@ethernity-cloud/sdk-js 1.5.5 → 1.5.9

package/nodenithy/build/securelock/src/task_status.js

@@ -17,6 +17,10 @@ class TaskStatus {
     static CONFIG_ERROR = 32;
     static EXECUTION_TIMEOUT = 33;      // Started but produced no result within the order duration.
     static ESR_GAS_LIMIT_EXCEEDED = 34; // ESR commits would exceed the per-order relayed-gas budget.
+    static SECURITY_VIOLATION = 35;     // A state commit was authorized under a caller other than
+                                        // the task's submitter (the in-enclave ownership check was
+                                        // bypassed). Set by the securelock on a detected forged
+                                        // caller, and by the trustedzone re-adjudication.
 }
 
 module.exports = {

package/nodenithy/build.mjs

@@ -115,6 +115,36 @@ try {
   process.exit(1);
 }
 
+// Safety lint: flag dynamic code execution -- especially of task input --
+// before the image is sealed. A hard error only for the case that actually
+// opens the enclave to a submitter (eval / Function of ___etny_data_set___);
+// everything else is a warning. See payloadLint.mjs for scope + opt-out.
+try {
+  const { analyze } = await import('../payloadLint.mjs');
+  const src = fs.readFileSync(backendFile, 'utf8');
+  const { findings, optedOut } = analyze(src, 'src/serverless/backend.js');
+  if (!optedOut) {
+    const warnings = findings.filter((f) => f.severity === 'warning');
+    const errors = findings.filter((f) => f.severity === 'error');
+    for (const f of warnings) {
+      console.warn(`WARNING: src/serverless/backend.js:${f.line}: ${f.message}`);
+    }
+    if (errors.length) {
+      console.error('');
+      console.error('ERROR: unsafe dynamic execution of task input in src/serverless/backend.js:');
+      for (const f of errors) console.error(`       line ${f.line}: ${f.message}`);
+      console.error('');
+      console.error('       This would let a task submitter run arbitrary code inside your enclave');
+      console.error('       and reach other users\' state. Fix it, or if the input is genuinely');
+      console.error('       trusted, add `// ecld: allow-eval` on that line to acknowledge the risk.');
+      process.exit(1);
+    }
+  }
+} catch (e) {
+  // The lint is best-effort; never block a build on the linter itself failing.
+  console.warn(`WARNING: payload safety lint skipped (${e && e.message ? e.message : e})`);
+}
+
 console.log(`Creating destination directory: ${destDir}`);
 fs.mkdirSync(destDir, { recursive: true });