cfsolve 0.1.1 → 0.1.2

data/vendor/cfsolve/profiles/safari-26-ios.json

@@ -378,14 +378,6 @@
               {
                 "candidate": "candidate:3747697418 1 udp 2113937151 f9501b39-1d57-4eb6-8029-16167a5a330b.local 51498 typ host generation 0 ufrag mtbG network-cost 999",
                 "observed_ms": 1792876992039
-              },
-              {
-                "candidate": "candidate:1648342598 1 udp 1677729535 192.0.2.1 64597 typ srflx raddr 0.0.0.0 rport 0 generation 0 ufrag mtbG network-cost 999",
-                "observed_ms": 1792876992052
-              },
-              {
-                "candidate": "candidate:2007285888 1 udp 1677732095 2001:db8::1 59340 typ srflx raddr :: rport 0 generation 0 ufrag mtbG network-cost 999",
-                "observed_ms": 1792876992056
               }
             ],
             "data_channel": true,

data/vendor/cfsolve/scripts/capture_cssom.mjs

@@ -0,0 +1,42 @@
+// Measure CSSOM serialization offline, using only a saved capture's inline styles.
+// Usage: node scripts/capture_cssom.mjs <capture.json> <cssom.json>
+// Pass cssom.json as build_profile's optional second argument. The builder verifies
+// the measurements against the hash the captured browser actually reported.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+const [input, output] = process.argv.slice(2);
+if (!input || !output) throw new Error('Supply capture.json and output cssom.json');
+const capture = JSON.parse(fs.readFileSync(input, 'utf8'));
+const styles = [...capture.iframeHtml.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi)].map(match => match[1]);
+const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'cf-cssom-'));
+try {
+  const encoded = Buffer.from(JSON.stringify(styles)).toString('base64');
+  const document = `<!doctype html><meta charset="utf-8"><pre id="out"></pre><script>
+    const sources = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob('${encoded}'), c => c.charCodeAt(0))));
+    const result = sources.map(source => {
+      const style = document.createElement('style');
+      style.textContent = source;
+      document.head.append(style);
+      return { source, rules: Array.from(style.sheet.cssRules, rule => rule.cssText) };
+    });
+    document.getElementById('out').textContent = JSON.stringify(result);
+  </script>`;
+  const file = path.join(directory, 'styles.html');
+  fs.writeFileSync(file, document);
+  const dom = execFileSync(process.env.CHROMIUM || 'chromium', [
+    '--headless=new', '--no-sandbox', '--disable-gpu', '--disable-background-networking',
+    '--host-resolver-rules=MAP * ~NOTFOUND', `--user-data-dir=${path.join(directory, 'profile')}`,
+    '--dump-dom', `file://${file}`,
+  ], { encoding: 'utf8', timeout: 30000, maxBuffer: 4 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
+  const found = dom.match(/<pre id="out">([\s\S]*?)<\/pre>/);
+  if (!found) throw new Error('Chromium did not return CSSOM measurements');
+  const decoded = found[1].replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&');
+  const result = JSON.parse(decoded);
+  if (result.length !== styles.length) throw new Error('CSSOM measurement count differs');
+  fs.writeFileSync(output, JSON.stringify(result, null, 2) + '\n');
+} finally {
+  fs.rmSync(directory, { recursive: true, force: true });
+}

