@encharm/cws 4.4.1 → 4.5.2

package/src/headers/24/permission/fs_permission.h

@@ -0,0 +1,167 @@
+#ifndef SRC_PERMISSION_FS_PERMISSION_H_
+#define SRC_PERMISSION_FS_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "v8.h"
+
+#include <unordered_map>
+#include "permission/permission_base.h"
+#include "util.h"
+
+namespace node {
+
+namespace permission {
+
+class FSPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param) const override;
+
+  struct RadixTree {
+    struct Node {
+      std::string prefix;
+      std::unordered_map<char, Node*> children;
+      Node* wildcard_child;
+      bool is_leaf;
+
+      explicit Node(const std::string& pre)
+          : prefix(pre), wildcard_child(nullptr), is_leaf(false) {}
+
+      Node() : wildcard_child(nullptr), is_leaf(false) {}
+
+      Node* CreateChild(const std::string& path_prefix) {
+        if (path_prefix.empty() && !is_leaf) {
+          is_leaf = true;
+          return this;
+        }
+
+        CHECK(!path_prefix.empty());
+        char label = path_prefix[0];
+
+        Node* child = children[label];
+        if (child == nullptr) {
+          children[label] = new Node(path_prefix);
+          return children[label];
+        }
+
+        // swap prefix
+        size_t i = 0;
+        size_t prefix_len = path_prefix.length();
+        for (; i < child->prefix.length(); ++i) {
+          if (i > prefix_len || path_prefix[i] != child->prefix[i]) {
+            std::string parent_prefix = child->prefix.substr(0, i);
+            std::string child_prefix = child->prefix.substr(i);
+
+            child->prefix = child_prefix;
+            Node* split_child = new Node(parent_prefix);
+            split_child->children[child_prefix[0]] = child;
+            children[parent_prefix[0]] = split_child;
+
+            return split_child->CreateChild(path_prefix.substr(i));
+          }
+        }
+        child->is_leaf = true;
+        return child->CreateChild(path_prefix.substr(i));
+      }
+
+      Node* CreateWildcardChild() {
+        if (wildcard_child != nullptr) {
+          return wildcard_child;
+        }
+        wildcard_child = new Node();
+        return wildcard_child;
+      }
+
+      Node* NextNode(const std::string& path, size_t idx) const {
+        if (idx >= path.length()) {
+          return nullptr;
+        }
+
+        // wildcard node takes precedence
+        if (children.size() > 1) {
+          auto it = children.find('*');
+          if (it != children.end()) {
+            return it->second;
+          }
+        }
+
+        auto it = children.find(path[idx]);
+        if (it == children.end()) {
+          return nullptr;
+        }
+        auto child = it->second;
+        // match prefix
+        size_t prefix_len = child->prefix.length();
+        for (size_t i = 0; i < path.length(); ++i) {
+          if (i >= prefix_len || child->prefix[i] == '*') {
+            return child;
+          }
+
+          // Handle optional trailing
+          // path = /home/subdirectory
+          // child = subdirectory/*
+          if (idx >= path.length() &&
+              child->prefix[i] == node::kPathSeparator) {
+            continue;
+          }
+
+          if (path[idx++] != child->prefix[i]) {
+            return nullptr;
+          }
+        }
+        return child;
+      }
+
+      // A node can be a *end* node and have children
+      // E.g: */slower*, */slown* are inserted:
+      // /slow
+      // ---> er
+      // ---> n
+      // If */slow* is inserted right after, it will create an
+      // empty node
+      // /slow
+      // ---> '\000' ASCII (0) || \0
+      // ---> er
+      // ---> n
+      bool IsEndNode() const {
+        if (children.empty()) {
+          return true;
+        }
+        return is_leaf;
+      }
+    };
+
+    RadixTree();
+    ~RadixTree();
+    void Insert(const std::string& s);
+    bool Lookup(const std::string_view& s) const { return Lookup(s, false); }
+    bool Lookup(const std::string_view& s, bool when_empty_return) const;
+
+   private:
+    Node* root_node_;
+  };
+
+ private:
+  void GrantAccess(PermissionScope scope, const std::string& param);
+  // fs granted on startup
+  RadixTree granted_in_fs_;
+  RadixTree granted_out_fs_;
+
+  bool deny_all_in_ = true;
+  bool deny_all_out_ = true;
+
+  bool allow_all_in_ = false;
+  bool allow_all_out_ = false;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_FS_PERMISSION_H_

