@ai-ecoverse/slicc-kernel 1.170.3 → 1.170.4

package/dist/node.js

@@ -3695,7 +3695,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.170.3" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.170.4" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -5602,6 +5602,78 @@ var CronService = class {
   }
 };
 
+// src/kernel/net/placeholder-floor.ts
+var PLACEHOLDER = /fnox_proxy_[0-9a-f]{24}/;
+var ESCAPE = /%([0-9a-f]{2})/gi;
+var BASIC = /\bbasic\b(.*)/is;
+var PERCENT_LAYERS = 8;
+var BASE64_GROUP = 4;
+var PLACEHOLDER_REFUSED = "refused: this request has a sealed placeholder in its URL, a header or a Basic credential, and nothing fills it, so it was not sent";
+var PlaceholderRefused = class extends Error {
+  status = 403;
+  code = "EACCES";
+  constructor() {
+    super(PLACEHOLDER_REFUSED);
+  }
+};
+function carries(text) {
+  let layer = text;
+  for (let i = 0; i < PERCENT_LAYERS; i++) {
+    if (PLACEHOLDER.test(layer)) return true;
+    const next3 = layer.replace(
+      ESCAPE,
+      (_, hex4) => String.fromCharCode(Number.parseInt(hex4, 16))
+    );
+    if (next3 === layer) return false;
+    layer = next3;
+  }
+  return PLACEHOLDER.test(layer);
+}
+function basicCarries(value2) {
+  const credential = BASIC.exec(value2)?.[1];
+  if (credential === void 0) return false;
+  const letters = credential.replace(/[^A-Za-z0-9+/_-]/g, "").replaceAll("-", "+").replaceAll("_", "/");
+  for (let shift = 0; shift < BASE64_GROUP; shift++) {
+    const part = letters.slice(shift);
+    const whole = part.length % BASE64_GROUP === 1 ? part.slice(0, -1) : part;
+    if (carries(atob(whole))) return true;
+  }
+  return false;
+}
+function headersCarry(headers) {
+  return headers.some(
+    ([name2, value2]) => carries(name2.toLowerCase()) || carries(value2) || basicCarries(value2)
+  );
+}
+function urlCarries(url) {
+  return carries(url) || URL.canParse(url) && carries(new URL(url).href);
+}
+function refuse(request) {
+  if (urlCarries(request.url) || headersCarry(request.headers)) throw new PlaceholderRefused();
+}
+function refuseSocket(request) {
+  refuse(request);
+  if (request.protocols.some(carries)) throw new PlaceholderRefused();
+}
+function placeholderFloor(inner) {
+  const open = inner.websocket?.bind(inner);
+  return {
+    get traits() {
+      return inner.traits;
+    },
+    ...open ? {
+      websocket: async (request) => {
+        refuseSocket(request);
+        return open(request);
+      }
+    } : {},
+    async fetch(request, owner) {
+      refuse(request);
+      return inner.fetch(request, owner);
+    }
+  };
+}
+
 // src/kernel/net/ws-queue.ts
 var INBOUND_LIMIT = 16 * 1024 * 1024;
 var MESSAGE_LIMIT = 64 * 1024 * 1024;
@@ -6176,7 +6248,8 @@ var RealmProxy = class {
       });
     } catch (e) {
       waiting.abort();
-      throw new HttpError(502, e instanceof Error ? e.message : String(e));
+      const status = e instanceof PlaceholderRefused ? e.status : 502;
+      throw new HttpError(status, e instanceof Error ? e.message : String(e));
     }
     ctx.idle.ms = Number.POSITIVE_INFINITY;
     try {
@@ -6390,7 +6463,7 @@ async function relay(socket, conn) {
 // src/fs/attest.ts
 var ATTEST_MAX = 1024 * 1024;
 var UNOWNED = 1e3;
-function refuse(code, path, why) {
+function refuse2(code, path, why) {
   throw Object.assign(new Error(`attest ${path}: ${why}`), { code });
 }
 function chainOf(path) {
@@ -6432,11 +6505,11 @@ async function trustedParents(fs, path, o) {
