cfsolve 0.1.1 → 0.1.2

data/vendor/cfsolve/src/listing/query.rs

@@ -1,8 +1,9 @@
 //! Queries value sources, function reachability, and common program reads such as `Date.now()`,
 //! challenge options, and record timestamps.
 //!
-//! [`Index::assignment`] finds the nearest earlier instruction assigning a register and
-//! returns its first write, resolving temporaries through the path that computed them.
+//! [`Index::register_before`] finds the nearest earlier instruction assigning a register and
+//! returns the first write from any of its paths. [`Index::assignment`] resolves each write
+//! through its own path, including path-local temporaries.
 
 use std::collections::{BTreeMap, BTreeSet};
 
@@ -10,9 +11,7 @@ use anyhow::{Context, Result, ensure};
 use swc_core::ecma::ast::BinaryOp;
 
 use super::Index;
-use super::fold::{Frame, constant};
 use crate::candidates;
-use crate::js::JsValue;
 use crate::vm::{Constant, Effect, Instruction, Listing, Term};
 
 /// A property write, `object.key = value` or `object[key] = value`. Dynamic keys resolve to the
@@ -56,55 +55,6 @@ pub(crate) fn walk(
 const DEREFERENCE_FUEL: usize = 8;
 
 impl Index<'_> {
-    /// Recovers arrays populated through numeric stores, rejecting holes and conflicting writes.
-    pub(crate) fn string_arrays(&self, entry: u32) -> Vec<Vec<String>> {
-        let mut arrays = BTreeMap::<u32, BTreeMap<usize, String>>::new();
-        let mut invalid = BTreeSet::new();
-        for pc in self.reachable(entry) {
-            let Some(instruction) = self.listing().instructions.get(&pc) else {
-                continue;
-            };
-            for effect in instruction.effects() {
-                let Effect::SetProperty { object, key, value } = effect else {
-                    continue;
-                };
-                let Some((origin, Term::Array(initial))) = self.dereference(pc, object) else {
-                    continue;
-                };
-                if !initial.is_empty() {
-                    continue;
-                }
-                let Some((_, Term::Const(Constant::Number(index)))) = self.dereference(pc, key)
-                else {
-                    invalid.insert(origin);
-                    continue;
-                };
-                let Some(value) = self.text(pc, value) else {
-                    invalid.insert(origin);
-                    continue;
-                };
-                if !index.is_finite() || index < 0.0 || index.fract() != 0.0 {
-                    invalid.insert(origin);
-                    continue;
-                }
-                let array = arrays.entry(origin).or_default();
-                if array
-                    .insert(index as usize, value.clone())
-                    .is_some_and(|old| old != value)
-                {
-                    invalid.insert(origin);
-                }
-            }
-        }
-        arrays
-            .into_iter()
-            .filter(|(origin, array)| {
-                !invalid.contains(origin) && array.keys().copied().eq(0..array.len())
-            })
-            .map(|(_, array)| array.into_values().collect())
-            .collect()
-    }
-
     /// Caches property writes in program-counter order. Resolves dynamic keys through the
     /// nearest earlier register assignment and skips stores whose keys are not known strings.
     #[must_use]
@@ -118,18 +68,22 @@ impl Index<'_> {
                 let Term::Reg(object) = **object else {
                     continue;
                 };
-                let Some(key) = self.text(pc, key) else {
+                let key = match &**key {
+                    Term::Reg(register) => self.register_before(pc, *register),
+                    key => Some(key),
+                };
+                let Some(Term::Const(Constant::String(key))) = key else {
                     continue;
                 };
                 if stores.last().is_some_and(|store: &Store| {
-                    store.pc == pc && store.object == object && store.key == key
+                    store.pc == pc && store.object == object && store.key == *key
                 }) {
                     continue;
                 }
                 stores.push(Store {
                     pc,
                     object,
-                    key,
+                    key: key.clone(),
                     value: (**value).clone(),
                 });
             }
@@ -161,6 +115,18 @@ impl Index<'_> {
         reached
     }
 