package/src/headers/24/permission/inspector_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_INSPECTOR_PERMISSION_H_
+#define SRC_PERMISSION_INSPECTOR_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <string>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class InspectorPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_INSPECTOR_PERMISSION_H_

package/src/headers/24/permission/permission.h

@@ -0,0 +1,100 @@
+#ifndef SRC_PERMISSION_PERMISSION_H_
+#define SRC_PERMISSION_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "debug_utils.h"
+#include "node_options.h"
+#include "permission/addon_permission.h"
+#include "permission/child_process_permission.h"
+#include "permission/fs_permission.h"
+#include "permission/inspector_permission.h"
+#include "permission/permission_base.h"
+#include "permission/wasi_permission.h"
+#include "permission/worker_permission.h"
+#include "v8.h"
+
+#include <string_view>
+#include <unordered_map>
+
+namespace node {
+
+class Environment;
+
+namespace fs {
+class FSReqBase;
+}
+
+namespace permission {
+
+#define THROW_IF_INSUFFICIENT_PERMISSIONS(env, perm_, resource_, ...)          \
+  do {                                                                         \
+    if (!env->permission()->is_granted(env, perm_, resource_)) [[unlikely]] {  \
+      node::permission::Permission::ThrowAccessDenied(                         \
+          (env), perm_, resource_);                                            \
+      return __VA_ARGS__;                                                      \
+    }                                                                          \
+  } while (0)
+
+#define ASYNC_THROW_IF_INSUFFICIENT_PERMISSIONS(                               \
+    env, wrap, perm_, resource_, ...)                                          \
+  do {                                                                         \
+    if (!env->permission()->is_granted(env, perm_, resource_)) [[unlikely]] {  \
+      node::permission::Permission::AsyncThrowAccessDenied(                    \
+          (env), wrap, perm_, resource_);                                      \
+      return __VA_ARGS__;                                                      \
+    }                                                                          \
+  } while (0)
+
+class Permission {
+ public:
+  Permission();
+
+  FORCE_INLINE bool is_granted(Environment* env,
+                               const PermissionScope permission,
+                               const std::string_view& res = "") const {
+    if (!enabled_) [[likely]] {
+      return true;
+    }
+    return is_scope_granted(env, permission, res);
+  }
+
+  FORCE_INLINE bool enabled() const { return enabled_; }
+
+  static PermissionScope StringToPermission(const std::string& perm);
+  static const char* PermissionToString(PermissionScope perm);
+  static void ThrowAccessDenied(Environment* env,
+                                PermissionScope perm,
+                                const std::string_view& res);
+  static void AsyncThrowAccessDenied(Environment* env,
+                                     fs::FSReqBase* req_wrap,
+                                     PermissionScope perm,
+                                     const std::string_view& res);
+
+  // CLI Call
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope);
+  void EnablePermissions();
+
+ private:
+  COLD_NOINLINE bool is_scope_granted(Environment* env,
+                                      const PermissionScope permission,
+                                      const std::string_view& res = "") const {
+    auto perm_node = nodes_.find(permission);
+    if (perm_node != nodes_.end()) {
+      return perm_node->second->is_granted(env, permission, res);
+    }
+    return false;
+  }
+
+  std::unordered_map<PermissionScope, std::shared_ptr<PermissionBase>> nodes_;
+  bool enabled_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_PERMISSION_H_