data/vendor/cfsolve/scripts/serve_cssom.py

@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+"""Measure saved iframe styles in another browser without replaying a challenge.
+
+Usage: serve_cssom.py <output-directory> <capture.json>... [--port 8766]
+Open the printed LAN URL in the browser being profiled.
+"""
+
+import argparse
+import json
+import re
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+
+PAGE = b'''<!doctype html><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Safari stylesheet measurement</title>
+<body style="font:18px system-ui;padding:24px"><h1>Stylesheet measurement</h1>
+<p id="status">Measuring this browser...</p>
+<script>
+(async () => {
+  const captures = await (await fetch('/styles.json')).json();
+  const results = [];
+  for (const capture of captures) {
+    const frame = document.createElement('iframe');
+    frame.style.display = 'none';
+    document.body.append(frame);
+    const doc = frame.contentDocument;
+    const sheets = capture.sources.map(source => {
+      const style = doc.createElement('style');
+      style.textContent = source;
+      doc.head.append(style);
+      return {source, rules: Array.from(style.sheet.cssRules, rule => rule.cssText)};
+    });
+    results.push({name: capture.name, sheets});
+    frame.remove();
+  }
+  const response = await fetch('/measurements', {
+    method: 'POST', headers: {'Content-Type': 'application/json'},
+    body: JSON.stringify({userAgent: navigator.userAgent, results})
+  });
+  if (!response.ok) throw new Error(await response.text());
+  document.getElementById('status').textContent = 'Saved successfully. You can close this page and tell me it is done.';
+})().catch(error => document.getElementById('status').textContent = 'Measurement failed: ' + error.message);
+</script>'''
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('output', type=Path)
+    parser.add_argument('captures', nargs='+', type=Path)
+    parser.add_argument('--port', type=int, default=8766)
+    arguments = parser.parse_args()
+    arguments.output.mkdir(parents=True, exist_ok=True)
+    captures = []
+    for index, path in enumerate(arguments.captures):
+        capture = json.loads(path.read_text())
+        sources = re.findall(r'<style\b[^>]*>([\s\S]*?)</style\s*>', capture['iframeHtml'], re.I)
+        if not sources:
+            raise ValueError(f'No stylesheets in {path}')
+        captures.append({'name': f'{index:02d}-{path.parent.name}', 'sources': sources})
+    expected = {capture['name']: capture['sources'] for capture in captures}
+
+    class Handler(BaseHTTPRequestHandler):
+        def reply(self, status, content, content_type='text/plain'):
+            self.send_response(status)
+            self.send_header('Content-Type', content_type)
+            self.send_header('Content-Length', str(len(content)))
+            self.send_header('Cache-Control', 'no-store')
+            self.end_headers()
+            self.wfile.write(content)
+
+        def do_GET(self):
+            if self.path == '/':
+                self.reply(200, PAGE, 'text/html; charset=utf-8')
+            elif self.path == '/styles.json':
+                self.reply(200, json.dumps(captures).encode(), 'application/json')
+            else:
+                self.reply(404, b'Not found')
+
+        def do_POST(self):
+            if self.path != '/measurements':
+                return self.reply(404, b'Not found')
+            try:
+                length = int(self.headers.get('Content-Length', '0'))
+                if not 0 < length < 4_000_000:
+                    raise ValueError('Invalid measurement size')
+                measured = json.loads(self.rfile.read(length))
+                if {result['name'] for result in measured['results']} != set(expected):
+                    raise ValueError('Unexpected capture names')
+                for result in measured['results']:
+                    if [sheet['source'] for sheet in result['sheets']] != expected[result['name']]:
+                        raise ValueError('Stylesheet sources differ')
+                    if not all(isinstance(rule, str) for sheet in result['sheets'] for rule in sheet['rules']):
+                        raise ValueError('Invalid CSS rules')
+                # Write only after the entire measurement has validated.
+                for result in measured['results']:
+                    (arguments.output / f"{result['name']}.json").write_text(json.dumps(result['sheets'], indent=2) + '\n')
+                (arguments.output / 'browser.json').write_text(json.dumps({'userAgent': measured['userAgent']}, indent=2) + '\n')
+                print(f"Saved {len(measured['results'])} captures from {measured['userAgent']}", flush=True)
+                self.reply(200, b'Saved')
+            except (ValueError, KeyError, TypeError) as error:
+                self.reply(400, str(error).encode())
+
+    server = ThreadingHTTPServer(('0.0.0.0', arguments.port), Handler)
+    print(f'Listening on port {arguments.port}; open this computer\'s LAN address in Safari.', flush=True)
+    server.serve_forever()
+
+
+if __name__ == '__main__':
+    main()

data/vendor/cfsolve/src/capture/profile.rs

@@ -13,7 +13,6 @@
 mod headers;
 
 use std::collections::BTreeMap;
-use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
 use anyhow::{Context, Result, bail};
 use serde::Serialize;
@@ -33,6 +32,7 @@ use crate::js::{self, JsObject, JsValue, Payload};
 use crate::script::Source;
 use crate::stage2::analysis;
 use crate::stage2::benchmark::WorkerCosts;
+use crate::stage2::probes::ice;
 use crate::stage2::probes::media::Measurement;
 use crate::stage2::registry::{Kind, Operation};
 
@@ -247,7 +247,7 @@ impl Reported {
                     plan.vocabulary()
                         .rewrite_to_reference(probe.position(), &mut observed);
                     match fields.observed(&observed, started) {
-                        Ok(media) => self.media = Some(without_addresses(media)),
+                        Ok(media) => self.media = Some(host_candidates_only(media)),
                         Err(error) => problems.push(error.context("reading the media probe")),
                     }
                 }
@@ -373,23 +373,12 @@ fn reported<'payload>(
     }
 }
 
