@encharm/cws 4.4.0 → 4.5.1

package/src/headers/22/permission/fs_permission.h

@@ -0,0 +1,167 @@
+#ifndef SRC_PERMISSION_FS_PERMISSION_H_
+#define SRC_PERMISSION_FS_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "v8.h"
+
+#include <unordered_map>
+#include "permission/permission_base.h"
+#include "util.h"
+
+namespace node {
+
+namespace permission {
+
+class FSPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param) const override;
+
+  struct RadixTree {
+    struct Node {
+      std::string prefix;
+      std::unordered_map<char, Node*> children;
+      Node* wildcard_child;
+      bool is_leaf;
+
+      explicit Node(const std::string& pre)
+          : prefix(pre), wildcard_child(nullptr), is_leaf(false) {}
+
+      Node() : wildcard_child(nullptr), is_leaf(false) {}
+
+      Node* CreateChild(const std::string& path_prefix) {
+        if (path_prefix.empty() && !is_leaf) {
+          is_leaf = true;
+          return this;
+        }
+
+        CHECK(!path_prefix.empty());
+        char label = path_prefix[0];
+
+        Node* child = children[label];
+        if (child == nullptr) {
+          children[label] = new Node(path_prefix);
+          return children[label];
+        }
+
+        // swap prefix
+        size_t i = 0;
+        size_t prefix_len = path_prefix.length();
+        for (; i < child->prefix.length(); ++i) {
+          if (i > prefix_len || path_prefix[i] != child->prefix[i]) {
+            std::string parent_prefix = child->prefix.substr(0, i);
+            std::string child_prefix = child->prefix.substr(i);
+
+            child->prefix = child_prefix;
+            Node* split_child = new Node(parent_prefix);
+            split_child->children[child_prefix[0]] = child;
+            children[parent_prefix[0]] = split_child;
+
+            return split_child->CreateChild(path_prefix.substr(i));
+          }
+        }
+        child->is_leaf = true;
+        return child->CreateChild(path_prefix.substr(i));
+      }
+
+      Node* CreateWildcardChild() {
+        if (wildcard_child != nullptr) {
+          return wildcard_child;
+        }
+        wildcard_child = new Node();
+        return wildcard_child;
+      }
+
+      Node* NextNode(const std::string& path, size_t idx) const {
+        if (idx >= path.length()) {
+          return nullptr;
+        }
+
+        // wildcard node takes precedence
+        if (children.size() > 1) {
+          auto it = children.find('*');
+          if (it != children.end()) {
+            return it->second;
+          }
+        }
+
+        auto it = children.find(path[idx]);
+        if (it == children.end()) {
+          return nullptr;
+        }
+        auto child = it->second;
+        // match prefix
+        size_t prefix_len = child->prefix.length();
+        for (size_t i = 0; i < path.length(); ++i) {
+          if (i >= prefix_len || child->prefix[i] == '*') {
+            return child;
+          }
+
+          // Handle optional trailing
+          // path = /home/subdirectory
+          // child = subdirectory/*
+          if (idx >= path.length() &&
+              child->prefix[i] == node::kPathSeparator) {
+            continue;
+          }
+
+          if (path[idx++] != child->prefix[i]) {
+            return nullptr;
+          }
+        }
+        return child;
+      }
+
+      // A node can be a *end* node and have children
+      // E.g: */slower*, */slown* are inserted:
+      // /slow
+      // ---> er
+      // ---> n
+      // If */slow* is inserted right after, it will create an
+      // empty node
+      // /slow
+      // ---> '\000' ASCII (0) || \0
+      // ---> er
+      // ---> n
+      bool IsEndNode() const {
+        if (children.empty()) {
+          return true;
+        }
+        return is_leaf;
+      }
+    };
+
+    RadixTree();
+    ~RadixTree();
+    void Insert(const std::string& s);
+    bool Lookup(const std::string_view& s) const { return Lookup(s, false); }
+    bool Lookup(const std::string_view& s, bool when_empty_return) const;
+
+   private:
+    Node* root_node_;
+  };
+
+ private:
+  void GrantAccess(PermissionScope scope, const std::string& param);
+  // fs granted on startup
+  RadixTree granted_in_fs_;
+  RadixTree granted_out_fs_;
+
+  bool deny_all_in_ = true;
+  bool deny_all_out_ = true;
+
+  bool allow_all_in_ = false;
+  bool allow_all_out_ = false;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_FS_PERMISSION_H_

package/src/headers/22/permission/inspector_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_INSPECTOR_PERMISSION_H_
+#define SRC_PERMISSION_INSPECTOR_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <string>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class InspectorPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_INSPECTOR_PERMISSION_H_

