cfsolve 0.1.1 → 0.1.2

data/lib/cfsolve/profiles/safari-26-ios.json

@@ -378,14 +378,6 @@
               {
                 "candidate": "candidate:3747697418 1 udp 2113937151 f9501b39-1d57-4eb6-8029-16167a5a330b.local 51498 typ host generation 0 ufrag mtbG network-cost 999",
                 "observed_ms": 1792876992039
-              },
-              {
-                "candidate": "candidate:1648342598 1 udp 1677729535 192.0.2.1 64597 typ srflx raddr 0.0.0.0 rport 0 generation 0 ufrag mtbG network-cost 999",
-                "observed_ms": 1792876992052
-              },
-              {
-                "candidate": "candidate:2007285888 1 udp 1677732095 2001:db8::1 59340 typ srflx raddr :: rport 0 generation 0 ufrag mtbG network-cost 999",
-                "observed_ms": 1792876992056
               }
             ],
             "data_channel": true,

data/lib/cfsolve/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Cfsolve
-  VERSION = "0.1.1"
-  UPSTREAM_REVISION = "0f97eb7ccfea54f445b60a624ad8949beae95e95"
+  VERSION = "0.1.2"
+  UPSTREAM_REVISION = "1599e9b80b74689587f0e35445185c8174066793"
 end

data/vendor/cfsolve/README.md

@@ -21,41 +21,6 @@ set to the address of a running `capture-proxy`, which records the decoded
 payloads sent to Cloudflare.  Currently only Safari and Chrome(ium) profile
 types are supported.
 
-Newer builds also rename values embedded in probe answers, namespace properties,
-and stylesheet selectors on every session. Rebuild the answers with
-`cargo run --release --example build_profile -- capture.json > answers.json`
-to include the source evidence needed to refresh those values. Existing answer
-files remain readable, but do not contain this additional evidence.
-
-For builds that vary stylesheet selectors, record the profile browser's CSSOM
-formatting once. In the challenge iframe's execution context, save the JSON
-result of:
-
-```javascript
-JSON.stringify(Array.from(document.styleSheets, sheet =>
-  Array.from(sheet.cssRules, rule => rule.cssText)))
-```
-
-Pass that file as the second argument to `build_profile`. The answers then store
-the stylesheet source alongside its browser formatting. At solve time cfsolve
-checks that only randomized names have changed, substitutes the current names,
-and recomputes the stylesheet measurements without a browser. If the stylesheet
-structure changes, capture the new revision; the solver rejects an unmatched
-revision instead of sending an obsolete digest. The `stylesheets` array can hold
-multiple captured revisions for the same browser profile. Keep captures and
-device profiles private; they are not needed in bug reports or pull requests.
-
-Replay keeps browser measurements while deriving field names, namespace functions
-and trace frames from the current program. Function declaration order and function
-counts may change between builds. Trace frames come from the current program;
-captured frames are not replayed. Unmapped fields and ambiguous stylesheet
-markers are errors, rather than guessed answers.
-
-The internal `Replay::new` constructor now takes the current `Source` and
-`Installed` facts and returns a `Result`. It validates the profile and field
-mapping before use; there is no separate unchecked replay constructor. Stylesheet
-updates use the same replay path, preserving field order and late callback fields.
-
 ## Building
 
 You need the Rust version pinned in `rust-toolchain.toml`, plus CMake, a C/C++

data/vendor/cfsolve/examples/build_profile.rs

@@ -1,32 +1,34 @@
 //! Store a real browser's probe answers for a device profile.
-//! Usage: build_profile <capture.json> [cssom-rules.json] > answers.json
+//! Usage: build_profile <capture.json> [cssom.json] > answers.json
 //!
 //! The capture is a session's `capture.json` from the capture proxy, or what
 //! `scripts/cdp_capture.mjs` writes: the iframe's HTML, its POSTs with their
 //! responses, and the plaintext payloads. Each probe's record from the second
 //! payload is stored under the reference build's names; see
-//! `cfsolve::stage2::replay`.
+//! `cfsolve::stage2::replay`. An adjacent `iframe.deobfuscated.js` (from
+//! `capture_session`) is used instead of deobfuscating the capture's script.
 
