cfsolve 0.1.1 → 0.1.2

data/vendor/cfsolve/src/challenge/installed.rs

@@ -5,17 +5,21 @@
 //! globals include a build marker, a selector log, and functions built from constants, such as
 //! the key transform's `window[name] = factory(secret)`.
 
+use std::cell::RefCell;
 use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
+use std::rc::Rc;
 
 use anyhow::Result;
-use indexmap::IndexMap;
+use swc_core::ecma::ast::BinaryOp;
 
 use crate::js::{JsObject, JsValue, Options, Window, json};
-use crate::listing::fold::{Frame, Known, constant};
+use crate::listing::fold::{Frame, Known};
 use crate::listing::query;
 use crate::script::Source;
 use crate::vm::{Effect, Exit, Listing, Term};
 
+mod audit;
+
 /// Values tracked beyond literals while recovering installed options.
 #[derive(Clone)]
 enum Held {
@@ -24,7 +28,13 @@ enum Held {
     Window,
     /// The result of a call with one string-constant argument.
     Built(String),
-    Function,
+    /// An array the audit fills by index, holding native function sources where known.
+    AuditArray(Rc<RefCell<BTreeMap<usize, Option<String>>>>),
+    NativeFunction(String),
+    /// The result of a `now()` call.
+    Clock,
+    ClockDelta,
+    GpuPromise,
 }
 
 /// Options and globals left by the initial program.
@@ -37,21 +47,16 @@ pub struct Installed {
     pub window: Window,
     /// Window globals created by calls with one string constant, mapped to that constant.
     pub built: BTreeMap<String, String>,
-    /// Global value classes, in installation order, for matching captured namespace properties.
-    pub(crate) audit: IndexMap<String, String>,
-    /// Global factories called to create installed functions.
-    pub(crate) factories: BTreeSet<String>,
+    /// Initial global values as classified by the environment audit.
+    pub audit: BTreeMap<String, String>,
+    /// Semantic roles for globals whose values alone do not identify their definitions.
+    pub audit_roles: BTreeMap<String, String>,
 }
 