package/src/headers/22/permission/permission.h

@@ -0,0 +1,99 @@
+#ifndef SRC_PERMISSION_PERMISSION_H_
+#define SRC_PERMISSION_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "debug_utils.h"
+#include "node_options.h"
+#include "permission/child_process_permission.h"
+#include "permission/fs_permission.h"
+#include "permission/inspector_permission.h"
+#include "permission/permission_base.h"
+#include "permission/wasi_permission.h"
+#include "permission/worker_permission.h"
+#include "v8.h"
+
+#include <string_view>
+#include <unordered_map>
+
+namespace node {
+
+class Environment;
+
+namespace fs {
+class FSReqBase;
+}
+
+namespace permission {
+
+#define THROW_IF_INSUFFICIENT_PERMISSIONS(env, perm_, resource_, ...)          \
+  do {                                                                         \
+    if (!env->permission()->is_granted(env, perm_, resource_)) [[unlikely]] {  \
+      node::permission::Permission::ThrowAccessDenied(                         \
+          (env), perm_, resource_);                                            \
+      return __VA_ARGS__;                                                      \
+    }                                                                          \
+  } while (0)
+
+#define ASYNC_THROW_IF_INSUFFICIENT_PERMISSIONS(                               \
+    env, wrap, perm_, resource_, ...)                                          \
+  do {                                                                         \
+    if (!env->permission()->is_granted(env, perm_, resource_)) [[unlikely]] {  \
+      node::permission::Permission::AsyncThrowAccessDenied(                    \
+          (env), wrap, perm_, resource_);                                      \
+      return __VA_ARGS__;                                                      \
+    }                                                                          \
+  } while (0)
+
+class Permission {
+ public:
+  Permission();
+
+  FORCE_INLINE bool is_granted(Environment* env,
+                               const PermissionScope permission,
+                               const std::string_view& res = "") const {
+    if (!enabled_) [[likely]] {
+      return true;
+    }
+    return is_scope_granted(env, permission, res);
+  }
+
+  FORCE_INLINE bool enabled() const { return enabled_; }
+
+  static PermissionScope StringToPermission(const std::string& perm);
+  static const char* PermissionToString(PermissionScope perm);
+  static void ThrowAccessDenied(Environment* env,
+                                PermissionScope perm,
+                                const std::string_view& res);
+  static void AsyncThrowAccessDenied(Environment* env,
+                                     fs::FSReqBase* req_wrap,
+                                     PermissionScope perm,
+                                     const std::string_view& res);
+
+  // CLI Call
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope);
+  void EnablePermissions();
+
+ private:
+  COLD_NOINLINE bool is_scope_granted(Environment* env,
+                                      const PermissionScope permission,
+                                      const std::string_view& res = "") const {
+    auto perm_node = nodes_.find(permission);
+    if (perm_node != nodes_.end()) {
+      return perm_node->second->is_granted(env, permission, res);
+    }
+    return false;
+  }
+
+  std::unordered_map<PermissionScope, std::shared_ptr<PermissionBase>> nodes_;
+  bool enabled_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_PERMISSION_H_

package/src/headers/22/permission/permission_base.h

@@ -0,0 +1,60 @@
+#ifndef SRC_PERMISSION_PERMISSION_BASE_H_
+#define SRC_PERMISSION_PERMISSION_BASE_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <map>
+#include <string>
+#include <string_view>
+#include "v8.h"
+
+namespace node {
+
+class Environment;
+
+namespace permission {
+
+#define FILESYSTEM_PERMISSIONS(V)                                              \
+  V(FileSystem, "fs", PermissionsRoot)                                         \
+  V(FileSystemRead, "fs.read", FileSystem)                                     \
+  V(FileSystemWrite, "fs.write", FileSystem)
+
+#define CHILD_PROCESS_PERMISSIONS(V) V(ChildProcess, "child", PermissionsRoot)
+
+#define WASI_PERMISSIONS(V) V(WASI, "wasi", PermissionsRoot)
+
+#define WORKER_THREADS_PERMISSIONS(V)                                          \
+  V(WorkerThreads, "worker", PermissionsRoot)
+
+#define INSPECTOR_PERMISSIONS(V) V(Inspector, "inspector", PermissionsRoot)
+
+#define PERMISSIONS(V)                                                         \
+  FILESYSTEM_PERMISSIONS(V)                                                    \
+  CHILD_PROCESS_PERMISSIONS(V)                                                 \
+  WASI_PERMISSIONS(V)                                                          \
+  WORKER_THREADS_PERMISSIONS(V)                                                \
+  INSPECTOR_PERMISSIONS(V)
+
+#define V(name, _, __) k##name,
+enum class PermissionScope {
+  kPermissionsRoot = -1,
+  PERMISSIONS(V) kPermissionsCount
+};
+#undef V
+
+class PermissionBase {
+ public:
+  virtual void Apply(Environment* env,
+                     const std::vector<std::string>& allow,
+                     PermissionScope scope) = 0;
+  virtual bool is_granted(Environment* env,
+                          PermissionScope perm,
+                          const std::string_view& param = "") const = 0;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_PERMISSION_BASE_H_