   const parents = [];
   for (const dir of chainOf(path).slice(0, -1)) {
     const st = await fs.lstat(dir);
-    if (st.isSymbolicLink) refuse("EACCES", path, `${dir} is a symlink`);
-    if (!st.isDirectory) refuse("ENOTDIR", path, `${dir} is not a directory`);
+    if (st.isSymbolicLink) refuse2("EACCES", path, `${dir} is a symlink`);
+    if (!st.isDirectory) refuse2("ENOTDIR", path, `${dir} is not a directory`);
     const perm = owned(dir, st);
     if (o.users !== "off" && (perm.uid !== 0 || (perm.mode & 18) !== 0)) {
-      refuse("EACCES", path, `${dir} is not root-owned or is writable by group or others`);
+      refuse2("EACCES", path, `${dir} is not root-owned or is writable by group or others`);
     }
     parents.push(perm);
   }
@@ -6444,27 +6517,27 @@ async function trustedParents(fs, path, o) {
 }
 async function attest(fs, asked, o) {
   if (typeof asked !== "string" || !asked.startsWith("/")) {
-    refuse("EINVAL", String(asked), "not an absolute path");
+    refuse2("EINVAL", String(asked), "not an absolute path");
   }
   const path = normalizePath(asked);
   const mount = o.mounts.find((target) => {
     const at = normalizePath(target);
     return at === "/" || under(path, at);
   });
-  if (mount !== void 0) refuse("EACCES", path, `under the mount ${mount}`);
+  if (mount !== void 0) refuse2("EACCES", path, `under the mount ${mount}`);
   const parents = await trustedParents(fs, path, o);
   for (let tries = 0; ; tries++) {
     const before = await fs.lstat(path);
-    if (before.isSymbolicLink) refuse("EACCES", path, "is a symlink");
+    if (before.isSymbolicLink) refuse2("EACCES", path, "is a symlink");
     if (!before.isFile)
-      refuse(before.isDirectory ? "EISDIR" : "EINVAL", path, "is not a regular file");
-    if (before.size > ATTEST_MAX) refuse("EFBIG", path, `is over ${ATTEST_MAX} bytes`);
+      refuse2(before.isDirectory ? "EISDIR" : "EINVAL", path, "is not a regular file");
+    if (before.size > ATTEST_MAX) refuse2("EFBIG", path, `is over ${ATTEST_MAX} bytes`);
     const bytes = (await fs.readFileBuffer(path)).slice();
     const after = await fs.lstat(path);
     if (unchanged(before, after, bytes)) {
       return attested(path, after, bytes, await sha256(bytes), o, parents);
     }
-    if (tries >= 1) refuse("EAGAIN", path, "changed while it was read");
+    if (tries >= 1) refuse2("EAGAIN", path, "changed while it was read");
   }
 }
 var WATCH_DEBOUNCE_MS = 50;
@@ -11702,7 +11775,7 @@ function encodeSabResult(result) {
           message: result.message,
           ...result.direct ? { direct: true } : {},
           ...result.dev !== void 0 ? { dev: result.dev } : {},
-          ...result.detail === "transport" ? { detail: result.detail } : {}
+          ...result.detail ? { detail: result.detail } : {}
         })
       )
     };
@@ -15116,22 +15189,28 @@ var HttpHandles = class {
       return response.redirected ? { ...head, json: { ...head.json, redirected: true } } : head;
     } catch (e) {
       entry.upload?.cancel();
-      const text = message2(e);
-      if (port !== void 0) return { ok: false, errno: codeOf2(e), message: text };
-      const status = e.status;
-      if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
-        const code = codeOf2(e);
-        const errno3 = text === NO_TRANSPORT ? "ENETUNREACH" : code !== "EIO" ? code : "ECONNREFUSED";
-        const failed3 = e.detail === "transport";
