@johnhenry/andbox 0.0.8 → 0.0.9

package/README.md

@@ -427,7 +427,7 @@ andbox is **not** a boundary against code that is actively trying to escape it.
 - **No implicit host object references.** Only what you explicitly pass in (`capabilities`, `globals`, import map entries) is reachable from sandboxed code -- ordinary (non-adversarial) code cannot accidentally read or mutate host-side state it wasn't given a reference to.
 - **(Node) A worker thread is not a security boundary.** It shares the process with the host; by default it inherits `process.env` and can reach `process`, `fs`, and `child_process`. The opt-in `nodeWorker.permissions` hardening (see [Node](#node)) adds the permission model, an isolated env, a memory cap and import blocking, which raises the cost of casual abuse but does not make the thread a boundary.
 - **Hard kill on timeout.** `evaluate()` calls that exceed `timeoutMs` `terminate()` the Worker outright and start a fresh one for the next call -- this is a real process-level kill, not a cooperative cancellation the running code could ignore. See "still yours" below for what a kill does *not* undo.
-- **The capability gate cannot be walked around via the prototype chain.** `gateCapabilities()` builds the gated object with `Object.create(null)`, so `host.call('constructor', ...)` cannot resolve through `Object.prototype` to the real global `Object` constructor. Previously fixed; see [andbox#5](https://github.com/johnhenry/andbox/issues/5).
+- **The capability gate cannot be walked around via the prototype chain.** `gateCapabilities()` builds the gated object with `Object.create(null)`, so `host.call('constructor', ...)` cannot resolve through `Object.prototype` to the real global `Object` constructor; the host resolves names through a `Map` and rejects anything that was not explicitly granted. First fixed in 0.0.1, hardened in 0.0.9; see [andbox#5](https://github.com/johnhenry/andbox/issues/5).
 - **`createNetworkFetch()`'s allowlist is redirect-safe.** Requests are made with `redirect: 'manual'` and any redirect response is rejected outright, so an allowlisted host cannot silently redirect a caller to a non-allowlisted one. Previously fixed; see [andbox#6](https://github.com/johnhenry/andbox/issues/6).
 - **`gateCapabilities()` enforces call/argument-size/concurrency caps per capability**, for cooperative callers that stay within the capabilities you actually granted.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@johnhenry/andbox",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "type": "module",
   "description": "Sandboxed JavaScript runtime with Worker isolation, RPC, import maps, timeouts, and an optional QuickJS-in-WebAssembly mode",
   "main": "./src/index.mjs",

package/src/capability-gate.mjs

@@ -21,11 +21,12 @@ import { DEFAULT_LIMITS, DEFAULT_CAPABILITY_LIMITS } from './constants.mjs';
  *
  * @param {Record<string, Function>} capabilities - Raw capability functions.
  * @param {GatePolicy} [policy] - Rate limit policy.
- * @returns {{ gated: Record<string, Function>, stats: () => object }}
+ * @returns {{ gated: Record<string, Function>, lookup: (name: unknown) => Function | undefined, stats: () => object }}
  */
 export function gateCapabilities(capabilities, policy = {}) {
   const limits = { ...DEFAULT_LIMITS, ...policy.limits };
   const capPolicies = policy.capabilities || {};
+  const hasOwn = (o, k) => Object.prototype.hasOwnProperty.call(o, k);
 
   let totalCalls = 0;
   let totalArgBytes = 0;
@@ -41,9 +42,12 @@ export function gateCapabilities(capabilities, policy = {}) {
   // like 'constructor' or 'toString' cannot resolve through the prototype
   // to real global functions and bypass the allowlist/rate limiting below.
   const gated = Object.create(null);
+  // Authoritative table for lookup(): a Map has no prototype-chain property
+  // semantics at all, so a string key either was granted or is absent.
+  const table = new Map();
 
   for (const [name, fn] of Object.entries(capabilities)) {
-    const capLimits = { ...DEFAULT_CAPABILITY_LIMITS, ...capPolicies[name] };
+    const capLimits = { ...DEFAULT_CAPABILITY_LIMITS, ...(hasOwn(capPolicies, name) ? capPolicies[name] : undefined) };
 
     gated[name] = async (...args) => {
       // Measure argument bytes
@@ -83,6 +87,18 @@ export function gateCapabilities(capabilities, policy = {}) {
         concurrent--;
       }
     };
+    table.set(name, gated[name]);
+  }
+
+  /**
+   * Resolve a capability by name. Only names the host explicitly granted
+   * resolve; non-strings and anything that exists only on Object.prototype
+   * (constructor, toString, __proto__, ...) return undefined.
+   * @param {unknown} name
+   * @returns {Function | undefined}
+   */
+  function lookup(name) {
+    return typeof name === 'string' ? table.get(name) : undefined;
   }
 
   function stats() {
@@ -94,5 +110,5 @@ export function gateCapabilities(capabilities, policy = {}) {
     };
   }
 
