@encharm/cws 4.3.0 → 4.4.1

package/src/headers/20/permission/fs_permission.h

@@ -0,0 +1,154 @@
+#ifndef SRC_PERMISSION_FS_PERMISSION_H_
+#define SRC_PERMISSION_FS_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "v8.h"
+
+#include <unordered_map>
+#include "permission/permission_base.h"
+#include "util.h"
+
+namespace node {
+
+namespace permission {
+
+class FSPermission final : public PermissionBase {
+ public:
+  void Apply(const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(PermissionScope perm, const std::string_view& param) override;
+
+  struct RadixTree {
+    struct Node {
+      std::string prefix;
+      std::unordered_map<char, Node*> children;
+      Node* wildcard_child;
+      bool is_leaf;
+
+      explicit Node(const std::string& pre)
+          : prefix(pre), wildcard_child(nullptr), is_leaf(false) {}
+
+      Node() : wildcard_child(nullptr), is_leaf(false) {}
+
+      Node* CreateChild(std::string prefix) {
+        if (prefix.empty() && !is_leaf) {
+          is_leaf = true;
+          return this;
+        }
+        char label = prefix[0];
+
+        Node* child = children[label];
+        if (child == nullptr) {
+          children[label] = new Node(prefix);
+          return children[label];
+        }
+
+        // swap prefix
+        unsigned int i = 0;
+        unsigned int prefix_len = prefix.length();
+        for (; i < child->prefix.length(); ++i) {
+          if (i > prefix_len || prefix[i] != child->prefix[i]) {
+            std::string parent_prefix = child->prefix.substr(0, i);
+            std::string child_prefix = child->prefix.substr(i);
+
+            child->prefix = child_prefix;
+            Node* split_child = new Node(parent_prefix);
+            split_child->children[child_prefix[0]] = child;
+            children[parent_prefix[0]] = split_child;
+
+            return split_child->CreateChild(prefix.substr(i));
+          }
+        }
+        child->is_leaf = true;
+        return child->CreateChild(prefix.substr(i));
+      }
+
+      Node* CreateWildcardChild() {
+        if (wildcard_child != nullptr) {
+          return wildcard_child;
+        }
+        wildcard_child = new Node();
+        return wildcard_child;
+      }
+
+      Node* NextNode(const std::string& path, unsigned int idx) {
+        if (idx >= path.length()) {
+          return nullptr;
+        }
+
+        auto it = children.find(path[idx]);
+        if (it == children.end()) {
+          return nullptr;
+        }
+        auto child = it->second;
+        // match prefix
+        unsigned int prefix_len = child->prefix.length();
+        for (unsigned int i = 0; i < path.length(); ++i) {
+          if (i >= prefix_len || child->prefix[i] == '*') {
+            return child;
+          }
+
+          // Handle optional trailing
+          // path = /home/subdirectory
+          // child = subdirectory/*
+          if (idx >= path.length() &&
+              child->prefix[i] == node::kPathSeparator) {
+            continue;
+          }
+
+          if (path[idx++] != child->prefix[i]) {
+            return nullptr;
+          }
+        }
+        return child;
+      }
+
+      // A node can be a *end* node and have children
+      // E.g: */slower*, */slown* are inserted:
+      // /slow
+      // ---> er
+      // ---> n
+      // If */slow* is inserted right after, it will create an
+      // empty node
+      // /slow
+      // ---> '\000' ASCII (0) || \0
+      // ---> er
+      // ---> n
+      bool IsEndNode() {
+        if (children.size() == 0) {
+          return true;
+        }
+        return is_leaf;
+      }
+    };
+
+    RadixTree();
+    ~RadixTree();
+    void Insert(const std::string& s);
+    bool Lookup(const std::string_view& s) { return Lookup(s, false); }
+    bool Lookup(const std::string_view& s, bool when_empty_return);
+
+   private:
+    Node* root_node_;
+  };
+
+ private:
+  void GrantAccess(PermissionScope scope, const std::string& param);
+  // fs granted on startup
+  RadixTree granted_in_fs_;
+  RadixTree granted_out_fs_;
+
+  bool deny_all_in_ = true;
+  bool deny_all_out_ = true;
+
+  bool allow_all_in_ = false;
+  bool allow_all_out_ = false;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_FS_PERMISSION_H_

