cfsolve 0.1.1 → 0.1.2

data/vendor/cfsolve/src/stage2/replay.rs

@@ -9,27 +9,26 @@
 //! plus trace membership and navigation sizes in the environment audit. Live requests, fresh
 //! WebRTC state, benchmark results, and stacks are computed separately.
 
-use std::collections::{BTreeMap, BTreeSet, HashSet};
+use std::collections::BTreeMap;
 use std::mem;
 use std::ops::Range;
 
 use anyhow::{Context, Result, ensure};
 use serde::{Deserialize, Serialize};
 
-use super::analysis;
-pub use super::probes::stylesheets::Snapshot as StylesheetSnapshot;
-use super::probes::{stylesheets, worker_navigator};
+pub use super::audit_globals::{Globals, Signature};
+use super::probes::worker_navigator;
 use super::records::{ArrangedFields, Probe, ProbePlan};
 use super::reference::{
     ENVIRONMENT_AUDIT_DECODED, ENVIRONMENT_AUDIT_ENCODED, ENVIRONMENT_AUDIT_GROUPS,
     ENVIRONMENT_AUDIT_REDUCTION, ENVIRONMENT_AUDIT_VALUES, ENVIRONMENT_REFERRER, REFERENCE,
-    WORKER_NAVIGATOR_RESULT,
+    STYLESHEETS_HASH, WORKER_NAVIGATOR_RESULT,
 };
 use super::registry::{AUDIT_PROBE, Kind, Operation, Treatment};
-pub use super::session_names::CapturedNames;
+pub use super::stylesheets::Stylesheet;
 use super::trace::Trace;
-use super::vocabulary::Vocabulary;
-use crate::challenge::installed::Installed;
+use super::vocabulary::{self, Vocabulary};
+use super::{analysis, stylesheets};
 use crate::http::ResponseMetrics;
 use crate::js::{JsObject, JsValue, Options, Payload, json};
 use crate::script::Source;
@@ -43,12 +42,12 @@ pub struct Answers {
     pub probes: BTreeMap<usize, Stored>,
     /// The worker navigator, by API property.
     pub navigator: JsObject,
-    /// Captured source/CSSOM pairs for stylesheet revisions this profile supports.
+    /// Definitions of the captured iframe globals, under the audit's stored names.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub globals: BTreeMap<String, Signature>,
+    /// CSSOM measurements, checked against the current CSS before reuse.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub stylesheets: Vec<StylesheetSnapshot>,
-    /// Source evidence for names that change between sessions.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub names: Option<CapturedNames>,
+    pub stylesheets: Vec<Stylesheet>,
 }
 
 /// One probe's stored record, without its envelope.
@@ -65,17 +64,52 @@ pub struct Stored {
 }
 