+    /// Returns the first write to `register` on any path of the nearest assigning instruction
+    /// before `pc`.
+    fn register_before(&self, pc: u32, register: u8) -> Option<&Term> {
+        let at = self.assigning_before(pc, register)?;
+        self.listing().instructions[&at]
+            .effects()
+            .find_map(|effect| match effect {
+                Effect::Set(target, value) if *target == register => Some(value),
+                _ => None,
+            })
+    }
+
     /// Finds the nearest assignment to `register` before `before`, retaining its program
     /// counter so operands resolve at assignment time. Resolves temporaries only through the
     /// path that computed them; missing path values leave the assignment unknown.
@@ -205,56 +171,10 @@ impl Index<'_> {
     /// The string `term` holds at `pc`.
     #[must_use]
     pub(crate) fn text(&self, pc: u32, term: &Term) -> Option<String> {
-        self.literal(pc, term, 16)?.as_str().map(str::to_owned)
-    }
-
-    /// Resolves the small constant expressions left in an inline string decoder when a
-    /// control-flow join prevents whole-program folding. Every operand must be a literal.
-    fn literal(&self, pc: u32, term: &Term, fuel: usize) -> Option<JsValue> {
-        if fuel == 0 {
-            return None;
+        match self.dereference(pc, term)? {
+            (_, Term::Const(Constant::String(text))) => Some(text),
+            _ => None,
         }
-        let (pc, term) = self.dereference(pc, term)?;
-        let literal = |term: &Term| -> Option<Term> {
-            Some(Term::Const(match self.literal(pc, term, fuel - 1)? {
-                JsValue::String(text) => Constant::String(text),
-                JsValue::Number(number) => Constant::Number(number),
-                JsValue::Bool(value) => Constant::Bool(value),
-                JsValue::Null => Constant::Null,
-                JsValue::Undefined => Constant::Undefined,
-                _ => return None,
-            }))
-        };
-        let resolved = match term {
-            Term::Const(_) => term,
-            Term::Binary(op, left, right) => {
-                Term::Binary(op, Box::new(literal(&left)?), Box::new(literal(&right)?))
-            }
-            Term::Call {
-                callee,
-                this,
-                arguments,
-            } => {
-                let (at, Term::Get(object, method)) = self.dereference(pc, &callee)? else {
-                    return None;
-                };
-                let object = self.literal(at, &object, fuel - 1)?.as_str()?.to_owned();
-                let method = self.literal(at, &method, fuel - 1)?.as_str()?.to_owned();
-                Term::Call {
-                    callee: Box::new(Term::Get(
-                        Box::new(Term::Const(Constant::String(object))),
-                        Box::new(Term::Const(Constant::String(method))),
-                    )),
-                    this: match this {
-                        Some(this) => Some(Box::new(literal(&this)?)),
-                        None => None,
-                    },
-                    arguments: arguments.iter().map(literal).collect::<Option<_>>()?,
-                }
-            }
-            _ => return None,
-        };
-        constant(&Frame::<()>::default(), &resolved)
     }
 
     /// Resolves `term` to an `object[key]` read with a string key.
@@ -356,142 +276,3 @@ impl Index<'_> {
         Ok([started, finished, duration])
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::vm::{Exit, Path};
-
-    fn text(value: &str) -> Term {
-        Term::Const(Constant::String(value.into()))
-    }
-    fn number(value: f64) -> Term {
-        Term::Const(Constant::Number(value))
-    }
-    fn call(object: Term, method: &str, arguments: Vec<Term>) -> Term {
-        Term::Call {
-            callee: Box::new(Term::Get(Box::new(object), Box::new(text(method)))),
-            this: None,
-            arguments,
-        }
-    }
-    fn store(object: u8, key: Term, value: Term) -> Effect {
-        Effect::SetProperty {
-            object: Box::new(Term::Reg(object)),
-            key: Box::new(key),
-            value: Box::new(value),
-        }
-    }
-    fn listing(effects: Vec<Effect>) -> Listing {
-        let count = effects.len();
-        let mut listing = Listing::default();
-        for (pc, effect) in effects.into_iter().enumerate() {
-            listing.instructions.insert(
-                pc as u32,
-                Instruction {
-                    pc: pc as u32,
-                    key: 0,
-                    opcode: 0,
-                    paths: vec![Path {
-                        conditions: vec![],
-                        effects: vec![effect],
-                        exit: if pc + 1 == count {
-                            Exit::Return
-                        } else {
-                            Exit::Next {
-                                pc: pc as u32 + 1,
-                                key: 0,
-                            }
-                        },
-                    }],
-                },
-            );
-        }
-        listing
-    }
-
-    #[test]
-    fn resolves_stored_keys_through_inline_string_decoders() {
-        let listing = listing(vec![
-            Effect::Set(1, text("\0\u{6}Field7padding")),
-            Effect::Set(2, number(2.0)),
-            Effect::Set(3, number(256.0)),
-            Effect::Set(4, call(Term::Reg(1), "charCodeAt", vec![number(0.0)])),
-            Effect::Set(5, call(Term::Reg(1), "charCodeAt", vec![number(1.0)])),
-            Effect::Set(
-                4,
-                Term::Binary(
-                    BinaryOp::Mul,
-                    Box::new(Term::Reg(4)),
-                    Box::new(Term::Reg(3)),
-                ),
-            ),
-            Effect::Set(
-                4,
-                Term::Binary(
-                    BinaryOp::Add,
-                    Box::new(Term::Reg(4)),
-                    Box::new(Term::Reg(5)),
-                ),
-            ),
-            Effect::Set(
-                4,
-                Term::Binary(
-                    BinaryOp::Add,
-                    Box::new(Term::Reg(4)),
-                    Box::new(Term::Reg(2)),
-                ),
-            ),
-            Effect::Set(
-                1,
-                call(Term::Reg(1), "slice", vec![Term::Reg(2), Term::Reg(4)]),
-            ),
-            store(9, Term::Reg(1), number(1.0)),
-            store(
-                9,
-                call(Term::Reg(99), "slice", vec![number(0.0), number(1.0)]),
-                number(2.0),
-            ),
-        ]);
-        let index = Index::new(&listing);
-        assert_eq!(index.stores().len(), 1);
-        assert_eq!(index.stores()[0].key, "Field7");
-    }
-
-    #[test]
-    fn string_methods_use_the_explicit_receiver() {
-        let mut term = call(text("other"), "slice", vec![number(0.0), number(3.0)]);
-        let Term::Call { this, .. } = &mut term else {
-            unreachable!()
-        };
-        *this = Some(Box::new(text("fresh")));
-        let program = listing(vec![]);
-        let index = Index::new(&program);
-        assert_eq!(index.text(0, &term).as_deref(), Some("fre"));
-        let Term::Call { this, .. } = &mut term else {
-            unreachable!()
-        };
-        *this = Some(Box::new(Term::Reg(99)));
-        assert_eq!(index.text(0, &term), None);
-    }
-
-    #[test]
-    fn collects_complete_string_arrays_and_rejects_uncertain_contents() {
-        let listing = listing(vec![
-            Effect::Set(1, Term::Array(vec![])),
-            store(1, number(1.0), text("second")),
-            store(1, number(0.0), text("first")),
-            Effect::Set(2, Term::Array(vec![])),
-            store(2, number(1.0), text("gap")),
-            Effect::Set(3, Term::Array(vec![])),
-            store(3, number(0.0), text("before")),
-            store(3, number(0.0), text("after")),
-            Effect::Set(4, Term::Array(vec![])),
-            store(4, Term::Reg(99), text("unknown index")),
-        ]);
-        assert_eq!(
-            Index::new(&listing).string_arrays(0),
-            [vec!["first", "second"]]
-        );
-    }
-}