package/src/headers/24/permission/permission_base.h

@@ -0,0 +1,65 @@
+#ifndef SRC_PERMISSION_PERMISSION_BASE_H_
+#define SRC_PERMISSION_PERMISSION_BASE_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <map>
+#include <string>
+#include <string_view>
+#include "v8.h"
+
+namespace node {
+
+class Environment;
+
+namespace permission {
+
+#define FILESYSTEM_PERMISSIONS(V)                                              \
+  V(FileSystem, "fs", PermissionsRoot, "")                                     \
+  V(FileSystemRead, "fs.read", FileSystem, "--allow-fs-read")                  \
+  V(FileSystemWrite, "fs.write", FileSystem, "--allow-fs-write")
+
+#define CHILD_PROCESS_PERMISSIONS(V)                                           \
+  V(ChildProcess, "child", PermissionsRoot, "--allow-child-process")
+
+#define WASI_PERMISSIONS(V) V(WASI, "wasi", PermissionsRoot, "--allow-wasi")
+
+#define WORKER_THREADS_PERMISSIONS(V)                                          \
+  V(WorkerThreads, "worker", PermissionsRoot, "--allow-worker")
+
+#define INSPECTOR_PERMISSIONS(V) V(Inspector, "inspector", PermissionsRoot, "")
+
+#define ADDON_PERMISSIONS(V)                                                   \
+  V(Addon, "addon", PermissionsRoot, "--allow-addons")
+
+#define PERMISSIONS(V)                                                         \
+  FILESYSTEM_PERMISSIONS(V)                                                    \
+  CHILD_PROCESS_PERMISSIONS(V)                                                 \
+  WASI_PERMISSIONS(V)                                                          \
+  WORKER_THREADS_PERMISSIONS(V)                                                \
+  INSPECTOR_PERMISSIONS(V)                                                     \
+  ADDON_PERMISSIONS(V)
+
+#define V(name, _, __, ___) k##name,
+enum class PermissionScope {
+  kPermissionsRoot = -1,
+  PERMISSIONS(V) kPermissionsCount
+};
+#undef V
+
+class PermissionBase {
+ public:
+  virtual void Apply(Environment* env,
+                     const std::vector<std::string>& allow,
+                     PermissionScope scope) = 0;
+  virtual bool is_granted(Environment* env,
+                          PermissionScope perm,
+                          const std::string_view& param = "") const = 0;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_PERMISSION_BASE_H_

package/src/headers/24/permission/wasi_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_WASI_PERMISSION_H_
+#define SRC_PERMISSION_WASI_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <vector>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class WASIPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_WASI_PERMISSION_H_

package/src/headers/24/permission/worker_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_WORKER_PERMISSION_H_
+#define SRC_PERMISSION_WORKER_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <vector>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class WorkerPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_WORKER_PERMISSION_H_