 impl Answers {
+    /// Attaches browser CSSOM measurements only after reproducing this capture's reported hash.
+    pub fn measure_stylesheets(
+        &mut self,
+        source: &Source,
+        program: &[u8],
+        html: &str,
+        templates: Vec<Stylesheet>,
+    ) -> Result<()> {
+        let analysis = analysis::analyze(source, program)?;
+        let (probe, excluded) = analysis
+            .plan()
+            .probes()
+            .iter()
+            .find_map(|probe| Some((probe, stylesheets::excluded_selector(probe)?)))
+            .context("the capture has no stylesheet probe")?;
+        let excluded = excluded?;
+        let partner = analysis
+            .plan()
+            .vocabulary()
+            .partner(probe.position())
+            .context("the stylesheet probe has no reference partner")?;
+        let stored = self
+            .probes
+            .get(&partner)
+            .context("no stored stylesheet answer")?;
+        let mut fields = JsObject::new();
+        stylesheets::patch(html, &templates, excluded, &mut fields)?;
+        ensure!(
+            fields.get(STYLESHEETS_HASH) == stored.fields.get(STYLESHEETS_HASH),
+            "CSSOM measurements do not reproduce the captured stylesheet hash"
+        );
+        self.stylesheets = templates;
+        Ok(())
+    }
+
     /// Builds stored answers from a captured iframe script, probe program, and second payload.
     pub fn capture(source: &Source, program: &[u8], payload: &Payload) -> Result<Self> {
         let analysis = analysis::analyze(source, program)?;
         let plan = analysis.plan();
         let vocabulary = plan.vocabulary();
+        let globals = Globals::capture(source)?;
         let envelope = &plan.record_fields;
         let envelope_names = envelope.names();
         let is_envelope = |name: &String| envelope_names.contains(&name.as_str());
         let mut answers = Self {
             reference: REFERENCE.digest.clone(),
-            names: Some(CapturedNames::capture(source, plan)?),
             ..Self::default()
         };
         for probe in plan.probes() {
@@ -125,6 +159,10 @@ impl Answers {
             vocabulary.rewrite_to_reference(position, &mut fields);
             // Replay refreshes an audit's navigation sizes and trace by reference name.
             if operation.family() == Kind::EnvironmentAudit {
+                for (name, signature) in &globals.0 {
+                    let name = vocabulary.to_reference(position, name).to_owned();
+                    answers.globals.insert(name, signature.clone());
+                }
                 ensure!(
                     fields.contains_key(ENVIRONMENT_AUDIT_GROUPS)
                         && fields.contains_key(ENVIRONMENT_AUDIT_VALUES),
@@ -158,144 +196,33 @@ impl Answers {
 /// Stored answers matched to one session's probes.
 pub struct Replay<'answers> {
     answers: &'answers Answers,
-    vocabulary: Vocabulary,
-    refresh: Option<super::session_names::Refresh>,
-    plan: &'answers ProbePlan,
+    vocabulary: &'answers Vocabulary,
 }
 
 impl<'answers> Replay<'answers> {
-    /// Matches and validates stored answers, preparing names for the current program.
-    pub fn new(
-        answers: &'answers Answers,
-        plan: &'answers ProbePlan,
-        source: &Source,
-        installed: &Installed,
-    ) -> Result<Self> {
-        answers.check()?;
-        let mut vocabulary = plan.vocabulary().clone();
-        let mut common: HashSet<&str> = plan
-            .probes()
-            .first()
-            .into_iter()
-            .flat_map(|probe| probe.features.iter().map(String::as_str))
-            .collect();
-        for probe in plan.probes() {
-            common.retain(|name| probe.features.iter().any(|text| text == name));
-        }
-        for probe in plan.probes() {
-            if let Some(partner) = vocabulary.partner(probe.position())
-                && let Some(stored) = answers.probes.get(&partner)
-            {
-                let wanted: Vec<String> = stored.fields.keys().cloned().collect();
-                vocabulary.refine_outputs(
-                    probe.position(),
-                    &probe.features,
-                    &probe.writes.fields,
-                    &probe.writes.internal,
-                    &common,
-                    &wanted,
-                );
-            }
-        }
-        let refresh = answers
-            .names
-            .as_ref()
-            .map(|names| super::session_names::Refresh::new(names, source, plan, installed))
-            .transpose()?;
-        let replay = Self {
+    /// Matches `answers` to `plan`'s probes using the plan's vocabulary.
+    #[must_use]
+    pub fn new(answers: &'answers Answers, plan: &'answers ProbePlan) -> Self {
+        Self {
             answers,
-            vocabulary,
-            refresh,
-            plan,
-        };
-        replay.validate()?;
-        Ok(replay)
-    }
-
-    fn validate(&self) -> Result<()> {
-        let mut failures = Vec::new();
-        for probe in self.plan.probes() {
-            let Some(partner) = self.vocabulary.partner(probe.position()) else {
-                continue;
-            };
-            let Some(stored) = self.answers.probes.get(&partner) else {
-                continue;
-            };
-            if probe.writes.fields.is_empty() {
-                continue;
-            }
-            let missing: Vec<&String> =
-                stored
-                    .fields
-                    .keys()
-                    .filter(|name| {
-                        !probe.writes.fields.iter().any(|field| {
-                            field == self.vocabulary.to_session(probe.position(), name)
-                        })
-                    })
-                    .collect();
-            if !missing.is_empty() {
-                failures.push(format!("probe {}: {:?}", probe.index, missing));
-            }
-            if probe
-                .expanded_features
-                .iter()
-                .any(|name| super::vocabulary::hashed_name(name))
-            {
-                let mut names = BTreeSet::new();
-                fn collect<'a>(value: &'a JsValue, names: &mut BTreeSet<&'a str>) {
-                    match value {
-                        JsValue::String(text) => {
-                            names.insert(text);
-                        }
-                        JsValue::Object(object) => {
-                            for (key, value) in object {
-                                names.insert(key);
-                                collect(value, names);
-                            }
-                        }
-                        JsValue::Array(array) => {
-                            for value in array {
-                                collect(value, names);
-                            }
-                        }
-                        _ => {}
-                    }
-                }
-                for (key, value) in &stored.fields {
-                    names.insert(key.as_str());
-                    collect(value, &mut names);
-                }
-                let reference = &super::reference::EXPANDED_REFERENCE.probes[partner - 1];
-                names.retain(|name| {
-                    super::vocabulary::is_name(name)
-                        && reference.iter().any(|text| text == name)
-                        && !probe.expanded_features.iter().any(|text| text == name)
-                        && self.vocabulary.to_session(probe.position(), name) == *name
-                });
-                if !names.is_empty() {
-                    failures.push(format!("probe {} nested values: {:?}", probe.index, names));
-                }
-            }
+            vocabulary: plan.vocabulary(),
         }
-        ensure!(
-            failures.is_empty(),
-            "unmapped stored result fields: {}",
-            failures.join("; ")
-        );
-        Ok(())
     }
 