package/src/headers/20/permission/inspector_permission.h

@@ -0,0 +1,29 @@
+#ifndef SRC_PERMISSION_INSPECTOR_PERMISSION_H_
+#define SRC_PERMISSION_INSPECTOR_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <string>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class InspectorPermission final : public PermissionBase {
+ public:
+  void Apply(const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(PermissionScope perm,
+                  const std::string_view& param = "") override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_INSPECTOR_PERMISSION_H_

package/src/headers/20/permission/permission.h

@@ -0,0 +1,74 @@
+#ifndef SRC_PERMISSION_PERMISSION_H_
+#define SRC_PERMISSION_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "debug_utils.h"
+#include "node_options.h"
+#include "permission/child_process_permission.h"
+#include "permission/fs_permission.h"
+#include "permission/inspector_permission.h"
+#include "permission/permission_base.h"
+#include "permission/worker_permission.h"
+#include "v8.h"
+
+#include <string_view>
+#include <unordered_map>
+
+namespace node {
+
+class Environment;
+
+namespace permission {
+
+#define THROW_IF_INSUFFICIENT_PERMISSIONS(env, perm_, resource_, ...)          \
+  do {                                                                         \
+    if (UNLIKELY(!(env)->permission()->is_granted(perm_, resource_))) {        \
+      node::permission::Permission::ThrowAccessDenied(                         \
+          (env), perm_, resource_);                                            \
+      return __VA_ARGS__;                                                      \
+    }                                                                          \
+  } while (0)
+
+class Permission {
+ public:
+  Permission();
+
+  FORCE_INLINE bool is_granted(const PermissionScope permission,
+                               const std::string_view& res = "") const {
+    if (LIKELY(!enabled_)) return true;
+    return is_scope_granted(permission, res);
+  }
+
+  FORCE_INLINE bool enabled() const { return enabled_; }
+
+  static PermissionScope StringToPermission(const std::string& perm);
+  static const char* PermissionToString(PermissionScope perm);
+  static void ThrowAccessDenied(Environment* env,
+                                PermissionScope perm,
+                                const std::string_view& res);
+
+  // CLI Call
+  void Apply(const std::vector<std::string>& allow, PermissionScope scope);
+  void EnablePermissions();
+
+ private:
+  COLD_NOINLINE bool is_scope_granted(const PermissionScope permission,
+                                      const std::string_view& res = "") const {
+    auto perm_node = nodes_.find(permission);
+    if (perm_node != nodes_.end()) {
+      return perm_node->second->is_granted(permission, res);
+    }
+    return false;
+  }
+
+  std::unordered_map<PermissionScope, std::shared_ptr<PermissionBase>> nodes_;
+  bool enabled_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_PERMISSION_H_