package/src/headers/24/permission.h

@@ -0,0 +1,100 @@
+#ifndef SRC_PERMISSION_PERMISSION_H_
+#define SRC_PERMISSION_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "debug_utils.h"
+#include "node_options.h"
+#include "permission/addon_permission.h"
+#include "permission/child_process_permission.h"
+#include "permission/fs_permission.h"
+#include "permission/inspector_permission.h"
+#include "permission/permission_base.h"
+#include "permission/wasi_permission.h"
+#include "permission/worker_permission.h"
+#include "v8.h"
+
+#include <string_view>
+#include <unordered_map>
+
+namespace node {
+
+class Environment;
+
+namespace fs {
+class FSReqBase;
+}
+
+namespace permission {
+
+#define THROW_IF_INSUFFICIENT_PERMISSIONS(env, perm_, resource_, ...)          \
+  do {                                                                         \
+    if (!env->permission()->is_granted(env, perm_, resource_)) [[unlikely]] {  \
+      node::permission::Permission::ThrowAccessDenied(                         \
+          (env), perm_, resource_);                                            \
+      return __VA_ARGS__;                                                      \
+    }                                                                          \
+  } while (0)
+
+#define ASYNC_THROW_IF_INSUFFICIENT_PERMISSIONS(                               \
+    env, wrap, perm_, resource_, ...)                                          \
+  do {                                                                         \
+    if (!env->permission()->is_granted(env, perm_, resource_)) [[unlikely]] {  \
+      node::permission::Permission::AsyncThrowAccessDenied(                    \
+          (env), wrap, perm_, resource_);                                      \
+      return __VA_ARGS__;                                                      \
+    }                                                                          \
+  } while (0)
+
+class Permission {
+ public:
+  Permission();
+
+  FORCE_INLINE bool is_granted(Environment* env,
+                               const PermissionScope permission,
+                               const std::string_view& res = "") const {
+    if (!enabled_) [[likely]] {
+      return true;
+    }
+    return is_scope_granted(env, permission, res);
+  }
+
+  FORCE_INLINE bool enabled() const { return enabled_; }
+
+  static PermissionScope StringToPermission(const std::string& perm);
+  static const char* PermissionToString(PermissionScope perm);
+  static void ThrowAccessDenied(Environment* env,
+                                PermissionScope perm,
+                                const std::string_view& res);
+  static void AsyncThrowAccessDenied(Environment* env,
+                                     fs::FSReqBase* req_wrap,
+                                     PermissionScope perm,
+                                     const std::string_view& res);
+
+  // CLI Call
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope);
+  void EnablePermissions();
+
+ private:
+  COLD_NOINLINE bool is_scope_granted(Environment* env,
+                                      const PermissionScope permission,
+                                      const std::string_view& res = "") const {
+    auto perm_node = nodes_.find(permission);
+    if (perm_node != nodes_.end()) {
+      return perm_node->second->is_granted(env, permission, res);
+    }
+    return false;
+  }
+
+  std::unordered_map<PermissionScope, std::shared_ptr<PermissionBase>> nodes_;
+  bool enabled_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_PERMISSION_H_

package/src/headers/24/permission_base.h

@@ -0,0 +1,65 @@
+#ifndef SRC_PERMISSION_PERMISSION_BASE_H_
+#define SRC_PERMISSION_PERMISSION_BASE_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <map>
+#include <string>
+#include <string_view>
+#include "v8.h"
+
+namespace node {
+
+class Environment;
+
+namespace permission {
+
+#define FILESYSTEM_PERMISSIONS(V)                                              \
+  V(FileSystem, "fs", PermissionsRoot, "")                                     \
+  V(FileSystemRead, "fs.read", FileSystem, "--allow-fs-read")                  \
+  V(FileSystemWrite, "fs.write", FileSystem, "--allow-fs-write")
+
+#define CHILD_PROCESS_PERMISSIONS(V)                                           \
+  V(ChildProcess, "child", PermissionsRoot, "--allow-child-process")
+
+#define WASI_PERMISSIONS(V) V(WASI, "wasi", PermissionsRoot, "--allow-wasi")
+
+#define WORKER_THREADS_PERMISSIONS(V)                                          \
+  V(WorkerThreads, "worker", PermissionsRoot, "--allow-worker")
+
+#define INSPECTOR_PERMISSIONS(V) V(Inspector, "inspector", PermissionsRoot, "")
+
+#define ADDON_PERMISSIONS(V)                                                   \
+  V(Addon, "addon", PermissionsRoot, "--allow-addons")
+
+#define PERMISSIONS(V)                                                         \
+  FILESYSTEM_PERMISSIONS(V)                                                    \
+  CHILD_PROCESS_PERMISSIONS(V)                                                 \
+  WASI_PERMISSIONS(V)                                                          \
+  WORKER_THREADS_PERMISSIONS(V)                                                \
+  INSPECTOR_PERMISSIONS(V)                                                     \
+  ADDON_PERMISSIONS(V)
+
+#define V(name, _, __, ___) k##name,
+enum class PermissionScope {
+  kPermissionsRoot = -1,
+  PERMISSIONS(V) kPermissionsCount
+};
+#undef V
+
+class PermissionBase {
+ public:
+  virtual void Apply(Environment* env,
+                     const std::vector<std::string>& allow,
+                     PermissionScope scope) = 0;
+  virtual bool is_granted(Environment* env,
+                          PermissionScope perm,
+                          const std::string_view& param = "") const = 0;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_PERMISSION_BASE_H_