     /// Finds environment-audit groups that report window dimensions and position.
     #[must_use]
-    pub fn audit_groups<'r>(&self, records: &'r JsObject) -> Option<&'r JsObject> {
-        let position = (0..self.plan.probes().len())
+    pub fn audit_groups<'r>(
+        &self,
+        plan: &ProbePlan,
+        records: &'r JsObject,
+    ) -> Option<&'r JsObject> {
+        let position = (0..plan.probes().len())
             .find(|&position| self.vocabulary.partner(position) == Some(AUDIT_PROBE))?;
         let groups = self
             .vocabulary
             .to_session(position, ENVIRONMENT_AUDIT_GROUPS);
         records
-            .get(&self.plan.probes()[position].index.to_string())?
+            .get(&plan.probes()[position].index.to_string())?
             .get(groups)?
             .as_object()
     }
@@ -330,33 +257,20 @@ impl<'answers> Replay<'answers> {
         let partner = self.vocabulary.partner(position).with_context(missing)?;
         let stored = self.answers.probes.get(&partner).with_context(missing)?;
         let mut fields = stored.fields.clone();
-        session.patch(probe, &mut fields)?;
-        if Kind::Stylesheets.references().contains(&partner) && !self.answers.stylesheets.is_empty()
+        let measured = &self.answers.stylesheets;
+        if !measured.is_empty()
+            && let Some(excluded) = stylesheets::excluded_selector(probe)
         {
-            stylesheets::refresh(
-                &self.answers.stylesheets,
-                probe,
-                session.iframe_html,
-                &mut fields,
-            )?;
-        }
-        // Profiles without source evidence retain the original trace-only refresh.
-        if self.refresh.is_none()
-            && let Some(groups) = fields
-                .get_mut(ENVIRONMENT_AUDIT_GROUPS)
-                .and_then(JsValue::as_object_mut)
-        {
-            let trace = session
-                .trace
-                .as_ref()
-                .context("the environment audit needs the iframe's trace")?;
-            refresh_trace(trace, groups, &probe.features, session.controller)?;
+            stylesheets::patch(session.iframe_html, measured, excluded?, &mut fields)?;
         }
+        session.patch(probe, &mut fields, &self.answers.globals)?;
         let mut arranged = ArrangedFields::split(fields, &stored.late);
         for fields in [&mut arranged.early, &mut arranged.late] {
             self.vocabulary.rewrite_to_session(position, fields);
-            if let Some(refresh) = &self.refresh {
-                refresh.apply(probe, &self.vocabulary, fields)?;
+            for (name, value) in &probe.replay_literals {
+                if let Some(field) = fields.get_mut(name) {
+                    *field = value.clone();
+                }
             }
         }
         Ok(arranged)
@@ -365,10 +279,10 @@ impl<'answers> Replay<'answers> {
 