package/src/headers/20/permission/permission_base.h

@@ -0,0 +1,53 @@
+#ifndef SRC_PERMISSION_PERMISSION_BASE_H_
+#define SRC_PERMISSION_PERMISSION_BASE_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <map>
+#include <string>
+#include <string_view>
+#include "v8.h"
+
+namespace node {
+
+namespace permission {
+
+#define FILESYSTEM_PERMISSIONS(V)                                              \
+  V(FileSystem, "fs", PermissionsRoot)                                         \
+  V(FileSystemRead, "fs.read", FileSystem)                                     \
+  V(FileSystemWrite, "fs.write", FileSystem)
+
+#define CHILD_PROCESS_PERMISSIONS(V) V(ChildProcess, "child", PermissionsRoot)
+
+#define WORKER_THREADS_PERMISSIONS(V)                                          \
+  V(WorkerThreads, "worker", PermissionsRoot)
+
+#define INSPECTOR_PERMISSIONS(V) V(Inspector, "inspector", PermissionsRoot)
+
+#define PERMISSIONS(V)                                                         \
+  FILESYSTEM_PERMISSIONS(V)                                                    \
+  CHILD_PROCESS_PERMISSIONS(V)                                                 \
+  WORKER_THREADS_PERMISSIONS(V)                                                \
+  INSPECTOR_PERMISSIONS(V)
+
+#define V(name, _, __) k##name,
+enum class PermissionScope {
+  kPermissionsRoot = -1,
+  PERMISSIONS(V) kPermissionsCount
+};
+#undef V
+
+class PermissionBase {
+ public:
+  virtual void Apply(const std::vector<std::string>& allow,
+                     PermissionScope scope) = 0;
+  virtual bool is_granted(PermissionScope perm,
+                          const std::string_view& param = "") = 0;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_PERMISSION_BASE_H_

package/src/headers/20/permission/worker_permission.h

@@ -0,0 +1,29 @@
+#ifndef SRC_PERMISSION_WORKER_PERMISSION_H_
+#define SRC_PERMISSION_WORKER_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <vector>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class WorkerPermission final : public PermissionBase {
+ public:
+  void Apply(const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(PermissionScope perm,
+                  const std::string_view& param = "") override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_WORKER_PERMISSION_H_

package/src/headers/20/pipe_wrap.h

@@ -0,0 +1,80 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+#ifndef SRC_PIPE_WRAP_H_
+#define SRC_PIPE_WRAP_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "async_wrap.h"
+#include "connection_wrap.h"
+
+namespace node {
+
+class ExternalReferenceRegistry;
+class Environment;
+
+class PipeWrap : public ConnectionWrap<PipeWrap, uv_pipe_t> {
+ public:
+  enum SocketType {
+    SOCKET,
+    SERVER,
+    IPC
+  };
+
+  static v8::MaybeLocal<v8::Object> Instantiate(Environment* env,
+                                                AsyncWrap* parent,
+                                                SocketType type);
+  static void Initialize(v8::Local<v8::Object> target,
+                         v8::Local<v8::Value> unused,
+                         v8::Local<v8::Context> context,
+                         void* priv);
+
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(PipeWrap)
+  SET_SELF_SIZE(PipeWrap)
+
+ private:
+  PipeWrap(Environment* env,
+           v8::Local<v8::Object> object,
+           ProviderType provider,
+           bool ipc);
+
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Bind(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Listen(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Connect(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Open(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+#ifdef _WIN32
+  static void SetPendingInstances(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+#endif
+  static void Fchmod(const v8::FunctionCallbackInfo<v8::Value>& args);
+};
+
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_PIPE_WRAP_H_

