@cuxt/sandboxjs 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 nyariv
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,186 @@
+[![GitHub](https://img.shields.io/github/license/nyariv/SandboxJS)](https://github.com/nyariv/SandboxJS/blob/main/LICENSE) ![npm (scoped)](https://img.shields.io/npm/v/@nyariv/sandboxjs) ![Package size gzipped](https://img.shields.io/bundlephobia/minzip/@nyariv/sandboxjs) [![GitHub issues](https://img.shields.io/github/issues-raw/nyariv/SandboxJS)](https://github.com/nyariv/SandboxJS/issues) [![codecov](https://codecov.io/gh/nyariv/SandboxJS/branch/main/graph/badge.svg)](https://codecov.io/gh/nyariv/SandboxJS)
+
+# SandboxJS - Safe eval runtime
+
+This is a javascript sandboxing library. When embedding any kind of js code inside your app (either web or nodejs based) you are essentially giving access to the entire kingdom, hoping there is no malicious code in a dependency such as with supply chain attacks. For securing code, sandboxing is needed.
+
+>  a "sandbox" is a security mechanism for separating running programs, usually in an effort to mitigate system failures or software vulnerabilities from spreading. It is often used to execute untested or untrusted programs or code, possibly from unverified or untrusted third parties, suppliers, users or websites, without risking harm to the host machine or operating system. - Wikipedia
+
+There are many vulnerable modules available on the global scope of a js environment, and unfortunately it is way to easy to get access to that if 3rd party code is allowed to be included. The main way is through the `eval` or `Function` globals because they execute code in the global context. Trying to block access to some global components through proxies or limiting scope variables is fruitless because of one main issue: _every function inherits the `Function` prototype, and can invoke `eval` by calling its constructor_, essentially making `eval` at most two properties away from anything in js.
+
+Example:
+```javascript
+[].filter.constructor("alert('jailbreak')")()
+```
+
+To make matters worse, it is extremely difficult to blacklist functions because code is easily obfuscated. For example, it is possible to execute anything using only `(`, `)`, `[`, `]`, `!`, and `+`. ([source](http://www.jsfuck.com/))
+
+```javascript
+[+!+[]]+[] // This evaluates to the number one, go a head type that in console
+```
+
+**SandboxJS** solves this problem by parsing js code and executing it though its own js runtime, while in the process checking every single prototype function that is being called. This allows whitelisting anything and everything, regardless of obfuscation.
+
+This means that you can potentially give different libraries different permissions, such as allowing `fetch()` for one library, or allowing access to the `Node` prototype for another, depending what the library requires and nothing more, and any objects that are gotten from the sandbox will remain sandboxed when used outside of it.
+
+Additionaly, `eval` and `Function` are sandboxed as well, and can be used recursively safely, which is why they are considered safe globals in SandboxJS.
+
+There is an `audit` method that will return all the accessed functions and prototypes during runtime if you need to know what permissions to give a certain library.
+
+Since parsing and executing are separated, execution with SandboxJS can be sometimes even faster than `eval`, allowing to prepare the execution code ahead of time.
+
+## Installation
+
+```
+npm install @nyariv/sandboxjs
+```
+
+## Usage
+
+The following is the bare minimum of code for using SandboxJS. This assumes safe whilelisted defaults.
+
+```javascript
+const code = `return myTest;`;
+const scope = { myTest: "hello world" };
+const sandbox = new Sandbox();
+const exec = sandbox.compile(code);
+const result = exec(scope).run(); // result: "hello world"
+```
+
+It is possible to defined multiple scopes in case you are reusing scopes with multiple layers.
+
+```javascript
+const sandbox = new Sandbox();
+
+const scopeA = {a: 1};
+const scopeB = {b: 2};
+const scopeC = {c: 3};
+
+const code = `a = 4; let d = 5; let b = 6`;
+const exec = sandbox.compile(code);
+exec(scopeA, scopeB, scopeC).run();
+
+console.log(scopeA); // {a: 4}
+console.log(scopeB); // {b: 2}
+console.log(scopeC); // {c: 3, d: 5, b: 6}
+```
+
+You can set your own whilelisted prototypes and global properties like so (`alert` and `Node` are added to whitelist in the following code):
+
+```javascript
+const prototypeWhitelist = Sandbox.SAFE_PROTOTYPES;
+prototypeWhitelist.set(Node, new Set());
+
+const globals = {...Sandbox.SAFE_GLOBALS, alert};
+
+const sandbox = new Sandbox({globals, prototypeWhitelist});
+```
+
+You can audit a piece of code, which will permit all globals and prototypes but will return a json with accessed globals and prototypes over time.
+
+```javascript
+const code = `console.log("test")`;
+console.log(Sandbox.audit(code));
+```
+
+## Safe Globals
+
+- `globalThis`
+- `Function`
+- `eval`
+- `setTimeout` - excluded by default
+- `setInterval` - excluded by default
+- `clearTimeout` - excluded by default
+- `clearInterval` - excluded by default
+- `console`
+- `isFinite`
+- `isNaN`
+- `parseFloat`
+- `parseInt`
+- `decodeURI`
+- `decodeURIComponent`
+- `encodeURI`
+- `encodeURIComponent`
+- `escape`
+- `unescape`
+- `Boolean`
+- `Number`
+- `BigInt`
+- `String`
+- `Object`
+- `Array`
+- `Symbol`
+- `Error`
+- `EvalError`
+- `RangeError`
+- `ReferenceError`
+- `SyntaxError`
+- `TypeError`
+- `URIError`
+- `Int8Array`
+- `Uint8Array`
+- `Uint8ClampedArray`
+- `Int16Array`
+- `Uint16Array`
+- `Int32Array`
+- `Uint32Array`
+- `Float32Array`
+- `Float64Array`
+- `Map`
+- `Set`
+- `WeakMap`
+- `WeakSet`
+- `Promise`
+- `Intl`
+- `JSON`
+- `Math`
+
+# Safe Prototypes
+
+- `SandboxGlobal`
+- `Function`
+- `Boolean`
+- `Object`
+- `Number`
+- `BigInt`
+- `String`
+- `Date`
+- `RegExp`
+- `Error`
+- `Array`
+- `Int8Array`
+- `Uint8Array`
+- `Uint8ClampedArray`
+- `Int16Array`
+- `Uint16Array`
+- `Int32Array`
+- `Uint32Array`
+- `Float32Array`
+- `Float64Array`
+- `Map`
+- `Set`
+- `WeakMap`
+- `WeakSet`
+- `Promise`
+
+## Goals
+
+|Feature|Status|
+|---|---|
+|Prototype access protection|done|
+|Globals access protection|done|
+|Prototype proxying|done|
+|Single line sandboxing|done|
+|Multi line sandboxing|done|
+|Functions support|done|
+|Audit prototype and globals access|done|
+|Code blocks (try/catch, ifs, and loops)|done|
+|Async/await|done|
+|Execution time protection|done|
+|Extensibility|done|
+|Full ECMAScript support|90%|
+|Script source and import sandboxing|Won't fix - handled by 3rd party|
+|DOM ownership and inherited permissions|See [scope-js](https://github.com/nyariv/scope-js)|
+|Tests|done|
+
+📋 **[ECMAScript Feature Implementation Status](TODO.md)** - See which JavaScript features are supported and tested (~90% of core ES5-ES2018 features)