package/src/headers/22/permission/wasi_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_WASI_PERMISSION_H_
+#define SRC_PERMISSION_WASI_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <vector>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class WASIPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_WASI_PERMISSION_H_

package/src/headers/22/permission/worker_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_WORKER_PERMISSION_H_
+#define SRC_PERMISSION_WORKER_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <vector>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class WorkerPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_WORKER_PERMISSION_H_

package/src/headers/{16 → 22}/req_wrap-inl.h

@@ -20,13 +20,12 @@ ReqWrap<T>::ReqWrap(Environment* env,
                     AsyncWrap::ProviderType provider)
     : AsyncWrap(env, object, provider),
       ReqWrapBase(env) {
+  MakeWeak();
   Reset();
 }
 
 template <typename T>
-ReqWrap<T>::~ReqWrap() {
-  CHECK_EQ(false, persistent().IsEmpty());
-}
+ReqWrap<T>::~ReqWrap() {}
 
 template <typename T>
 void ReqWrap<T>::Dispatched() {
@@ -120,7 +119,8 @@ struct MakeLibuvRequestCallback<ReqT, void(*)(ReqT*, Args...)> {
   using F = void(*)(ReqT* req, Args... args);
 
   static void Wrapper(ReqT* req, Args... args) {
-    ReqWrap<ReqT>* req_wrap = ReqWrap<ReqT>::from_req(req);
+    BaseObjectPtr<ReqWrap<ReqT>> req_wrap{ReqWrap<ReqT>::from_req(req)};
+    req_wrap->Detach();
     req_wrap->env()->DecreaseWaitingRequestCounter();
     F original_callback = reinterpret_cast<F>(req_wrap->original_callback_);
     original_callback(req, args...);
@@ -138,7 +138,6 @@ template <typename T>
 template <typename LibuvFunction, typename... Args>
 int ReqWrap<T>::Dispatch(LibuvFunction fn, Args... args) {
   Dispatched();
-
   // This expands as:
   //
   // int err = fn(env()->event_loop(), req(), arg1, arg2, Wrapper, arg3, ...)
@@ -158,8 +157,10 @@ int ReqWrap<T>::Dispatch(LibuvFunction fn, Args... args) {
       env()->event_loop(),
       req(),
       MakeLibuvRequestCallback<T, Args>::For(this, args)...);
-  if (err >= 0)
+  if (err >= 0) {
+    ClearWeak();
     env()->IncreaseWaitingRequestCounter();
+  }
   return err;
 }
 

package/src/headers/{14 → 22}/spawn_sync.h

@@ -30,8 +30,7 @@
 
 namespace node {
 
-
-
+class ExternalReferenceRegistry;
 class SyncProcessOutputBuffer;
 class SyncProcessStdioPipe;
 class SyncProcessRunner;
@@ -140,6 +139,7 @@ class SyncProcessRunner {
   };
 
  public:
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
   static void Initialize(v8::Local<v8::Object> target,
                          v8::Local<v8::Value> unused,
                          v8::Local<v8::Context> context,
@@ -155,7 +155,7 @@ class SyncProcessRunner {
   inline Environment* env() const;
 
   v8::MaybeLocal<v8::Object> Run(v8::Local<v8::Value> options);
-  v8::Maybe<bool> TryInitializeAndRunLoop(v8::Local<v8::Value> options);
+  v8::Maybe<void> TryInitializeAndRunLoop(v8::Local<v8::Value> options);
   void CloseHandlesAndDeleteLoop();
 
   void CloseStdioPipes();

package/src/headers/{18 → 22}/stream_base-inl.h

@@ -67,30 +67,6 @@ void StreamResource::PushStreamListener(StreamListener* listener) {
   listener_ = listener;
 }
 
-void StreamResource::RemoveStreamListener(StreamListener* listener) {
-  CHECK_NOT_NULL(listener);
-
-  StreamListener* previous;
-  StreamListener* current;
-
-  // Remove from the linked list.
-  for (current = listener_, previous = nullptr;
-       /* No loop condition because we want a crash if listener is not found */
-       ; previous = current, current = current->previous_listener_) {
-    CHECK_NOT_NULL(current);
-    if (current == listener) {
-      if (previous != nullptr)
-        previous->previous_listener_ = current->previous_listener_;
-      else
-        listener_ = listener->previous_listener_;
-      break;
-    }
-  }
-
-  listener->stream_ = nullptr;
-  listener->previous_listener_ = nullptr;
-}
-
 uv_buf_t StreamResource::EmitAlloc(size_t suggested_size) {
   DebugSealHandleScope seal_handle_scope;
   return listener_->OnStreamAlloc(suggested_size);
@@ -122,101 +98,6 @@ StreamBase::StreamBase(Environment* env) : env_(env) {
   PushStreamListener(&default_listener_);
 }
 