 /// Current-session values needed to refresh stored records.
 pub struct Session<'session> {
+    /// Current iframe HTML, including its inline styles.
+    pub iframe_html: &'session str,
     /// The iframe's URL, which records report as the referrer, base URI and stack locations.
     pub iframe_url: &'session str,
-    /// Current iframe stylesheets, used to refresh captured CSSOM measurements.
-    pub iframe_html: &'session str,
     /// `document.lastModified`, as the browser formats it.
     pub modified: String,
     /// Iframe `document.referrer`, set by the embedding page's policy or empty when absent.
@@ -381,18 +295,36 @@ pub struct Session<'session> {
     pub trace: Option<Trace>,
     /// The returned program's own trace frame.
     pub controller: Option<&'session str>,
+    /// Definitions in the current iframe, used to translate audited globals.
+    pub globals: &'session Globals,
 }
 
 impl Session<'_> {
     /// Patches a stored record while it still uses reference names: document identity, the
-    /// referrer, and the environment audit's navigation measurements.
-    fn patch(&self, probe: &Probe, fields: &mut JsObject) -> Result<()> {
+    /// referrer, and the environment audit's trace membership and navigation measurements.
+    fn patch(
+        &self,
+        probe: &Probe,
+        fields: &mut JsObject,
+        recorded: &BTreeMap<String, Signature>,
+    ) -> Result<()> {
         for value in fields.values_mut() {
             refresh_transplant(value, self.iframe_url, &self.modified);
         }
         if let Some(referrer) = fields.get_mut(ENVIRONMENT_REFERRER) {
             *referrer = json!(self.referrer);
         }
+        if let Some(groups) = fields
+            .get_mut(ENVIRONMENT_AUDIT_GROUPS)
+            .and_then(JsValue::as_object_mut)
+        {
+            let trace = self
+                .trace
+                .as_ref()
+                .context("the environment audit needs the iframe's trace")?;
+            refresh_globals(groups, &self.globals.mapping(recorded), self.globals);
+            refresh_trace(trace, groups, &probe.features, self.controller)?;
+        }
         if let Some(values) = fields
             .get_mut(ENVIRONMENT_AUDIT_VALUES)
             .and_then(JsValue::as_object_mut)
@@ -497,28 +429,47 @@ fn refresh_string(text: &mut String, iframe_url: &str, modified: &str) {
     }
 }
 