package/build/Sandbox.d.ts

@@ -0,0 +1,25 @@
+import { IExecContext, IOptionParams, IScope } from './utils.js';
+import { ExecReturn } from './executor.js';
+import SandboxExec from './SandboxExec.js';
+export { LocalScope, SandboxExecutionTreeError, SandboxCapabilityError, SandboxAccessError, SandboxError, } from './utils.js';
+export default class Sandbox extends SandboxExec {
+    constructor(options?: IOptionParams);
+    static audit<T>(code: string, scopes?: IScope[]): ExecReturn<T>;
+    static parse(code: string): import("./parser.js").IExecutionTree;
+    compile<T>(code: string, optimize?: boolean): (...scopes: IScope[]) => {
+        context: IExecContext;
+        run: () => T;
+    };
+    compileAsync<T>(code: string, optimize?: boolean): (...scopes: IScope[]) => {
+        context: IExecContext;
+        run: () => Promise<T>;
+    };
+    compileExpression<T>(code: string, optimize?: boolean): (...scopes: IScope[]) => {
+        context: IExecContext;
+        run: () => T;
+    };
+    compileExpressionAsync<T>(code: string, optimize?: boolean): (...scopes: IScope[]) => {
+        context: IExecContext;
+        run: () => Promise<T>;
+    };
+}