-int StreamBase::Shutdown(v8::Local<v8::Object> req_wrap_obj) {
-  Environment* env = stream_env();
-
-  v8::HandleScope handle_scope(env->isolate());
-
-  if (req_wrap_obj.IsEmpty()) {
-    if (!env->shutdown_wrap_template()
-             ->NewInstance(env->context())
-             .ToLocal(&req_wrap_obj)) {
-      return UV_EBUSY;
-    }
-    StreamReq::ResetObject(req_wrap_obj);
-  }
-
-  BaseObjectPtr<AsyncWrap> req_wrap_ptr;
-  AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(GetAsyncWrap());
-  ShutdownWrap* req_wrap = CreateShutdownWrap(req_wrap_obj);
-  if (req_wrap != nullptr)
-    req_wrap_ptr.reset(req_wrap->GetAsyncWrap());
-  int err = DoShutdown(req_wrap);
-
-  if (err != 0 && req_wrap != nullptr) {
-    req_wrap->Dispose();
-  }
-
-  const char* msg = Error();
-  if (msg != nullptr) {
-    if (req_wrap_obj->Set(env->context(),
-                          env->error_string(),
-                          OneByteString(env->isolate(), msg)).IsNothing()) {
-      return UV_EBUSY;
-    }
-    ClearError();
-  }
-
-  return err;
-}
-
-StreamWriteResult StreamBase::Write(
-    uv_buf_t* bufs,
-    size_t count,
-    uv_stream_t* send_handle,
-    v8::Local<v8::Object> req_wrap_obj) {
-  Environment* env = stream_env();
-  int err;
-
-  size_t total_bytes = 0;
-  for (size_t i = 0; i < count; ++i)
-    total_bytes += bufs[i].len;
-  bytes_written_ += total_bytes;
-
-  if (send_handle == nullptr) {
-    err = DoTryWrite(&bufs, &count);
-    if (err != 0 || count == 0) {
-      return StreamWriteResult { false, err, nullptr, total_bytes, {} };
-    }
-  }
-
-  v8::HandleScope handle_scope(env->isolate());
-
-  if (req_wrap_obj.IsEmpty()) {
-    if (!env->write_wrap_template()
-             ->NewInstance(env->context())
-             .ToLocal(&req_wrap_obj)) {
-      return StreamWriteResult { false, UV_EBUSY, nullptr, 0, {} };
-    }
-    StreamReq::ResetObject(req_wrap_obj);
-  }
-
-  AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(GetAsyncWrap());
-  WriteWrap* req_wrap = CreateWriteWrap(req_wrap_obj);
-  BaseObjectPtr<AsyncWrap> req_wrap_ptr(req_wrap->GetAsyncWrap());
-
-  err = DoWrite(req_wrap, bufs, count, send_handle);
-  bool async = err == 0;
-
-  if (!async) {
-    req_wrap->Dispose();
-    req_wrap = nullptr;
-  }
-
-  const char* msg = Error();
-  if (msg != nullptr) {
-    if (req_wrap_obj->Set(env->context(),
-                          env->error_string(),
-                          OneByteString(env->isolate(), msg)).IsNothing()) {
-      return StreamWriteResult { false, UV_EBUSY, nullptr, 0, {} };
-    }
-    ClearError();
-  }
-
-  return StreamWriteResult {
-      async, err, req_wrap, total_bytes, std::move(req_wrap_ptr) };
-}
-
 template <typename OtherBase>
 SimpleShutdownWrap<OtherBase>::SimpleShutdownWrap(
     StreamBase* stream,
@@ -278,22 +159,6 @@ void WriteWrap::SetBackingStore(std::unique_ptr<v8::BackingStore> bs) {
   backing_store_ = std::move(bs);
 }
 
-void StreamReq::Done(int status, const char* error_str) {
-  AsyncWrap* async_wrap = GetAsyncWrap();
-  Environment* env = async_wrap->env();
-  if (error_str != nullptr) {
-    v8::HandleScope handle_scope(env->isolate());
-    if (async_wrap->object()->Set(
-            env->context(),
-            env->error_string(),
-            OneByteString(env->isolate(), error_str)).IsNothing()) {
-      return;
-    }
-  }
-
-  OnDone(status);
-}
-
 void StreamReq::ResetObject(v8::Local<v8::Object> obj) {
   DCHECK_GT(obj->InternalFieldCount(), StreamReq::kStreamReqField);