-use std::env;
 use std::path::Path;
+use std::{env, fs};
 
 use anyhow::{Context, Result};
 use cfsolve::capture::CapturedSession;
-use cfsolve::stage2::replay::{Answers, StylesheetSnapshot};
+use cfsolve::stage2::replay::Answers;
 
 fn main() -> Result<()> {
-    let path = env::args().nth(1).context("supply a capture JSON file")?;
+    let mut arguments = env::args().skip(1);
+    let path = arguments.next().context("supply a capture JSON file")?;
     let capture = CapturedSession::read(Path::new(&path))?;
-    let mut answers = Answers::capture(
-        &capture.source()?,
-        &capture.program()?,
-        capture.probe_payload()?,
-    )?;
-    if let Some(path) = env::args().nth(2) {
-        let rules = serde_json::from_slice(&std::fs::read(path)?)?;
-        answers
-            .stylesheets
-            .push(StylesheetSnapshot::capture(capture.iframe_html(), rules)?);
+    let source = capture.source_beside(Path::new(&path))?;
+    let program = capture.program()?;
+    let mut answers = Answers::capture(&source, &program, capture.probe_payload()?)?;
+    if let Some(path) = arguments.next() {
+        answers.measure_stylesheets(
+            &source,
+            &program,
+            capture.iframe_html(),
+            serde_json::from_str(&fs::read_to_string(path)?)?,
+        )?;
     }
     println!("{}", serde_json::to_string_pretty(&answers)?);
     Ok(())

data/vendor/cfsolve/examples/capture_session.rs

@@ -0,0 +1,37 @@
+//! Write a capture as a session directory, for `stage2_snapshot` and other tools that read the
+//! challenge CLI's output.
+//! Usage: capture_session <capture.json> <output-directory>
+//!
+//! Writes `iframe.js`, `iframe.deobfuscated.js`, and each POST response's program as
+//! `response.decoded.txt`, `second-response.decoded.txt` and `third-response.decoded.txt`.
+
+use std::path::Path;
+use std::{env, fs};
+
+use anyhow::{Context, Result};
+use base64::Engine;
+use base64::engine::general_purpose::STANDARD;
+use cfsolve::capture::CapturedSession;
+
+fn main() -> Result<()> {
+    let mut arguments = env::args().skip(1);
+    let capture = arguments.next().context("supply a capture.json")?;
+    let directory = arguments.next().context("supply an output directory")?;
+    let capture = CapturedSession::read(Path::new(&capture))?;
+    let directory = Path::new(&directory);
+    fs::create_dir_all(directory)?;
+    let javascript = capture.javascript()?;
+    fs::write(directory.join("iframe.js"), &javascript)?;
+    fs::write(
+        directory.join("iframe.deobfuscated.js"),
+        cfsolve::deobfuscate(javascript)?.text,
+    )?;
+    let names = ["response", "second-response", "third-response"];
+    for (name, program) in names.iter().zip(capture.programs()?) {
+        fs::write(
+            directory.join(format!("{name}.decoded.txt")),
+            STANDARD.encode(program),
+        )?;
+    }
+    Ok(())
+}

data/vendor/cfsolve/examples/check_answers.rs

@@ -0,0 +1,66 @@
+//! Check stored answers against captured sessions of the current build.
+//! Usage: check_answers <answers.json> <capture.json>...
+//!
+//! Translates each replayed probe's stored record into the session's names, as a solve does,
+//! and compares its fields with the record the browser sent. Prints the fields only one side
+//! has; a field the stored record keeps under a name the session lacks means the vocabulary
+//! could not translate it.
+
+use std::collections::BTreeSet;
+use std::path::Path;
+use std::{env, fs};
+
+use anyhow::{Context, Result};
+use cfsolve::capture::CapturedSession;
+use cfsolve::js::JsValue;
+use cfsolve::stage2::analysis;
+use cfsolve::stage2::replay::Answers;
+
+fn main() -> Result<()> {
+    let mut arguments = env::args().skip(1);
+    let answers = arguments.next().context("supply answers.json")?;
+    let answers: Answers = serde_json::from_str(&fs::read_to_string(&answers)?)?;
+    let mut mismatched = 0;
+    for path in arguments {
+        let capture = CapturedSession::read(Path::new(&path))?;
+        let analysis = analysis::analyze(&capture.source()?, &capture.program()?)?;
+        let plan = analysis.plan();
+        let vocabulary = plan.vocabulary();
+        let envelope = plan.record_fields.names();
+        let payload = capture.probe_payload()?;
+        let (mut checked, mut differing) = (0, 0);
+        for probe in plan.probes() {
+            let position = probe.position();
+            let Some(stored) = vocabulary
+                .partner(position)
+                .and_then(|partner| answers.probes.get(&partner))
+            else {
+                continue;
+            };
+            let mut fields = stored.fields.clone();
+            vocabulary.rewrite_to_session(position, &mut fields);
+            let ours: BTreeSet<&String> = fields.keys().collect();
+            let sent: BTreeSet<&String> = payload
+                .get(&probe.index.to_string())
+                .and_then(JsValue::as_object)
+                .into_iter()
+                .flat_map(|record| record.keys())
+                .filter(|name| !envelope.contains(&name.as_str()))
+                .collect();
+            checked += 1;
+            if ours != sent {
+                differing += 1;
+                println!(
+                    "{path} probe {}: only stored {:?}, only sent {:?}",
+                    probe.index,
+                    ours.difference(&sent).collect::<Vec<_>>(),
+                    sent.difference(&ours).collect::<Vec<_>>(),
+                );
+            }
+        }
+        println!("{path}: {checked} replayed records, {differing} differ");
+        mismatched += differing;
+    }
+    anyhow::ensure!(mismatched == 0, "{mismatched} records differ");
+    Ok(())
+}