package/build/Sandbox.js

@@ -0,0 +1,62 @@
+import { createExecContext } from './utils.js';
+import { createEvalContext } from './eval.js';
+import parse from './parser.js';
+import SandboxExec from './SandboxExec.js';
+export { LocalScope, SandboxExecutionTreeError, SandboxCapabilityError, SandboxAccessError, SandboxError, } from './utils.js';
+export default class Sandbox extends SandboxExec {
+    constructor(options) {
+        super(options, createEvalContext());
+    }
+    static audit(code, scopes = []) {
+        const globals = {};
+        for (const i of Object.getOwnPropertyNames(globalThis)) {
+            globals[i] = globalThis[i];
+        }
+        const sandbox = new SandboxExec({
+            globals,
+            audit: true,
+        });
+        return sandbox.executeTree(createExecContext(sandbox, parse(code, true), createEvalContext()), scopes);
+    }
+    static parse(code) {
+        return parse(code);
+    }
+    compile(code, optimize = false) {
+        const parsed = parse(code, optimize);
+        const exec = (...scopes) => {
+            const context = createExecContext(this, parsed, this.evalContext);
+            return { context, run: () => this.executeTree(context, [...scopes]).result };
+        };
+        return exec;
+    }
+    compileAsync(code, optimize = false) {
+        const parsed = parse(code, optimize);
+        const exec = (...scopes) => {
+            const context = createExecContext(this, parsed, this.evalContext);
+            return {
+                context,
+                run: () => this.executeTreeAsync(context, [...scopes]).then((ret) => ret.result),
+            };
+        };
+        return exec;
+    }
+    compileExpression(code, optimize = false) {
+        const parsed = parse(code, optimize, true);
+        const exec = (...scopes) => {
+            const context = createExecContext(this, parsed, this.evalContext);
+            return { context, run: () => this.executeTree(context, [...scopes]).result };
+        };
+        return exec;
+    }
+    compileExpressionAsync(code, optimize = false) {
+        const parsed = parse(code, optimize, true);
+        const exec = (...scopes) => {
+            const context = createExecContext(this, parsed, this.evalContext);
+            return {
+                context,
+                run: () => this.executeTreeAsync(context, [...scopes]).then((ret) => ret.result),
+            };
+        };
+        return exec;
+    }
+}

package/build/SandboxExec.d.ts

@@ -0,0 +1,66 @@
+import { IEvalContext } from './eval.js';
+import { Change, ExecReturn } from './executor.js';
+import { IContext, IExecContext, IGlobals, IOptionParams, IScope, Scope, SubscriptionSubject, Ticks } from './utils.js';
+export { IOptions, IContext, IExecContext, LocalScope, SandboxExecutionTreeError, SandboxCapabilityError, SandboxAccessError, SandboxError, } from './utils.js';
+export default class SandboxExec {
+    evalContext?: IEvalContext | undefined;
+    readonly context: IContext;
+    readonly setSubscriptions: WeakMap<SubscriptionSubject, Map<string, Set<(modification: Change) => void>>>;
+    readonly changeSubscriptions: WeakMap<SubscriptionSubject, Set<(modification: Change) => void>>;
+    readonly sandboxFunctions: WeakMap<Function, IExecContext>;
+    private haltSubscriptions;
+    private resumeSubscriptions;
+    halted: boolean;
+    timeoutHandleCounter: number;
+    readonly setTimeoutHandles: Map<number, {
+        handle: number;
+        haltsub: {
+            unsubscribe: () => void;
+        };
+        contsub: {
+            unsubscribe: () => void;
+        };
+    }>;
+    readonly setIntervalHandles: Map<number, {
+        handle: number;
+        haltsub: {
+            unsubscribe: () => void;
+        };
+        contsub: {
+            unsubscribe: () => void;
+        };
+    }>;
+    constructor(options?: IOptionParams, evalContext?: IEvalContext | undefined);
+    static get SAFE_GLOBALS(): IGlobals;
+    static get SAFE_PROTOTYPES(): Map<any, Set<string>>;
+    subscribeGet(callback: (obj: SubscriptionSubject, name: string) => void, context: IExecContext): {
+        unsubscribe: () => void;
+    };
+    subscribeSet(obj: object, name: string, callback: (modification: Change) => void, context: SandboxExec | IExecContext): {
+        unsubscribe: () => void;
+    };
+    subscribeSetGlobal(obj: SubscriptionSubject, name: string, callback: (modification: Change) => void): {
+        unsubscribe: () => void;
+    };
+    subscribeHalt(cb: (args?: {
+        error: Error;
+        ticks: Ticks;
+        scope: Scope;
+        context: IExecContext;
+    }) => void): {
+        unsubscribe: () => void;
+    };
+    subscribeResume(cb: () => void): {
+        unsubscribe: () => void;
+    };
+    haltExecution(haltContext?: {
+        error: Error;
+        ticks: Ticks;
+        scope: Scope;
+        context: IExecContext;
+    }): void;
+    resumeExecution(): void;
+    getContext(fn: (...args: any[]) => any): IExecContext | undefined;
+    executeTree<T>(context: IExecContext, scopes?: IScope[]): ExecReturn<T>;
+    executeTreeAsync<T>(context: IExecContext, scopes?: IScope[]): Promise<ExecReturn<T>>;
+}