package/src/headers/24/preferredaddress.h

@@ -0,0 +1,72 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+
+#include <env.h>
+#include <ngtcp2/ngtcp2.h>
+#include <node_internals.h>
+#include <v8.h>
+#include <string>
+#include "defs.h"
+
+namespace node::quic {
+
+// PreferredAddress is a helper class used only when a client Session receives
+// an advertised preferred address from a server. The helper provides
+// information about the server advertised preferred address and allows
+// the preferred address to be selected.
+class PreferredAddress final {
+ public:
+  enum class Policy : uint32_t {
+    // Ignore the server-advertised preferred address.
+    IGNORE_PREFERRED,
+    // Use the server-advertised preferred address.
+    USE_PREFERRED,
+  };
+
+  static v8::Maybe<Policy> tryGetPolicy(Environment* env,
+                                        v8::Local<v8::Value> value);
+
+  // The QUIC_* constants are expected to be exported out to be used on
+  // the JavaScript side of the API.
+  static constexpr auto PREFERRED_ADDRESS_USE =
+      static_cast<uint32_t>(Policy::USE_PREFERRED);
+  static constexpr auto PREFERRED_ADDRESS_IGNORE =
+      static_cast<uint32_t>(Policy::IGNORE_PREFERRED);
+  static constexpr auto DEFAULT_PREFERRED_ADDRESS_POLICY =
+      static_cast<uint32_t>(Policy::USE_PREFERRED);
+
+  static void Initialize(Environment* env, v8::Local<v8::Object> target);
+
+  struct AddressInfo final {
+    char host[NI_MAXHOST];
+    int family;
+    uint16_t port;
+    std::string_view address;
+  };
+
+  explicit PreferredAddress(ngtcp2_path* dest,
+                            const ngtcp2_preferred_addr* paddr);
+  DISALLOW_COPY_AND_MOVE(PreferredAddress)
+
+  void Use(const AddressInfo& address);
+
+  std::optional<const AddressInfo> ipv4() const;
+  std::optional<const AddressInfo> ipv6() const;
+
+  // Set the preferred address in the transport params.
+  // The address family (ipv4 or ipv6) will be automatically
+  // detected from the given addr. Any other address family
+  // will be ignored.
+  static void Set(ngtcp2_transport_params* params, const sockaddr* addr);
+
+ private:
+  ngtcp2_path* dest_;
+  const ngtcp2_preferred_addr* paddr_;
+};
+
+}  // namespace node::quic
+
+#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS

package/src/headers/24/protocol_helper.h

@@ -0,0 +1,27 @@
+#ifndef SRC_INSPECTOR_PROTOCOL_HELPER_H_
+#define SRC_INSPECTOR_PROTOCOL_HELPER_H_
+
+#include "node/inspector/protocol/Protocol.h"
+#include "util.h"
+#include "v8-inspector.h"
+
+namespace node::inspector {
+
+// Convert a V8 string to v8_inspector StringBuffer, encoded in UTF16.
+inline std::unique_ptr<v8_inspector::StringBuffer> ToInspectorString(
+    v8::Isolate* isolate, v8::Local<v8::Value> value) {
+  TwoByteValue buffer(isolate, value);
+  return v8_inspector::StringBuffer::create(
+      v8_inspector::StringView(*buffer, buffer.length()));
+}
+
+// Convert a V8 string to node::inspector::protocol::String, encoded in UTF8.
+inline protocol::String ToProtocolString(v8::Isolate* isolate,
+                                         v8::Local<v8::Value> value) {
+  Utf8Value buffer(isolate, value);
+  return *buffer;
+}
+
+}  // namespace node::inspector
+
+#endif  // SRC_INSPECTOR_PROTOCOL_HELPER_H_