 /// Recovers values installed by the initial `program`, decoded from its program runner call.
 pub fn read(source: &Source, program: &[u8]) -> Result<Installed> {
-    let mut listing = source.disassemble(program)?;
-    crate::listing::normalize::constants(&mut listing);
-    Ok(read_listing(&listing))
-}
-
-fn read_listing(listing: &Listing) -> Installed {
-    let initialization = initialization(listing);
+    let listing = source.disassemble(program)?;
+    let initialization = initialization(&listing);
     let mut frame: Frame<Held> = Frame::default();
     let mut objects: HashMap<u32, JsObject> = HashMap::new();
     let mut installed = Installed::default();
@@ -65,31 +70,27 @@ fn read_listing(listing: &Listing) -> Installed {
                 let Effect::SetProperty { object, key, value } = effect else {
                     return;
                 };
-                let (Some(object), Some(Known::Literal(JsValue::String(key)))) =
-                    (frame.resolve(object), frame.resolve(key))
-                else {
+                let (Some(object), Some(Known::Literal(JsValue::String(key))), Some(value)) = (
+                    frame.resolve(object),
+                    frame.resolve(key),
+                    frame.resolve(value),
+                ) else {
                     return;
                 };
-                let value = evaluate(frame, value);
                 if matches!(object, Known::Ext(Held::Window)) {
-                    let group = match &value {
-                        Some(Known::Object(_)) => "o".to_owned(),
-                        Some(Known::Ext(Held::Function | Held::Built(_))) => "N".to_owned(),
-                        Some(Known::Ext(Held::EmptyArray)) => "".to_owned(),
-                        Some(Known::Literal(JsValue::String(value))) => value.clone(),
-                        Some(Known::Literal(JsValue::Number(value))) => value.to_string(),
-                        Some(Known::Literal(JsValue::Bool(value))) => {
-                            if *value { "T" } else { "F" }.to_owned()
-                        }
-                        _ => "?".to_owned(),
+                    let audit = match &value {
+                        Known::Literal(JsValue::String(text)) => Some(text.clone()),
+                        Known::Literal(JsValue::Number(number)) => Some(number.to_string()),
+                        Known::Literal(JsValue::Bool(true)) => Some("T".into()),
+                        Known::Literal(JsValue::Bool(false)) => Some("F".into()),
+                        Known::Object(_) => Some("o".into()),
+                        Known::Ext(Held::Built(_)) => Some("N".into()),
+                        _ => None,
                     };
-                    if group != "?" || !installed.audit.contains_key(&key) {
-                        installed.audit.insert(key.clone(), group);
+                    if let Some(audit) = audit {
+                        installed.audit.insert(key.clone(), audit);
                     }
                 }
-                let Some(value) = value else {
-                    return;
-                };
                 match (object, value) {
                     // The encoder skips function members, such as `toJSON`.
                     (Known::Object(id), Known::Literal(value)) => {
@@ -116,77 +117,79 @@ fn read_listing(listing: &Listing) -> Installed {
             });
         }
     }
-    let index = crate::listing::Index::new(listing);
-    for store in index.stores() {
-        let Some((at, Term::Get(_, key))) = index.dereference(store.pc, &Term::Reg(store.object))
-        else {
-            continue;
-        };
-        if index.text(at, &key).as_deref() != Some("window") {
-            continue;
-        }
-        let Some((_, value)) = index.dereference(store.pc, &store.value) else {
-            continue;
-        };
-        let kind = match value {
-            Term::Closure { .. } => "N",
-            Term::Object(_) => "o",
-            Term::Array(_) => "",
-            Term::Binary(_, _, _) | Term::Unary(_, _) => "number",
-            Term::Call { .. } => "call",
-            Term::Get(_, _) => "get",
-            _ => "?",
-        };
-        if installed
-            .audit
-            .get(&store.key)
-            .is_none_or(|value| value == "?")
-        {
-            installed.audit.insert(store.key.clone(), kind.into());
-        }
-    }
-    for (pc, effect) in index.effects_in(..) {
-        effect.visit_terms(&mut |term| {
-            if let Term::Call {
-                callee, arguments, ..
-            } = term
-                && let [argument] = arguments.as_slice()
-                && let Some(value) = index.text(pc, argument)
-                && installed.built.values().any(|secret| secret == &value)
-                && let Some(factory) = index.member(pc, callee)
-                && matches!(factory.object, Term::Reg(global) if Some(global) == index.global())
-            {
-                installed.factories.insert(factory.key);
-            }
-        });
-    }
-    installed
+    audit::read(&listing, &mut installed);
+    Ok(installed)
 }
 
 /// The value an assignment writes. Recognizes calls with one string constant, such as the key
-/// transform `factory(secret)`.
+/// transform `factory(secret)`, and folds the arithmetic and string methods that unpack
+/// length-prefixed names.
 fn evaluate(frame: &Frame<Held>, value: &Term) -> Option<Known<Held>> {
-    if let Some(value) = constant(frame, value) {
-        return Some(Known::Literal(value));
-    }
     Some(match value {
-        Term::Closure { .. } => Known::Ext(Held::Function),
         Term::Array(elements) if elements.is_empty() => Known::Ext(Held::EmptyArray),
         Term::Get(_, key) => match frame.resolve(key)?.text()? {
             "_cf_chl_opt" => Known::Ext(Held::Options),
             "window" => Known::Ext(Held::Window),
             _ => return None,
         },
-        Term::Call { arguments, .. } => {
+        Term::Call {
+            callee,
+            this,
+            arguments,
+        } => {
+            if this.is_none()
+                && let Some(folded) = string_method(frame, callee, arguments)
+            {
+                return Some(folded);
+            }
             let [argument] = arguments.as_slice() else {
                 return None;
             };
             Known::Ext(Held::Built(frame.resolve(argument)?.text()?.to_owned()))
         }
+        Term::Binary(BinaryOp::Add, left, right) => {
+            Known::Literal(json!(number(frame, left)? + number(frame, right)?))
+        }
+        Term::Binary(BinaryOp::Mul, left, right) => {
+            Known::Literal(json!(number(frame, left)? * number(frame, right)?))
+        }
         value => frame.resolve(value)?,
     })
 }
 