-/// Replaces recorded IP addresses with documentation addresses so shared profiles do not reveal the
-/// capture network. These addresses are never sent: [`crate::stage2::probes::ice::refresh`]
-/// generates new names for host candidates.
-fn without_addresses(mut media: Measurement) -> Measurement {
+/// Keeps only host candidates, which name the capture machine by mDNS name, so shared profiles do
+/// not reveal its public address. [`crate::stage2::probes::ice::refresh`] reports only these.
+fn host_candidates_only(mut media: Measurement) -> Measurement {
     if let Measurement::Observed { snapshot, .. } = &mut media {
-        for candidate in &mut snapshot.connection.published_candidates {
-            let Some(line) = candidate.candidate.as_str() else {
-                continue;
-            };
-            let tokens = line.split(' ').map(|token| match token.parse::<IpAddr>() {
-                Ok(address) if address.is_unspecified() => token.to_owned(),
-                Ok(IpAddr::V4(_)) => Ipv4Addr::new(192, 0, 2, 1).to_string(),
-                Ok(IpAddr::V6(_)) => Ipv6Addr::new(0x2001, 0xdb8, 0, 0, 0, 0, 0, 1).to_string(),
-                Err(_) => token.to_owned(),
-            });
-            candidate.candidate = JsValue::String(tokens.collect::<Vec<String>>().join(" "));
-        }
+        let candidates = &mut snapshot.connection.published_candidates;
+        candidates.retain(|candidate| candidate.candidate.as_str().is_some_and(ice::is_host));
     }
     media
 }

data/vendor/cfsolve/src/capture/recorded.rs

@@ -40,6 +40,7 @@ struct CapturedPayload {
 }
 
 impl CapturedSession {
+    /// The iframe document as received, including its stylesheets.
     #[must_use]
     pub fn iframe_html(&self) -> &str {
         &self.iframe_html
@@ -51,18 +52,46 @@ impl CapturedSession {
 
     /// Returns the deobfuscated inline script from the iframe.
     pub fn source(&self) -> Result<Source> {
-        let javascript = challenge::inline_javascript(&self.iframe_html)?;
-        Source::try_new(&deobfuscate::deobfuscate(javascript)?.text)
+        Source::try_new(&deobfuscate::deobfuscate(self.javascript()?)?.text)
+    }
+
+    /// Like [`Self::source`], but reads the `iframe.deobfuscated.js` that `capture_session`
+    /// writes beside `capture_path` when there is one.
+    pub fn source_beside(&self, capture_path: &Path) -> Result<Source> {
+        let deobfuscated = capture_path.with_file_name("iframe.deobfuscated.js");
+        if deobfuscated.exists() {
+            Source::try_new(&fs::read_to_string(deobfuscated)?)
+        } else {
+            self.source()
+        }
     }
 
     /// Returns the probe program from the first POST response, unmasked using the ray ID in the
     /// URL.
     pub fn program(&self) -> Result<Vec<u8>> {
-        let post = self.posts.first().context("the capture has no POST")?;
-        let url = Url::parse(&post.url)?;
-        let encoded =
-            challenge::decode_response(post.response_body.as_bytes(), challenge::ray(&url)?)?;
-        Ok(STANDARD.decode(encoded)?)
+        self.programs()?
+            .into_iter()
+            .next()
+            .context("the capture has no POST")
+    }
+
+    /// Returns the program each POST response carries, in order, such as the probe program and
+    /// then the checkbox program.
+    pub fn programs(&self) -> Result<Vec<Vec<u8>>> {
+        self.posts
+            .iter()
+            .map(|post| {
+                let url = Url::parse(&post.url)?;
+                let ray = challenge::ray(&url)?;
+                let encoded = challenge::decode_response(post.response_body.as_bytes(), ray)?;
+                Ok(STANDARD.decode(encoded)?)
+            })
+            .collect()
+    }
+
+    /// Returns the iframe's inline script, before deobfuscation.
+    pub fn javascript(&self) -> Result<String> {
+        challenge::inline_javascript(&self.iframe_html)
     }
 
     /// Returns the payload built before probes run.
@@ -78,6 +107,12 @@ impl CapturedSession {
             .find(|payload| payload.contains_key("1"))
             .context("the capture has no payload with probe records")
     }
+
+    /// Returns the last payload, such as the checkbox interaction's.
+    #[must_use]
+    pub fn last_payload(&self) -> Option<&Payload> {
+        self.payloads.last().map(|payload| &payload.payload)
+    }
 }
 
 /// Traffic and complete sessions from one proxy run directory.