data/vendor/cfsolve/src/listing.rs

@@ -7,7 +7,6 @@
 
 pub(crate) mod fold;
 mod index;
-pub(crate) mod normalize;
 pub(crate) mod query;
 mod strings;
 

data/vendor/cfsolve/src/session/initial.rs

@@ -1,6 +1,8 @@
 //! Prepares the first payload: renders the embedding page, fetches and parses the iframe, and
 //! merges page parameters with iframe state.
 
+use std::mem;
+
 use anyhow::{Context, Result};
 use url::Url;
 
@@ -20,6 +22,7 @@ use crate::resource_timing::LoadTiming;
 use crate::script::Source;
 use crate::stage2::call_stack::{self, CaseOpcodes, ScriptPosition};
 use crate::stage2::payload::Environment;
+use crate::stage2::replay::Globals;
 use crate::{deep_stack, performance_clock};
 
 /// Default loader URL for pages that load Turnstile dynamically without a script tag.
@@ -68,6 +71,8 @@ impl Fetched {
 
 /// The evaluated first-payload template, before sender fields, and state for later payloads.
 pub(crate) struct FirstPayload {
+    /// Signatures of the session-named globals the initial program installs.
+    pub audit_globals: Globals,
     /// The extracted program with fully populated request options.
     pub program: ExtractedProgram,
     pub state: ScriptState,
@@ -94,11 +99,11 @@ impl FirstPayload {
         options_artifact: &str,
         complete: impl FnOnce(&mut Options) -> (Option<&'mark str>, i64),
     ) -> Result<Self> {
-        // Keep the extracted facts available to later stages; request state is a separate copy.
-        let installed = &program.installed;
+        let installed = mem::take(&mut program.installed);
+        let audit_globals = Globals::installed(&installed);
         let fields = &program.payload_fields;
         let options = &mut program.request.options;
-        options.extend(installed.options.clone());
+        options.extend(installed.options);
         if let Some(log) = &state.post_log {
             log.start(options);
         }
@@ -110,10 +115,11 @@ impl FirstPayload {
             intervals,
         ));
         sink.json(options_artifact, options)?;
-        let window = installed.window.clone();
+        let window = installed.window;
         let globals = payload::infer_globals(fields, &state, options, &window);
         let plaintext = payload::build(fields, options, &globals)?;
         Ok(Self {
+            audit_globals,
             program,
             state,
             window,
@@ -126,6 +132,7 @@ impl FirstPayload {
 
 /// Iframe state after merging page parameters, shared by the first and later payloads.
 pub(crate) struct Merged {
+    pub audit_globals: Globals,
     /// The first payload, which the probe payload extends.
     pub first: Payload,
     pub state: ScriptState,
@@ -214,7 +221,8 @@ pub(crate) async fn render_page(
         sink,
         rendered,
         script,
-        page.layout.clone(),
+        page.layout
+            .placed(page.layout.embedding_pages.get(document.url.as_str())),
         document.referrer_policy,
         Embedding::Site,
     ))
@@ -386,6 +394,7 @@ pub(crate) fn merge(
     ));
     sink.json("payload.json", &first)?;
     let merged = Merged {
+        audit_globals: built.audit_globals,
         first,
         state: built.state,
         window: built.window,