+/// Folds `charCodeAt` and `slice` on a known string. Some programs store names as
+/// length-prefixed constants padded with NULs and unpack them with
+/// `text.slice(2, 2 + 256 * text.charCodeAt(0) + text.charCodeAt(1))`.
+fn string_method(frame: &Frame<Held>, callee: &Term, arguments: &[Term]) -> Option<Known<Held>> {
+    let Term::Get(receiver, method) = callee else {
+        return None;
+    };
+    let text: Vec<u16> = frame.resolve(receiver)?.text()?.encode_utf16().collect();
+    let index = |argument: &Term| {
+        let index = number(frame, argument)?;
+        // Negative indexes count from the end; the unpacking never uses them.
+        (index >= 0.0 && index.fract() == 0.0).then_some(index as usize)
+    };
+    Some(match (frame.resolve(method)?.text()?, arguments) {
+        ("charCodeAt", [position]) => {
+            Known::Literal(json!(f64::from(*text.get(index(position)?)?)))
+        }
+        ("slice", [start, end]) => {
+            let end = index(end)?.min(text.len());
+            let start = index(start)?.min(end);
+            Known::Literal(json!(String::from_utf16(&text[start..end]).ok()?))
+        }
+        _ => return None,
+    })
+}
+
+fn number(frame: &Frame<Held>, term: &Term) -> Option<f64> {
+    match frame.resolve(term)? {
+        Known::Literal(value) => value.as_f64(),
+        _ => None,
+    }
+}
+
 /// Finds startup instructions reachable from the entry, the returned function called by the
 /// iframe, and their callees. Excludes exception handlers and callbacks that are installed
 /// without being called.
@@ -261,198 +264,46 @@ fn return_register(listing: &Listing) -> Option<u8> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::vm::{Constant, Instruction, Path, Position};
-    use swc_core::ecma::ast::BinaryOp;
-
-    fn text(value: &str) -> Term {
-        Term::Const(Constant::String(value.into()))
-    }
-
-    fn number(value: f64) -> Term {
-        Term::Const(Constant::Number(value))
-    }
+    use crate::vm::Constant;
 