data/vendor/cfsolve/examples/compare_session.rs

@@ -0,0 +1,190 @@
+//! Compare a solve's payloads with a browser capture of the same build.
+//! Usage: compare_session <session-directory> <capture.json> [--values]
+//!
+//! The session directory is one the challenge CLI writes. Probe records are compared in the
+//! reference build's names, by key and JSON type; the other payload fields, whose names the
+//! vocabulary does not cover, by count and type. Timing values are ignored. `--values` also
+//! prints each probe field whose value differs.
+
+use std::collections::BTreeMap;
+use std::path::Path;
+use std::{env, fs};
+
+use anyhow::{Context, Result};
+use base64::Engine;
+use base64::engine::general_purpose::STANDARD;
+use cfsolve::capture::CapturedSession;
+use cfsolve::js::{JsObject, JsValue};
+use cfsolve::script::Source;
+use cfsolve::stage2::analysis::{self, Analysis};
+
+fn main() -> Result<()> {
+    let mut arguments = env::args().skip(1);
+    let directory = arguments.next().context("supply a session directory")?;
+    let capture_path = arguments.next().context("supply a capture.json")?;
+    let directory = Path::new(&directory);
+    let read = |name: &str| fs::read_to_string(directory.join(name));
+    let read_payload = |name: &str| -> Result<JsObject> { Ok(serde_json::from_str(&read(name)?)?) };
+
+    let ours = analysis::analyze(
+        &Source::try_new(&read("iframe.deobfuscated.js")?)?,
+        &STANDARD.decode(read("response.decoded.txt")?.trim())?,
+    )?;
+    let capture = CapturedSession::read(Path::new(&capture_path))?;
+    let theirs = analysis::analyze(&capture.source()?, &capture.program()?)?;
+
+    let our_second = read_payload("second-payload.json")?;
+    let their_second: &JsObject = capture.probe_payload()?;
+    let our_values = values(&ours, &our_second);
+    let their_values = values(&theirs, their_second);
+    if env::args().any(|argument| argument == "--values") {
+        for (probe, their_record) in &their_values {
+            let Some(our_record) = our_values.get(probe) else {
+                continue;
+            };
+            for (name, their_value) in their_record {
+                let our_value = our_record.get(name).map_or("<missing>".to_owned(), short);
+                let their_value = short(their_value);
+                if our_value != their_value {
+                    println!("{probe} {name}\n    ours   {our_value}\n    theirs {their_value}");
+                }
+            }
+        }
+    }
+    let our_records = records(&our_values);
+    let their_records = records(&their_values);
+    let only = |a: &BTreeMap<String, String>, b: &BTreeMap<String, String>| -> Vec<String> {
+        a.iter()
+            .filter(|(key, kind)| b.get(*key) != Some(*kind))
+            .map(|(key, kind)| format!("{key}:{kind}"))
+            .collect()
+    };
+    for (probe, theirs) in &their_records {
+        match our_records.get(probe) {
+            None => println!("{probe}: only in the capture"),
+            Some(ours) if ours != theirs => {
+                println!(
+                    "{probe}: ours {:?} theirs {:?}",
+                    only(ours, theirs),
+                    only(theirs, ours)
+                );
+            }
+            Some(_) => {}
+        }
+    }
+    for probe in our_records.keys() {
+        if !their_records.contains_key(probe) {
+            println!("{probe}: only in ours");
+        }
+    }
+
+    println!(
+        "second payload top level: {}",
+        top_level(&our_second, their_second)
+    );
+    if let (Ok(ours), Some(theirs)) = (read_payload("third-payload.json"), capture.last_payload()) {
+        println!("third payload top level: {}", top_level(&ours, theirs));
+        if let (Some(ours), Some(theirs)) = (last_record(&ours), last_record(theirs)) {
+            println!(
+                "checkbox record: ours {} theirs {}",
+                shape(ours),
+                shape(theirs)
+            );
+        }
+    }
+    if let (Ok(ours), Ok(theirs)) = (read_payload("payload.json"), capture.first_payload()) {
+        println!("first payload top level: {}", top_level(&ours, theirs));