-  return { gated, stats };
+  return { gated, lookup, stats };
 }

package/src/sandbox.mjs

@@ -436,7 +436,7 @@ async function createWorkerSandbox(options = {}, forceNode = false, isWasm = fal
   }
 
   // Gate capabilities with rate limits
-  const { gated: gatedCaps, stats: gateStats } = gateCapabilities(capabilities, policy);
+  const { lookup: lookupCapability, stats: gateStats } = gateCapabilities(capabilities, policy);
 
   // Console handler — mutable so evaluate() can swap per-call
   let activeConsoleHandler = onConsole || null;
@@ -490,7 +490,7 @@ async function createWorkerSandbox(options = {}, forceNode = false, isWasm = fal
 
         case 'result': {
           const entry = pending.get(msg.id);
-          if (entry) {
+          if (entry && entry.nonce === msg.nonce) {
             pending.delete(msg.id);
             if (entry.timer) clearTimeout(entry.timer);
             if (msg.stats) {
@@ -570,7 +570,7 @@ async function createWorkerSandbox(options = {}, forceNode = false, isWasm = fal
   }
 
   async function handleCapabilityCall(rpcId, name, args) {
-    const fn = gatedCaps[name];
+    const fn = lookupCapability(name);
     if (!fn) {
       worker.postMessage({
         type: 'capabilityResult',
@@ -637,6 +637,10 @@ async function createWorkerSandbox(options = {}, forceNode = false, isWasm = fal
     // can't guess the id of a concurrent evaluate() on the same worker and
     // forge a matching message to interfere with it.
     const id = crypto.randomUUID();
+    // Per-call nonce: the worker echoes it in its `result`; a result whose
+    // nonce does not match is dropped. Held only by the host and the worker's
+    // message handler, never exposed to evaluated code.
+    const nonce = crypto.randomUUID() + crypto.randomUUID();
     const timeoutMs = opts.timeoutMs ?? defaultTimeoutMs;
     const { promise, resolve, reject } = makeDeferred();
 
@@ -691,8 +695,8 @@ async function createWorkerSandbox(options = {}, forceNode = false, isWasm = fal
       }, { once: true });
     }
 
-    pending.set(id, { resolve, reject, timer });
-    worker.postMessage({ type: 'evaluate', id, code, ...(wasmLimits ? { limits: wasmLimits } : {}) });
+    pending.set(id, { resolve, reject, timer, nonce });
+    worker.postMessage({ type: 'evaluate', id, nonce, code, ...(wasmLimits ? { limits: wasmLimits } : {}) });
 
     // Restore console handler when evaluation completes
     return promise.finally(() => {

package/src/wasm-worker-source.mjs

@@ -462,7 +462,7 @@ function wasmWorkerMain() {
       }
       case 'evaluate': {
         const res = await runEval(msg);
-        self.postMessage({ type: 'result', id: msg.id, ...res });
+        self.postMessage({ type: 'result', id: msg.id, nonce: msg.nonce, ...res });
         break;
       }
       case 'capabilityResult': {

package/src/worker-source.mjs

@@ -175,11 +175,12 @@ self.onmessage = async ({ data: msg }) => {
           \`return (async () => {\\n\${msg.code}\\n})();\`
         );
         const result = await asyncFn(sandboxImport, host, fwdConsole);
-        self.postMessage({ type: 'result', id: msg.id, success: true, value: serialize(result) });
+        self.postMessage({ type: 'result', id: msg.id, nonce: msg.nonce, success: true, value: serialize(result) });
       } catch (e) {
         self.postMessage({
           type: 'result',
           id: msg.id,
+          nonce: msg.nonce,
           success: false,
           error: { message: e.message || String(e), name: e.name || 'Error', stack: e.stack },
         });