-    fn method(object: Term, name: &str, arguments: Vec<Term>) -> Term {
-        Term::Call {
-            callee: Box::new(Term::Get(Box::new(object), Box::new(text(name)))),
+    #[test]
+    fn unpacks_length_prefixed_names() {
+        let mut frame: Frame<Held> = Frame::default();
+        frame.set(1, Some(Known::Literal(json!("\0\u{3}abc\0\0\0"))));
+        let register = |register| Box::new(Term::Reg(register));
+        let number = |value| Term::Const(Constant::Number(value));
+        let method = |name: &str, arguments| Term::Call {
+            callee: Box::new(Term::Get(
+                register(1),
+                Box::new(Term::Const(Constant::String(name.into()))),
+            )),
             this: None,
             arguments,
-        }
-    }
-
-    #[test]
-    fn records_the_global_factory_that_built_an_installed_function() {
-        let effects = vec![
-            Effect::Set(
-                1,
-                Term::Get(Box::new(Term::Reg(99)), Box::new(text("window"))),
-            ),
-            Effect::Set(
-                2,
-                method(Term::Reg(99), "factory", vec![text("synthetic-secret")]),
-            ),
-            Effect::SetProperty {
-                object: Box::new(Term::Reg(1)),
-                key: Box::new(text("transform")),
-                value: Box::new(Term::Reg(2)),
-            },
-            Effect::Set(
-                3,
-                method(Term::Reg(99), "unrelated", vec![text("different-value")]),
-            ),
-        ];
-        let mut listing = Listing::default();
-        listing.functions.push(Position::new(0, 0));
-        let count = effects.len() as u32;
-        for (pc, effect) in (0..).zip(effects) {
-            listing.instructions.insert(
-                pc,
-                Instruction {
-                    pc,
-                    key: 0,
-                    opcode: 0,
-                    paths: vec![Path {
-                        conditions: vec![],
-                        effects: vec![effect],
-                        exit: if pc + 1 == count {
-                            Exit::Return
-                        } else {
-                            Exit::Next { pc: pc + 1, key: 0 }
-                        },
-                    }],
-                },
-            );
-        }
-        let installed = read_listing(&listing);
-        assert_eq!(installed.factories, BTreeSet::from(["factory".into()]));
-        assert_eq!(
-            installed.built,
-            BTreeMap::from([("transform".into(), "synthetic-secret".into())])
-        );
-    }
-
-    #[test]
-    fn recovers_a_key_transform_with_an_inline_decoded_global_name() {
-        let effects = vec![
-            Effect::Set(
-                1,
-                Term::Get(
-                    Box::new(Term::Global("self".into())),
-                    Box::new(text("window")),
-                ),
-            ),
-            Effect::Set(2, text("\0\u{9}fresh_key\0padding")),
-            Effect::Set(3, method(Term::Reg(2), "charCodeAt", vec![number(0.0)])),
-            Effect::Set(4, method(Term::Reg(2), "charCodeAt", vec![number(1.0)])),
-            Effect::Set(
-                3,
-                Term::Binary(
-                    BinaryOp::Mul,
-                    Box::new(Term::Reg(3)),
-                    Box::new(number(256.0)),
-                ),
-            ),
-            Effect::Set(
-                3,
-                Term::Binary(
-                    BinaryOp::Add,
-                    Box::new(Term::Reg(3)),
-                    Box::new(Term::Reg(4)),
-                ),
-            ),
-            Effect::Set(
-                3,
-                Term::Binary(BinaryOp::Add, Box::new(Term::Reg(3)), Box::new(number(2.0))),
-            ),
-            Effect::Set(
-                2,
-                method(Term::Reg(2), "slice", vec![number(2.0), Term::Reg(3)]),
-            ),
-            Effect::Set(
-                5,
-                Term::Call {
-                    callee: Box::new(Term::Reg(99)),
-                    this: None,
-                    arguments: vec![text("synthetic-secret")],
-                },
-            ),
-            Effect::SetProperty {
-                object: Box::new(Term::Reg(1)),
-                key: Box::new(Term::Reg(2)),
-                value: Box::new(Term::Reg(5)),
-            },
-        ];
-        let mut listing = Listing::default();
-        listing.functions.push(Position::new(0, 0));
-        listing.instructions.insert(
-            0,
-            Instruction {
-                pc: 0,
-                key: 0,
-                opcode: 0,
-                paths: vec![Path {
-                    conditions: vec![],
-                    effects,
-                    exit: Exit::Return,
-                }],
-            },
+        };
+        let mut set = |target, term: Term| {
+            let value = evaluate(&frame, &term);
+            frame.set(target, value);
+        };
+        // `text.slice(2, 256 * text.charCodeAt(0) + text.charCodeAt(1) + 2)`
+        set(2, method("charCodeAt", vec![number(0.0)]));
+        set(3, method("charCodeAt", vec![number(1.0)]));
+        set(
+            4,
+            Term::Binary(BinaryOp::Mul, Box::new(number(256.0)), register(2)),
         );
-        assert_eq!(
-            read_listing(&listing).built,
-            BTreeMap::from([("fresh_key".into(), "synthetic-secret".into())])
+        set(4, Term::Binary(BinaryOp::Add, register(4), register(3)));
+        set(
+            4,
+            Term::Binary(BinaryOp::Add, register(4), Box::new(number(2.0))),
         );
-    }
+        set(5, method("slice", vec![number(2.0), Term::Reg(4)]));
+        assert_eq!(frame.register(5).and_then(Known::text), Some("abc"));
 