package/src/headers/20/req_wrap-inl.h

@@ -0,0 +1,171 @@
+#ifndef SRC_REQ_WRAP_INL_H_
+#define SRC_REQ_WRAP_INL_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "req_wrap.h"
+#include "async_wrap-inl.h"
+#include "uv.h"
+
+namespace node {
+
+ReqWrapBase::ReqWrapBase(Environment* env) {
+  CHECK(env->has_run_bootstrapping_code());
+  env->req_wrap_queue()->PushBack(this);
+}
+
+template <typename T>
+ReqWrap<T>::ReqWrap(Environment* env,
+                    v8::Local<v8::Object> object,
+                    AsyncWrap::ProviderType provider)
+    : AsyncWrap(env, object, provider),
+      ReqWrapBase(env) {
+  MakeWeak();
+  Reset();
+}
+
+template <typename T>
+ReqWrap<T>::~ReqWrap() {}
+
+template <typename T>
+void ReqWrap<T>::Dispatched() {
+  req_.data = this;
+}
+
+template <typename T>
+void ReqWrap<T>::Reset() {
+  original_callback_ = nullptr;
+  req_.data = nullptr;
+}
+
+template <typename T>
+ReqWrap<T>* ReqWrap<T>::from_req(T* req) {
+  return ContainerOf(&ReqWrap<T>::req_, req);
+}
+
+template <typename T>
+void ReqWrap<T>::Cancel() {
+  if (req_.data == this)  // Only cancel if already dispatched.
+    uv_cancel(reinterpret_cast<uv_req_t*>(&req_));
+}
+
+template <typename T>
+AsyncWrap* ReqWrap<T>::GetAsyncWrap() {
+  return this;
+}
+
+// Below is dark template magic designed to invoke libuv functions that
+// initialize uv_req_t instances in a unified fashion, to allow easier
+// tracking of active/inactive requests.
+
+// Invoke a generic libuv function that initializes uv_req_t instances.
+// This is, unfortunately, necessary since they come in three different
+// variants that can not all be invoked in the same way:
+// - int uv_foo(uv_loop_t* loop, uv_req_t* request, ...);
+// - int uv_foo(uv_req_t* request, ...);
+// - void uv_foo(uv_req_t* request, ...);
+template <typename ReqT, typename T>
+struct CallLibuvFunction;
+
+// Detect `int uv_foo(uv_loop_t* loop, uv_req_t* request, ...);`.
+template <typename ReqT, typename... Args>
+struct CallLibuvFunction<ReqT, int(*)(uv_loop_t*, ReqT*, Args...)> {
+  using T = int(*)(uv_loop_t*, ReqT*, Args...);
+  template <typename... PassedArgs>
+  static int Call(T fn, uv_loop_t* loop, ReqT* req, PassedArgs... args) {
+    return fn(loop, req, args...);
+  }
+};
+
+// Detect `int uv_foo(uv_req_t* request, ...);`.
+template <typename ReqT, typename... Args>
+struct CallLibuvFunction<ReqT, int(*)(ReqT*, Args...)> {
+  using T = int(*)(ReqT*, Args...);
+  template <typename... PassedArgs>
+  static int Call(T fn, uv_loop_t* loop, ReqT* req, PassedArgs... args) {
+    return fn(req, args...);
+  }
+};
+
+// Detect `void uv_foo(uv_req_t* request, ...);`.
+template <typename ReqT, typename... Args>
+struct CallLibuvFunction<ReqT, void(*)(ReqT*, Args...)> {
+  using T = void(*)(ReqT*, Args...);
+  template <typename... PassedArgs>
+  static int Call(T fn, uv_loop_t* loop, ReqT* req, PassedArgs... args) {
+    fn(req, args...);
+    return 0;
+  }
+};
+
+// This is slightly darker magic: This template is 'applied' to each parameter
+// passed to the libuv function. If the parameter type (aka `T`) is a
+// function type, it is assumed that this it is the request callback, and a
+// wrapper that calls the original callback is created.
+// If not, the parameter is passed through verbatim.
+template <typename ReqT, typename T>
+struct MakeLibuvRequestCallback {
+  static T For(ReqWrap<ReqT>* req_wrap, T v) {
+    static_assert(!is_callable<T>::value,
+                  "MakeLibuvRequestCallback missed a callback");
+    return v;
+  }
+};
+
+// Match the `void callback(uv_req_t*, ...);` signature that all libuv
+// callbacks use.
+template <typename ReqT, typename... Args>
+struct MakeLibuvRequestCallback<ReqT, void(*)(ReqT*, Args...)> {
+  using F = void(*)(ReqT* req, Args... args);
+
+  static void Wrapper(ReqT* req, Args... args) {
+    BaseObjectPtr<ReqWrap<ReqT>> req_wrap{ReqWrap<ReqT>::from_req(req)};
+    req_wrap->Detach();
+    req_wrap->env()->DecreaseWaitingRequestCounter();
+    F original_callback = reinterpret_cast<F>(req_wrap->original_callback_);
+    original_callback(req, args...);
+  }
+
+  static F For(ReqWrap<ReqT>* req_wrap, F v) {
+    CHECK_NULL(req_wrap->original_callback_);
+    req_wrap->original_callback_ =
+        reinterpret_cast<typename ReqWrap<ReqT>::callback_t>(v);
+    return Wrapper;
+  }
+};
+
+template <typename T>
+template <typename LibuvFunction, typename... Args>
+int ReqWrap<T>::Dispatch(LibuvFunction fn, Args... args) {
+  Dispatched();
+  // This expands as:
+  //
+  // int err = fn(env()->event_loop(), req(), arg1, arg2, Wrapper, arg3, ...)
+  //              ^                                       ^        ^
+  //              |                                       |        |
+  //              \-- Omitted if `fn` has no              |        |
+  //                  first `uv_loop_t*` argument         |        |
+  //                                                      |        |
+  //        A function callback whose first argument      |        |
+  //        matches the libuv request type is replaced ---/        |
+  //        by the `Wrapper` method defined above                  |
+  //                                                               |
+  //               Other (non-function) arguments are passed  -----/
+  //               through verbatim
+  int err = CallLibuvFunction<T, LibuvFunction>::Call(
+      fn,
+      env()->event_loop(),
+      req(),
+      MakeLibuvRequestCallback<T, Args>::For(this, args)...);
+  if (err >= 0) {
+    ClearWeak();
+    env()->IncreaseWaitingRequestCounter();
+  }
+  return err;
+}
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_REQ_WRAP_INL_H_