package/build/SandboxExec.js

@@ -0,0 +1,214 @@
+import { executeTree, executeTreeAsync } from './executor.js';
+import { createContext, SandboxExecutionQuotaExceededError, SandboxGlobal, } from './utils.js';
+export { LocalScope, SandboxExecutionTreeError, SandboxCapabilityError, SandboxAccessError, SandboxError, } from './utils.js';
+function subscribeSet(obj, name, callback, context) {
+    const names = context.setSubscriptions.get(obj) || new Map();
+    context.setSubscriptions.set(obj, names);
+    const callbacks = names.get(name) || new Set();
+    names.set(name, callbacks);
+    callbacks.add(callback);
+    let changeCbs;
+    const val = obj[name];
+    if (val instanceof Object) {
+        changeCbs = context.changeSubscriptions.get(val) || new Set();
+        changeCbs.add(callback);
+        context.changeSubscriptions.set(val, changeCbs);
+    }
+    return {
+        unsubscribe: () => {
+            callbacks.delete(callback);
+            changeCbs?.delete(callback);
+        },
+    };
+}
+export default class SandboxExec {
+    constructor(options, evalContext) {
+        this.evalContext = evalContext;
+        this.setSubscriptions = new WeakMap();
+        this.changeSubscriptions = new WeakMap();
+        this.sandboxFunctions = new WeakMap();
+        this.haltSubscriptions = new Set();
+        this.resumeSubscriptions = new Set();
+        this.halted = false;
+        this.timeoutHandleCounter = 0;
+        this.setTimeoutHandles = new Map();
+        this.setIntervalHandles = new Map();
+        const opt = Object.assign({
+            audit: false,
+            forbidFunctionCalls: false,
+            forbidFunctionCreation: false,
+            globals: SandboxExec.SAFE_GLOBALS,
+            prototypeWhitelist: SandboxExec.SAFE_PROTOTYPES,
+            prototypeReplacements: new Map(),
+        }, options || {});
+        this.context = createContext(this, opt);
+    }
+    static get SAFE_GLOBALS() {
+        return {
+            globalThis,
+            Function,
+            eval,
+            console: {
+                debug: console.debug,
+                error: console.error,
+                info: console.info,
+                log: console.log,
+                table: console.table,
+                warn: console.warn,
+            },
+            isFinite,
+            isNaN,
+            parseFloat,
+            parseInt,
+            decodeURI,
+            decodeURIComponent,
+            encodeURI,
+            encodeURIComponent,
+            escape,
+            unescape,
+            Boolean,
+            Number,
+            BigInt,
+            String,
+            Object,
+            Array,
+            Symbol,
+            Error,
+            EvalError,
+            RangeError,
+            ReferenceError,
+            SyntaxError,
+            TypeError,
+            URIError,
+            Int8Array,
+            Uint8Array,
+            Uint8ClampedArray,
+            Int16Array,
+            Uint16Array,
+            Int32Array,
+            Uint32Array,
+            Float32Array,
+            Float64Array,
+            Map,
+            Set,
+            WeakMap,
+            WeakSet,
+            Promise,
+            Intl,
+            JSON,
+            Math,
+            Date,
+            RegExp,
+        };
+    }
+    static get SAFE_PROTOTYPES() {
+        const protos = [
+            SandboxGlobal,
+            Function,
+            Boolean,
+            Number,
+            BigInt,
+            String,
+            Date,
+            Error,
+            Array,
+            Int8Array,
+            Uint8Array,
+            Uint8ClampedArray,
+            Int16Array,
+            Uint16Array,
+            Int32Array,
+            Uint32Array,
+            Float32Array,
+            Float64Array,
+            Map,
+            Set,
+            WeakMap,
+            WeakSet,
+            Promise,
+            Symbol,
+            Date,
+            RegExp,
+            // Fetch API
+            Response,
+            Request,
+            Headers,
+            FormData,
+        ];
+        const map = new Map();
+        protos.forEach((proto) => {
+            map.set(proto, new Set());
+        });
+        map.set(Object, new Set([
+            'constructor',
+            'name',
+            'entries',
+            'fromEntries',
+            'getOwnPropertyNames',
+            'is',
+            'keys',
+            'hasOwnProperty',
+            'isPrototypeOf',
+            'propertyIsEnumerable',
+            'toLocaleString',
+            'toString',
+            'valueOf',
+            'values',
+        ]));
+        return map;
+    }
+    subscribeGet(callback, context) {
+        context.getSubscriptions.add(callback);
+        return { unsubscribe: () => context.getSubscriptions.delete(callback) };
+    }
+    subscribeSet(obj, name, callback, context) {
+        return subscribeSet(obj, name, callback, context);
+    }
+    subscribeSetGlobal(obj, name, callback) {
+        return subscribeSet(obj, name, callback, this);
+    }
+    subscribeHalt(cb) {
+        this.haltSubscriptions.add(cb);
+        return {
+            unsubscribe: () => {
+                this.haltSubscriptions.delete(cb);
+            },
+        };
+    }
+    subscribeResume(cb) {
+        this.resumeSubscriptions.add(cb);
+        return {
+            unsubscribe: () => {
+                this.resumeSubscriptions.delete(cb);
+            },
+        };
+    }
+    haltExecution(haltContext) {
+        if (this.halted)
+            return;
+        this.halted = true;
+        for (const cb of this.haltSubscriptions) {
+            cb(haltContext);
+        }
+    }
+    resumeExecution() {
+        if (!this.halted)
+            return;
+        if (this.context.ticks.tickLimit && this.context.ticks.ticks >= this.context.ticks.tickLimit) {
+            throw new SandboxExecutionQuotaExceededError('Cannot resume execution: tick limit exceeded');
+        }
+        this.halted = false;
+        for (const cb of this.resumeSubscriptions) {
+            cb();
+        }
+    }
+    getContext(fn) {
+        return this.sandboxFunctions.get(fn);
+    }
+    executeTree(context, scopes = []) {
+        return executeTree(context.ctx.ticks, context, context.tree, scopes);
+    }
+    executeTreeAsync(context, scopes = []) {
+        return executeTreeAsync(context.ctx.ticks, context, context.tree, scopes);
+    }
+}