-    #[test]
-    fn constant_string_operations_use_javascript_utf16_indexes() {
-        let frame: Frame<Held> = Frame::default();
-        assert_eq!(
-            constant(
-                &frame,
-                &method(text("a😀z"), "charCodeAt", vec![number(1.0)])
-            ),
-            Some(JsValue::Number(0xd83d as f64))
-        );
-        assert_eq!(
-            constant(
-                &frame,
-                &method(text("a😀z"), "slice", vec![number(1.0), number(3.0)])
-            ),
-            Some(json!("😀"))
-        );
-        assert_eq!(
-            constant(
-                &frame,
-                &method(text("abcdef"), "slice", vec![number(-3.0), number(99.0)])
-            ),
-            Some(json!("def"))
-        );
-        assert_eq!(
-            constant(
-                &frame,
-                &method(text("abc"), "slice", vec![number(2.0), number(1.0)])
-            ),
-            Some(json!(""))
-        );
-        assert_eq!(
-            constant(
-                &frame,
-                &method(text("a😀z"), "slice", vec![number(1.0), number(2.0)])
-            ),
-            None
-        );
-        let outside = constant(
-            &frame,
-            &method(text("abc"), "charCodeAt", vec![number(-1.0)]),
-        )
-        .unwrap();
-        assert!(outside.as_f64().unwrap().is_nan());
-        assert!(
-            constant(
-                &frame,
-                &method(Term::Reg(99), "slice", vec![number(0.0), number(2.0)])
-            )
-            .is_none()
-        );
+        // A call with one string argument still builds a global.
+        let built = evaluate(&frame, &method("factory", vec![Term::Reg(5)]));
+        assert!(matches!(built, Some(Known::Ext(Held::Built(secret))) if secret == "abc"));
+        // Out-of-range and negative indexes stay unknown.
+        assert!(evaluate(&frame, &method("charCodeAt", vec![number(9.0)])).is_none());
+        assert!(evaluate(&frame, &method("slice", vec![number(-1.0), number(2.0)])).is_none());
     }
 }

data/vendor/cfsolve/src/challenge/payload.rs

@@ -1,12 +1,15 @@
 //! Builds the plaintext first challenge payload by evaluating the template's field expressions
 //! against session options and the script's namespace.
 
+use std::sync::LazyLock;
+
 use anyhow::{Context, Result, ensure};
+use regex::Regex;
 use swc_core::ecma::ast::{BinaryOp, Expr};
 use swc_core::ecma::codegen;
 
 use crate::challenge::expression;
-use crate::challenge::state::{Difference, ScriptState};
+use crate::challenge::state::{Difference, Getter, ScriptState};
 use crate::js::{JsValue, Options, Payload, Window, ast, json};
 use crate::random_id;
 
@@ -41,8 +44,7 @@ pub(crate) fn infer_globals(
             (None, Shape::Called) => script
                 .getters
                 .get(name)
-                .and_then(|option| options.get(option))
-                .cloned()
+                .and_then(|getter| called(getter, options))
                 .unwrap_or_else(|| json!([])),
             // No interaction has been recorded, so the collection is empty.
             (None, Shape::Stringified) => json!([]),
@@ -66,6 +68,66 @@ pub(crate) fn infer_globals(
     globals
 }
 