data/vendor/cfsolve/src/challenge/installed/audit.rs

@@ -0,0 +1,131 @@
+//! Audit-only recovery includes initialization's timer callbacks. It does not change the
+//! options, key material, or globals used by the payload encoder.
+
+use std::rc::Rc;
+
+use swc_core::ecma::ast::BinaryOp;
+
+use super::{Held, Installed};
+use crate::js::{JsValue, json};
+use crate::listing::fold::{Frame, Known};
+use crate::stage2::vocabulary;
+use crate::vm::{Effect, Listing, Term};
+
+pub(super) fn read(listing: &Listing, installed: &mut Installed) {
+    let mut frame = Frame::<Held>::default();
+    for (&pc, instruction) in &listing.instructions {
+        for path in &instruction.paths {
+            frame.begin();
+            frame.follow(pc, &path.effects, evaluate, |frame, effect| {
+                // The key factory is declared by evaluating a literal function definition,
+                // after a Trusted Types wrapper has returned that same source string.
+                for argument in effect.call().map_or(&[][..], |(_, arguments)| arguments) {
+                    if let Some(known) = frame.resolve(argument)
+                        && let Some(text) = known.text()
+                        && let Some(function) = text.strip_prefix("function ")
+                        && let Some((name, _)) = function.split_once('(')
+                        && vocabulary::is_hex_name(name)
+                    {
+                        installed.audit.insert(name.into(), "N".into());
+                        installed
+                            .audit_roles
+                            .insert(name.into(), "function-factory".into());
+                    }
+                }
+                let Effect::SetProperty { object, key, value } = effect else {
+                    return;
+                };
+                let (Some(object), Some(key)) = (frame.resolve(object), frame.resolve(key)) else {
+                    return;
+                };
+                let value = frame.resolve(value);
+                if let Known::Ext(Held::AuditArray(array)) = &object
+                    && let Known::Literal(JsValue::Number(index)) = &key
+                    && *index >= 0.0
+                    && index.fract() == 0.0
+                {
+                    let native = if let Some(Known::Ext(Held::NativeFunction(name))) = &value {
+                        Some(format!("function {name}() {{ [native code] }}"))
+                    } else {
+                        None
+                    };
+                    array.borrow_mut().insert(*index as usize, native);
+                }
+                if !matches!(object, Known::Ext(Held::Window)) {
+                    return;
+                }
+                let Some(name) = key.text().filter(|name| vocabulary::is_hex_name(name)) else {
+                    return;
+                };
+                let (role, audit) = match value {
+                    Some(Known::Ext(Held::AuditArray(array))) => {
+                        let members: Option<Vec<String>> =
+                            array.borrow().values().cloned().collect();
+                        let Some(members) = members else {
+                            return;
+                        };
+                        let role = if members.is_empty() {
+                            "empty-array"
+                        } else {
+                            "native-array"
+                        };
+                        (role, members.join(","))
+                    }
+                    Some(Known::Ext(Held::GpuPromise)) => ("gpu-adapter", "o".into()),
+                    Some(Known::Ext(Held::ClockDelta)) => ("clock-delta", String::new()),
+                    _ => return,
+                };
+                installed.audit.insert(name.into(), audit);
+                installed.audit_roles.insert(name.into(), role.into());
+            });
+        }
+    }
+}
+
+fn evaluate(frame: &Frame<Held>, value: &Term) -> Option<Known<Held>> {
+    let string = |term: &Term| match frame.resolve(term) {
+        Some(Known::Literal(JsValue::String(text))) => Some(text),
+        _ => None,
+    };
+    match value {
+        Term::Array(elements) if elements.is_empty() => {
+            return Some(Known::Ext(Held::AuditArray(Rc::default())));
+        }
+        Term::Get(_, key) => {
+            if let Some(name @ ("querySelector" | "querySelectorAll")) =
+                frame.resolve(key).as_ref().and_then(Known::text)
+            {
+                return Some(Known::Ext(Held::NativeFunction(name.into())));
+            }
+        }
+        Term::Call {
+            callee, arguments, ..
+        } => {
+            if let Term::Get(_, method) = &**callee {
+                match frame.resolve(method).as_ref().and_then(Known::text) {
+                    Some("now") => return Some(Known::Ext(Held::Clock)),
+                    Some("requestAdapter") => return Some(Known::Ext(Held::GpuPromise)),
+                    _ => {}
+                }
+            }
+            if let [argument] = arguments.as_slice()
+                && let Some(text) = string(argument)
+                && text.starts_with("function ")
+            {
+                return Some(Known::Literal(json!(text)));
+            }
+        }
+        Term::Binary(BinaryOp::Sub, _, right)
+            if matches!(frame.resolve(right), Some(Known::Ext(Held::Clock))) =>
+        {
+            return Some(Known::Ext(Held::ClockDelta));
+        }
+        Term::Binary(BinaryOp::Add, left, right) => {
+            if let (Some(left), Some(right)) = (string(left), string(right)) {
+                return Some(Known::Literal(json!(format!("{left}{right}"))));
+            }
+        }
+        _ => {}
+    }
+    super::evaluate(frame, value)
+}