package/src/headers/20/req_wrap.h

@@ -0,0 +1,77 @@
+#ifndef SRC_REQ_WRAP_H_
+#define SRC_REQ_WRAP_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "async_wrap.h"
+#include "util.h"
+#include "v8.h"
+
+namespace node {
+
+class Environment;
+
+class ReqWrapBase {
+ public:
+  explicit inline ReqWrapBase(Environment* env);
+
+  virtual ~ReqWrapBase() = default;
+
+  virtual void Cancel() = 0;
+  virtual AsyncWrap* GetAsyncWrap() = 0;
+
+ private:
+  friend int GenDebugSymbols();
+  friend class Environment;
+
+  ListNode<ReqWrapBase> req_wrap_queue_;
+};
+
+template <typename T>
+class ReqWrap : public AsyncWrap, public ReqWrapBase {
+ public:
+  inline ReqWrap(Environment* env,
+                 v8::Local<v8::Object> object,
+                 AsyncWrap::ProviderType provider);
+  inline ~ReqWrap() override;
+  // Call this after the req has been dispatched, if that did not already
+  // happen by using Dispatch().
+  inline void Dispatched();
+  // Call this after a request has finished, if re-using this object is planned.
+  inline void Reset();
+  T* req() { return &req_; }
+  inline void Cancel() final;
+  inline AsyncWrap* GetAsyncWrap() override;
+
+  static ReqWrap* from_req(T* req);
+
+  template <typename LibuvFunction, typename... Args>
+  inline int Dispatch(LibuvFunction fn, Args... args);
+
+ private:
+  friend int GenDebugSymbols();
+
+  // Adding `friend struct MakeLibuvRequestCallback` is not enough anymore
+  // for some reason. Consider this private.
+ public:
+  typedef void (*callback_t)();
+  callback_t original_callback_ = nullptr;
+
+ protected:
+  // req_wrap_queue_ needs to be at a fixed offset from the start of the class
+  // because it is used by ContainerOf to calculate the address of the embedding
+  // ReqWrap. ContainerOf compiles down to simple, fixed pointer arithmetic. It
+  // is also used by src/node_postmortem_metadata.cc to calculate offsets and
+  // generate debug symbols for ReqWrap, which assumes that the position of
+  // members in memory are predictable. sizeof(req_) depends on the type of T,
+  // so req_wrap_queue_ would no longer be at a fixed offset if it came after
+  // req_. For more information please refer to
+  // `doc/contributing/node-postmortem-support.md`
+  T req_;
+};
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_REQ_WRAP_H_