package/build/eval.d.ts

@@ -0,0 +1,27 @@
+import { lispifyFunction } from './parser.js';
+import { IExecContext } from './utils.js';
+export interface IEvalContext {
+    sandboxFunction: typeof sandboxFunction;
+    sandboxAsyncFunction: typeof sandboxAsyncFunction;
+    sandboxedEval: (func: SandboxFunction, context: IExecContext) => SandboxEval;
+    sandboxedSetTimeout: typeof sandboxedSetTimeout;
+    sandboxedSetInterval: typeof sandboxedSetInterval;
+    sandboxedClearTimeout: typeof sandboxedClearTimeout;
+    sandboxedClearInterval: typeof sandboxedClearInterval;
+    lispifyFunction: typeof lispifyFunction;
+}
+export type SandboxFunction = (code: string, ...args: string[]) => () => unknown;
+export type SandboxEval = (code: string) => unknown;
+export type SandboxSetTimeout = (handler: TimerHandler, timeout?: number, ...args: unknown[]) => any;
+export type SandboxSetInterval = (handler: TimerHandler, timeout?: number, ...args: unknown[]) => any;
+export type SandboxClearTimeout = (handle: number) => void;
+export type SandboxClearInterval = (handle: number) => void;
+export declare function createEvalContext(): IEvalContext;
+export declare function sandboxFunction(context: IExecContext): SandboxFunction;
+export type SandboxAsyncFunction = (code: string, ...args: string[]) => () => Promise<unknown>;
+export declare function sandboxAsyncFunction(context: IExecContext): SandboxAsyncFunction;
+export declare function sandboxedEval(func: SandboxFunction, context: IExecContext): SandboxEval;
+export declare function sandboxedSetTimeout(func: SandboxFunction, context: IExecContext): SandboxSetTimeout;
+export declare function sandboxedClearTimeout(context: IExecContext): SandboxClearTimeout;
+export declare function sandboxedClearInterval(context: IExecContext): SandboxClearInterval;
+export declare function sandboxedSetInterval(func: SandboxFunction, context: IExecContext): SandboxSetInterval;