(&markers)) {
-        return None;
-    }
-    Some(Fields {
-        host: request_host(probe.session_features, probe.pool)?,
+    let features = strings.features();
+    let host = features.iter().find_map(|text| host(text))?;
+    let path = features.iter().any(|text| text.contains(PATH));
+    (strings.stores_all(&OUTPUTS) && strings.has_all(&markers) && path).then(|| Fields {
+        host: host.to_owned(),
         platform_property: probe.session_name(reference::PLATFORM_OPTION),
         ray_property: probe.session_name(reference::RAY_OPTION),
         nonce_property: probe.session_name(reference::NONCE_OPTION),
     })
 }
 
-/// Recovers a unique endpoint from a complete URL or adjacent scheme, host and path
-/// fragments. Malformed descriptors remain in place so they cannot join unrelated fragments.
-fn request_host(features: &[String], pool: &str) -> Option<String> {
-    let strings: Vec<String> = features
-        .iter()
-        .map(|text| {
-            if text.starts_with('\0') || text.starts_with("ÿÿ") {
-                listing::decode_string(text, pool).unwrap_or_else(|_| text.clone())
-            } else {
-                text.clone()
-            }
-        })
-        .collect();
-    let hosts = strings.iter().enumerate().filter_map(|(start, text)| {
-        if !text.starts_with("https://") {
-            return None;
-        }
-        let mut candidate = String::new();
-        strings[start..].iter().take(3).find_map(|part| {
-            candidate.push_str(part);
-            let url = Url::parse(&candidate).ok()?;
-            let host = url.host_str()?;
-            // Require the bare HTTPS endpoint, without credentials or extra URL components.
-            (host.ends_with(".challenges.cloudflare.com")
-                && url.as_str() == format!("https://{host}{PATH}"))
-            .then(|| host.to_owned())
-        })
-    });
-    candidates::at_most_one_distinct(hosts, "worker fetch host").ok()?
+/// Finds the challenge host in `text`, which may be a full URL or a host after a length prefix.
+fn host(text: &str) -> Option<&str> {
+    let suffix = text.find(HOST_SUFFIX)?;
+    let start = text[..suffix]
+        .rfind(|c: char| !(c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-'))
+        .map_or(0, |index| index + 1);
+    (start < suffix).then(|| &text[start..suffix + HOST_SUFFIX.len()])
 }
 
 #[cfg(test)]
 mod tests {
-    use std::collections::BTreeSet;
-
-    use super::*;
-    use crate::listing::Index;
-    use crate::stage2::analysis::recognize::Strings;
-    use crate::stage2::records::WriteOrder;
-    use crate::stage2::registry::Kind;
-    use crate::stage2::vocabulary::Vocabulary;
-    use crate::vm::Listing;
-
-    fn strings(parts: &[&str]) -> Vec<String> {
-        parts.iter().map(|part| (*part).to_owned()).collect()
-    }
-
-    #[test]
-    fn reads_current_hosts_from_complete_split_and_encoded_urls() {
-        for host in ["brunhild", "hagen", "future-worker"] {
-            let host = format!("{host}.challenges.cloudflare.com");
-            let full = format!("https://{host}{PATH}");
-            let encoded = format!("\0{}{host}\0padding", char::from(host.len() as u8));
-            for features in [
-                strings(&[&full]),
-                strings(&[&full, &full]),
-                strings(&["https://", &host, PATH]),
-                strings(&["https://", &format!("{host}{PATH}")]),
-                strings(&["https://", &encoded, PATH]),
-                strings(&[&format!("https://{host}"), PATH]),
-            ] {
-                assert_eq!(request_host(&features, ""), Some(host.clone()));
-            }
-        }
-    }
-
-    #[test]
-    fn recognizes_the_session_host_without_rewriting_it_to_the_reference() {
-        let reference = &reference::REFERENCE.probes[Kind::WorkerFetch.references()[0] - 1];
-        let session: Vec<String> = reference
-            .iter()
-            .map(|text| text.replace("brunhild.", "current-worker."))
-            .collect();
-        let listing = Listing::default();
-        let index = Index::new(&listing);
-        let vocabulary = Vocabulary::infer(&[&session]);
-        let empty = BTreeSet::new();
-        let outputs = OUTPUTS.map(str::to_owned).into_iter().collect();
-        let fields = recognize(&ProbeView {
-            index: &index,
-            vocabulary: &vocabulary,
-            position: 0,
-            header: &empty,
-            wrapper: &empty,
-            pool: "",
-            entry: 0,
-            session_features: &session,
-            writes: &WriteOrder::default(),
-            strings: Strings::new(reference, &outputs),
-        })
-        .unwrap();
-        assert_eq!(fields.host, "current-worker.challenges.cloudflare.com");
-    }
-
-    #[test]
-    fn reads_pooled_hosts_and_builds_the_current_request() {
-        let host = "hagen.challenges.cloudflare.com";
-        let pool = format!("\0\0{host}");
-        let descriptor = format!("ÿÿ\0\0\0\0\0\0\0\0\0{}", char::from(host.len() as u8));
-        let host = request_host(&strings(&["https://", &descriptor, PATH]), &pool).unwrap();
-        let fields = Fields {
-            host,
-            platform_property: "platform".into(),
-            ray_property: "ray".into(),
-            nonce_property: "nonce".into(),
-        };
-        let options =
-            serde_json::from_str(r#"{"platform":"g","ray":"fresh-ray","nonce":"fresh-nonce"}"#)
-                .unwrap();
-        assert_eq!(
-            fields.url(&options).unwrap().as_str(),
-            "https://hagen.challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/fresh-ray/fresh-nonce"
-        );
-    }
+    use super::host;
 