+    }
+    Ok(())
+}
+
+/// Each probe's record in reference names, keyed by the reference probe or, for unpaired
+/// probes, the family.
+fn values(analysis: &Analysis, payload: &JsObject) -> BTreeMap<String, JsObject> {
+    let plan = analysis.plan();
+    let vocabulary = plan.vocabulary();
+    let envelope = plan.record_fields.names();
+    plan.probes()
+        .iter()
+        .filter_map(|probe| {
+            let mut record = payload.get(&probe.index.to_string())?.as_object()?.clone();
+            record.retain(|name, _| !envelope.contains(&name.as_str()));
+            vocabulary.rewrite_to_reference(probe.position(), &mut record);
+            let key = match (vocabulary.partner(probe.position()), &probe.operation) {
+                (Some(reference), _) => format!("reference {reference:02}"),
+                (None, Some(operation)) => format!("unpaired {}", operation.kind()),
+                (None, None) => "unpaired ?".to_owned(),
+            };
+            Some((key, record))
+        })
+        .collect()
+}
+
+/// Each record from [`values`] with its fields' JSON types.
+fn records(values: &BTreeMap<String, JsObject>) -> BTreeMap<String, BTreeMap<String, String>> {
+    values
+        .iter()
+        .map(|(probe, record)| {
+            let types = record
+                .iter()
+                .map(|(name, value)| (name.clone(), kind(value)))
+                .collect();
+            (probe.clone(), types)
+        })
+        .collect()
+}
+
+/// The record under the highest numeric key, which in the third payload is the checkbox's.
+fn last_record(payload: &JsObject) -> Option<&JsObject> {
+    payload
+        .iter()
+        .filter_map(|(key, value)| Some((key.parse::<usize>().ok()?, value)))
+        .max_by_key(|(index, _)| *index)
+        .and_then(|(_, value)| value.as_object())
+}
+
+fn short(value: &JsValue) -> String {
+    let text = value.stringify().unwrap_or_else(|| "undefined".into());
+    text.chars().take(240).collect()
+}
+
+fn kind(value: &JsValue) -> String {
+    match value {
+        JsValue::Null => "null".into(),
+        JsValue::Bool(_) => "bool".into(),
+        JsValue::Number(_) => "number".into(),
+        JsValue::String(text) if text.is_empty() => "empty".into(),
+        JsValue::String(_) => "string".into(),
+        JsValue::Array(items) => format!("array{}", items.len()),
+        JsValue::Object(object) => format!("object{}", object.len()),
+        JsValue::Undefined => "undefined".into(),
+    }
+}
+
+/// Non-record fields: count and multiset of types on each side.
+fn top_level(ours: &JsObject, theirs: &JsObject) -> String {
+    let mut counts: BTreeMap<String, [usize; 2]> = BTreeMap::new();
+    for (side, payload) in [ours, theirs].into_iter().enumerate() {
+        for (key, value) in payload {
+            if key.parse::<usize>().is_err() {
+                counts.entry(kind(value)).or_default()[side] += 1;
+            }
+        }
+    }
+    let differing: Vec<String> = counts
+        .iter()
+        .filter(|(_, [ours, theirs])| ours != theirs)
+        .map(|(kind, [ours, theirs])| format!("{kind} {ours}/{theirs}"))
+        .collect();
+    let total = |side: usize| counts.values().map(|count| count[side]).sum::<usize>();
+    format!(
+        "ours {} theirs {} fields; differing types (ours/theirs): {differing:?}",
+        total(0),
+        total(1),
+    )
+}
+
+fn shape(record: &JsObject) -> String {
+    let kinds: Vec<String> = record.values().map(kind).collect();
+    format!("{} fields {kinds:?}", record.len())
+}

data/vendor/cfsolve/examples/stage2_snapshot.rs

@@ -54,7 +54,10 @@ fn main() -> Result<()> {
         let frames = fields
             .calls
             .context("the stack probe's calls have an unrecognized shape")
-            .and_then(|calls| call_stack::recover_probe(&original, &cases, calls))
+            .and_then(|calls| {
+                let resumed = call_stack::Resumption::WorkerMessage;
+                call_stack::recover_probe(&original, &cases, calls, resumed)
+            })
             .map(|geometry| {
                 json!({
                     "frames": geometry.frames,