+/// The value `getter` returns: its option, with each render sample's stack split at page URLs
+/// if the getter does so.
+fn called(getter: &Getter, options: &Options) -> Option<JsValue> {
+    let mut value = options.get(&getter.option)?.clone();
+    if let Some(origin) = &getter.page_origin
+        && let JsValue::Array(samples) = &mut value
+    {
+        let origin = options
+            .get(origin)
+            .and_then(JsValue::as_str)
+            .unwrap_or_default();
+        for sample in samples {
+            if let JsValue::Object(sample) = sample
+                && let Some(stack) = sample.get("s").and_then(JsValue::as_str)
+            {
+                let split = split_page_urls(stack, origin);
+                sample.insert("s".to_owned(), split);
+            }
+        }
+    }
+    Some(value)
+}
+
+/// Splits `stack` as the iframe's sample getter does. Each URL on `origin`, less a trailing
+/// `:line` or `:line:column`, becomes the index of that URL in a list of at most 64. Returns
+/// `[parts, urls]`, where `parts` alternates text and indices and ends with text.
+fn split_page_urls(stack: &str, origin: &str) -> JsValue {
+    const MAX_URLS: usize = 64;
+    static URL: LazyLock<Regex> =
+        LazyLock::new(|| Regex::new(r#"https?://[^\s)"'<>]+"#).expect("the URL pattern is valid"));
+    static POSITION: LazyLock<Regex> = LazyLock::new(|| {
+        Regex::new(r":[0-9]+(?::[0-9]+)?$").expect("the position pattern is valid")
+    });
+    let mut parts = Vec::new();
+    let mut urls: Vec<&str> = Vec::new();
+    let mut copied = 0;
+    for found in URL.find_iter(stack) {
+        let url = found.as_str();
+        let url = POSITION
+            .find(url)
+            .map_or(url, |position| &url[..position.start()]);
+        if url != origin && !url.starts_with(&format!("{origin}/")) {
+            continue;
+        }
+        let index = match urls.iter().position(|known| *known == url) {
+            Some(index) => index,
+            None if urls.len() >= MAX_URLS => continue,
+            None => {
+                urls.push(url);
+                urls.len() - 1
+            }
+        };
+        parts.push(json!(&stack[copied..found.start()]));
+        parts.push(json!(index));
+        copied = found.start() + url.len();
+    }
+    parts.push(json!(&stack[copied..]));
+    json!([parts, urls])
+}
+
 #[derive(Debug, Clone)]
 pub struct Field {
     pub name: String,
@@ -89,7 +151,10 @@ impl Field {
     #[must_use]
     pub(crate) fn option<'a>(&'a self, script: &'a ScriptState) -> Option<&'a str> {
         expression::option_key(&self.expression).or_else(|| match self.global()? {
-            (name, Shape::Called) => script.getters.get(name).map(String::as_str),
+            (name, Shape::Called) => script
+                .getters
+                .get(name)
+                .map(|getter| getter.option.as_str()),
             _ => None,
         })
     }
@@ -199,6 +264,37 @@ mod tests {
     use crate::challenge::state::Elapsed;
     use crate::challenge::tally::Tally;
 
+    /// Page URLs become indices into a list of distinct URLs; other hosts stay in the text.
+    #[test]
+    fn splits_stacks_at_page_urls() {
+        let stack = "Error\n    at f (https://captchatest.book.bi/app.js:1:20)\n    at g \
+                     (https://challenges.cloudflare.com/turnstile/v0/api.js:2:7)\n    at h \
+                     (https://captchatest.book.bi/app.js:3:4)";
+        assert_eq!(
+            split_page_urls(stack, "https://captchatest.book.bi"),
+            json!([
+                [
+                    "Error\n    at f (",
+                    0,
+                    ":1:20)\n    at g (https://challenges.cloudflare.com/turnstile/v0/api.js:2:7)\n    at h (",
+                    0,
+                    ":3:4)"
+                ],
+                ["https://captchatest.book.bi/app.js"]
+            ])
+        );
+        // As in the captured sessions, a stack without page URLs stays whole.
+        assert_eq!(
+            split_page_urls(stack, "https://example.com"),
+            json!([[stack], []])
+        );
+        assert_eq!(split_page_urls(stack, ""), json!([[stack], []]));
+        assert_eq!(
+            split_page_urls("at https://a.b:443/x.js:2:7", "https://a.b:443"),
+            json!([["at ", 0, ":2:7"], ["https://a.b:443/x.js"]])
+        );
+    }
+
     fn field(name: &str, text: &str) -> Field {
         Field {
             name: name.into(),
@@ -313,7 +409,13 @@ mod tests {
                 global: "tally".into(),
                 counters: vec!["a".into()],
             }),
-            getters: BTreeMap::from([("getter".into(), "opt".into())]),
+            getters: BTreeMap::from([(
+                "getter".into(),
+                Getter {
+                    option: "opt".into(),
+                    page_origin: None,
+                },
+            )]),
             ..ScriptState::default()
         };
         let options = Options::from_iter([("opt".to_owned(), json!(["x"]))]);