-        return { ok: false, errno: errno3, message: text, ...failed3 ? { detail: "transport" } : {} };
-      }
-      entry.body = once(new TextEncoder().encode(text))[Symbol.asyncIterator]();
-      return this.headOf(handle, req.url, {
-        status,
-        statusText: "",
-        headers: [["content-type", "text/plain; charset=utf-8"]]
-      });
+      if (port !== void 0) return { ok: false, errno: codeOf2(e), message: message2(e) };
+      return this.failure(handle, req, e, entry);
+    }
+  }
+  failure(handle, req, e, entry) {
+    const text = message2(e);
+    if (e instanceof PlaceholderRefused) {
+      return { ok: false, errno: e.code, message: text, detail: "placeholder" };
     }
+    const status = e.status;
+    if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
+      const code = codeOf2(e);
+      const errno3 = text === NO_TRANSPORT ? "ENETUNREACH" : code !== "EIO" ? code : "ECONNREFUSED";
+      const failed3 = e.detail === "transport";
+      return { ok: false, errno: errno3, message: text, ...failed3 ? { detail: "transport" } : {} };
+    }
+    entry.body = once(new TextEncoder().encode(text))[Symbol.asyncIterator]();
+    return this.headOf(handle, req.url, {
+      status,
+      statusText: "",
+      headers: [["content-type", "text/plain; charset=utf-8"]]
+    });
   }
   headOf(handle, url, response) {
     const { status, statusText, headers } = response;
@@ -18230,7 +18309,7 @@ var HEAD_MAX = 16 * 1024;
 var ANY_PLACEHOLDER = /fnox_proxy_[0-9a-f]{24}/g;
 var REQUEST_LINE2 = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+) ([\x21-\x7e]+) HTTP\/1\.[01]$/;
 var HEADER_LINE = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+):[ \t]*(.*?)[ \t]*$/;
-var BASIC = /^(Basic[ \t]+)([A-Za-z0-9+/]+={0,2})$/i;
+var BASIC2 = /^(Basic[ \t]+)([A-Za-z0-9+/]+={0,2})$/i;
 var encoder8 = new TextEncoder();
 function binary(text) {
   let out = "";
@@ -18246,7 +18325,7 @@ function sniffHttp1(start2) {
   return "no";
 }
 function basicOf(value2) {
-  const m = BASIC.exec(value2);
+  const m = BASIC2.exec(value2);
   if (!m) return void 0;
   try {
     return { scheme: m[1], decoded: atob(m[2]) };
@@ -25254,7 +25333,8 @@ function replayingHops(inner, heldMs = HELD_MS) {
       return { ...inner.traits, manualRedirects: true };
     },
     ...inner.websocket ? { websocket: inner.websocket.bind(inner) } : {},
-    async fetch(request, owner = KERNEL) {
+    async fetch(request, caller) {
+      const owner = caller ?? KERNEL;
       const key = keyOf3(owner, request.method, request.url);
       const waiting = held.get(key);
       if (waiting && waiting.fingerprint === fingerprint(request.headers)) {
@@ -25263,7 +25343,7 @@ function replayingHops(inner, heldMs = HELD_MS) {
         return replay(waiting);
       }
       if (waiting) drop(key);
-      const response = await inner.fetch(request);
+      const response = await inner.fetch(request, caller);
       if (!response.redirects?.length) return response;
       return replay({
         owner,
@@ -30990,7 +31070,7 @@ var Launcher = class {
       ...options.env
     };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
-    this.transport = replayingHops(options.transport ?? missingTransport());
+    this.transport = placeholderFloor(replayingHops(options.transport ?? missingTransport()));
     this.announcedTraits = JSON.stringify(this.transport.traits);
     this.uplink = options.uplink;
     this.routes = new Routes(options.uplink?.traits.ipv6 === true);