-/// Moves the trace global to the audit group matching this session's trace frames. Uses the
+/// Substitutes this session's globals and removes unmatched names and their empty groups.
+fn refresh_globals(groups: &mut JsObject, mapping: &BTreeMap<String, String>, globals: &Globals) {
+    for (key, members) in mem::take(groups) {
+        let JsValue::Array(members) = members else {
+            groups.insert(key, members);
+            continue;
+        };
+        if members.is_empty() {
+            group(groups, key);
+            continue;
+        }
+        for member in members {
+            let global = member
+                .as_str()
+                .and_then(|name| name.strip_prefix("o."))
+                .filter(|name| vocabulary::is_hex_name(name));
+            let Some(global) = global else {
+                group(groups, key.clone()).push(member);
+                continue;
+            };
+            let Some(current) = mapping.get(global) else {
+                continue;
+            };
+            let current_key = globals.0.get(current).and_then(Signature::audit_value);
+            let current_key = current_key.unwrap_or(&key).to_owned();
+            group(groups, current_key).push(json!(format!("o.{current}")));
+        }
+    }
+}
+
+/// Places this session's trace global in the audit group matching its trace frames. Uses the
 /// recovered controller frame as the second root, or the iframe callback frame if none was
 /// recovered.
-pub(crate) fn refresh_trace(
+fn refresh_trace(
     trace: &Trace,
     groups: &mut JsObject,
     features: &[String],
     controller: Option<&str>,
 ) -> Result<()> {
     let member = JsValue::String(format!("o.{}", trace.global));
-    let traced =
-        |names: &JsValue| matches!(names, JsValue::Array(names) if names.contains(&member));
-    if !groups.values().any(traced) {
-        return Ok(());
-    }
-    let entered = features
-        .windows(2)
-        .find(|pair| pair[1] == trace.replace)
-        .map(|pair| pair[0].as_str())
-        .context("environment audit has no session trace entry")?;
-    let second = controller.unwrap_or(&trace.returned_root);
-    let key = format!("{},{},{}", trace.initial_root, second, entered);
+    let key = trace.audit_key(features, controller)?;
     for (old_key, mut names) in mem::take(groups) {
         let members = names
             .as_array_mut()
@@ -532,6 +483,11 @@ pub(crate) fn refresh_trace(
             group(groups, key.clone()).push(member.clone());
         }
     }
+    // Recorded answers name another session's trace global, which is dropped beforehand.
+    let traced = group(groups, key);
+    if !traced.contains(&member) {
+        traced.push(member);
+    }
     Ok(())
 }
 
@@ -578,93 +534,55 @@ fn refresh_transplant(value: &mut JsValue, iframe_url: &str, modified: &str) {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::challenge::installed::Installed;
     use crate::js;
 