     #[test]
-    fn rejects_missing_ambiguous_and_unrelated_endpoints() {
-        for parts in [
-            vec![],
-            vec!["http://hagen.challenges.cloudflare.com/cdn-cgi/challenge-platform/h/"],
-            vec!["https://hagen.challenges.cloudflare.com/other/"],
-            vec![
-                "https://hagen.challenges.cloudflare.com.evil.example/cdn-cgi/challenge-platform/h/",
-            ],
-            vec!["https://user@hagen.challenges.cloudflare.com/cdn-cgi/challenge-platform/h/"],
-            vec!["https://hagen.challenges.cloudflare.com:8443/cdn-cgi/challenge-platform/h/"],
-            vec!["https://", "\0", PATH],
-            vec!["https://hagen.challenges.cloudflare.com", "\0", PATH],
-            vec!["https://hagen.challenges.cloudflare.com", "ÿÿ\0", PATH],
-            vec!["https://hagen.challenges.cloudflare.com/cdn-cgi/challenge-platform/h/?extra"],
-            vec!["https://hagen.challenges.cloudflare.com/cdn-cgi/challenge-platform/h/#extra"],
-            vec![
-                "https://hagen.challenges.cloudflare.com/cdn-cgi/challenge-platform/h/",
+    fn finds_regional_hosts_in_urls_and_prefixed_strings() {
+        for (text, expected) in [
+            (
                 "https://brunhild.challenges.cloudflare.com/cdn-cgi/challenge-platform/h/",
-            ],
+                Some("brunhild.challenges.cloudflare.com"),
+            ),
+            (
+                "\0\u{1f}hagen.challenges.cloudflare.com\0\0",
+                Some("hagen.challenges.cloudflare.com"),
+            ),
+            ("https://.challenges.cloudflare.com", None),
         ] {
-            assert_eq!(request_host(&strings(&parts), ""), None, "{parts:?}");
+            assert_eq!(host(text), expected, "{text:?}");
         }
     }
 }

data/vendor/cfsolve/src/stage2/vocabulary.rs

@@ -484,6 +484,11 @@ fn best_partners<'a>(
     best.into_values().map(|(pair, _)| pair).collect()
 }
 
+/// The lowest similarity that pairs two probes. Below it, probes share mostly common wrapper
+/// strings: unrelated probes score at most 0.2. The devtools probe scores only about 0.5 against
+/// its reference, and drops to 0.49 in programs that never name `document`.
+const MIN_PAIR_SIMILARITY: f64 = 0.35;
+
 /// Pairs probes by descending Jaccard similarity of stable strings, using each reference probe
 /// at most once. Also retains each session probe's closest reference match regardless of
 /// pairing.
@@ -520,8 +525,7 @@ fn pair_probes<S: AsRef<[String]>>(
     let mut used = HashSet::new();
     let mut pairs = vec![None; session.len()];
     for (index, candidate) in pairings {
-        // Below this threshold, probes share mostly common wrapper strings.
-        if candidate.similarity < 0.5 {
+        if candidate.similarity < MIN_PAIR_SIMILARITY {
             break;
         }
         if pairs[index].is_none() && used.insert(candidate.reference) {
@@ -901,6 +905,24 @@ mod tests {
         }
     }
 
+    /// A probe that shares only three of seven stable strings with its reference still pairs,
+    /// as the devtools probe must when a program never names `document`.
+    #[test]
+    fn pairs_a_probe_below_half_similarity() {
+        let session = [
+            strings("debug stack console"),
+            strings("fetch then"),
+            strings("now floor"),
+        ];
+        let reference = [
+            strings("debug stack console document create remove append"),
+            strings("fetch then"),
+            strings("now floor"),
+        ];
+        let (pairs, _) = pair_probes(&session, &reference);
+        assert_eq!(pairs, [Some(1), Some(2), Some(3)]);
+    }
+
     #[test]
     fn prefers_a_probes_own_pairs_over_the_global_map() {
         // The reference reuses one name where the session has two.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfsolve
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Oliver Morgan