     #[test]
-    fn stylesheet_refresh_preserves_field_order_and_late_callbacks() {
-        use super::super::reference::{STYLESHEET_DIGEST, STYLESHEET_MARKER};
-        let probes: Vec<_> = REFERENCE.probes.iter().enumerate().map(|(position, features)| {
-            json!({"index":position + 1, "token":"test", "input":{}, "features":features})
-        }).collect();
-        let mut plan: ProbePlan = js::from_value(json!({
-            "record_fields":{"counter":"counter", "token":"token", "input":"input",
-                "status":"status", "message":"message", "started":"started",
-                "finished":"finished", "duration":"duration"},
-            "payload":{"template":{"fields":{}}, "published":[], "footer":{}, "pending":null},
-            "probes":probes
+    fn audit_globals_keep_their_groups_under_current_names() {
+        let mut groups: JsObject = js::from_value(json!({
+            "N": ["o._111111111111111111111111", "o.alert"],
+            "o": ["o._222222222222222222222222"],
+            "empty": []
         }))
         .unwrap();
-        let position = Kind::Stylesheets.references()[0] - 1;
-        // The embedded reference already contains its marker; use that selector in both revisions.
-        let marker = plan.probes[position]
-            .features
-            .iter()
-            .find(|text| text.starts_with('.'))
-            .unwrap()
-            .clone();
-        let html = format!("<style>.Abcd1{{color:red}}</style><style>{marker}{{margin:0}}</style>");
-        let snapshot = StylesheetSnapshot::capture(
-            &html,
-            vec![
-                vec![".Abcd1 { color: red; }".into()],
-                vec![format!("{marker} {{ margin: 0px; }}")],
-            ],
-        )
-        .unwrap();
-        let fields = JsObject::from_iter([
-            ("unchanged".into(), json!(true)),
-            (STYLESHEET_DIGEST.into(), json!("stale")),
-            (STYLESHEET_MARKER.into(), json!("stale")),
-        ]);
-        plan.probes[position].writes.fields = fields.keys().cloned().collect();
-        let mut answers = Answers {
-            reference: REFERENCE.digest.clone(),
-            probes: BTreeMap::from([(
-                position + 1,
-                Stored {
-                    duration: None,
-                    fields,
-                    late: vec![STYLESHEET_MARKER.into()],
-                },
+        refresh_globals(
+            &mut groups,
+            &BTreeMap::from([(
+                "_111111111111111111111111".into(),
+                "_aaaaaaaaaaaaaaaaaaaaaaaa".into(),
             )]),
-            stylesheets: vec![snapshot],
-            ..Answers::default()
-        };
-        let source = Source::try_new("var root = this || self;").unwrap();
-        let installed = Installed::default();
-        let replay = Replay::new(&answers, &plan, &source, &installed).unwrap();
-        let navigation = ResponseMetrics::default();
-        let options = Options::new();
-        let mut session = Session {
-            iframe_url: CURRENT,
-            iframe_html: &html,
-            modified: "01/01/2000 00:00:00".into(),
-            referrer: "https://example.com/",
-            navigation: &navigation,
-            options: &options,
-            trace: None,
-            controller: None,
-        };
-        let result = replay.answer(&plan.probes[position], &session).unwrap();
-        assert_eq!(
-            result.early.keys().map(String::as_str).collect::<Vec<_>>(),
-            ["unchanged", STYLESHEET_DIGEST]
+            &Globals::default(),
         );
-        assert_eq!(result.late.len(), 1);
         assert_eq!(
-            result.late[STYLESHEET_MARKER],
-            json!(format!("{marker} {{ margin: 0px; }}1"))
+            json!(groups),
+            json!({
+                "N": ["o._aaaaaaaaaaaaaaaaaaaaaaaa", "o.alert"], "empty": []
+            })
         );
-        assert_ne!(result.early[STYLESHEET_DIGEST], json!("stale"));
+    }
+
+    #[test]
+    fn installed_globals_refresh_their_values_and_split_shared_groups() {
+        let installed = |name: &str, value: &str| {
+            Globals::installed(&Installed {
+                audit: BTreeMap::from([(name.into(), value.into())]),
+                ..Default::default()
+            })
+        };
+        let globals = installed("_aaaaaaaaaaaaaaaaaaaaaaaa", "_bbbbbbbbbbbbbbbbbbbbbbbb");
+        let recorded = installed("_111111111111111111111111", "_222222222222222222222222");
+        let mut groups: JsObject = js::from_value(json!({
+            "_222222222222222222222222": ["o._111111111111111111111111", "other"]
+        }))
+        .unwrap();
+        refresh_globals(&mut groups, &globals.mapping(&recorded.0), &globals);
         assert_eq!(
-            answers.probes[&(position + 1)].fields[STYLESHEET_DIGEST],
-            json!("stale")
+            json!(groups),
+            json!({
+                "_bbbbbbbbbbbbbbbbbbbbbbbb": ["o._aaaaaaaaaaaaaaaaaaaaaaaa"],
+                "_222222222222222222222222": ["other"]
+            })
         );
-        session.iframe_html = "<style>changed{color:blue}</style>";
-        assert!(replay.answer(&plan.probes[position], &session).is_err());
-        drop(replay);
-        answers.reference = "wrong-reference".into();
-        assert!(Replay::new(&answers, &plan, &source, &installed).is_err());
     }
 
     #[test]
@@ -697,6 +615,16 @@ mod tests {
             r#"{"old-root,old-response,old-probe":["other"],"fresh-root,controller-frame,fresh-probe":["o.trace"],"T":["enabled"],"empty":[]}"#
         );
         assert!(refreshed(&[], None).is_err());
+        let packed = [
+            "_111111111111111111111111".into(),
+            "replaceTrace".into(),
+            "fresh-probe$frame".into(),
+        ];
+        assert!(
+            refreshed(&packed, None)
+                .unwrap()
+                .contains("fresh-response,fresh-probe$frame")
+        );
     }
 
     const CURRENT: &str = "https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/av0/rch/y3vzw/0x4AAAAAAB8gDxRzm2UASWbL/light/fbE/new/normal?lang=auto";