@mywallpaper/addon-sdk 2.6.1 → 2.8.0

package/src/runtime/network-sandbox.js

@@ -0,0 +1,153 @@
+/**
+ * Network Sandbox Script - SECURITY LAYER
+ *
+ * This script MUST be injected FIRST (before addon-client.js)
+ * It saves original fetch/XHR for the SDK, then blocks them for addon code.
+ *
+ * Flow:
+ * 1. Save original fetch/XMLHttpRequest to __MYWALLPAPER_ORIGINAL_*
+ * 2. After addon-client.js loads, it will use these for the proxy
+ * 3. Replace window.fetch and XMLHttpRequest with blocked versions
+ * 4. Addon code must use MyWallpaper.network.fetch() instead
+ */
+;(function() {
+  'use strict';
+
+  // ============================================================================
+  // STEP 1: Save original network APIs for SDK internal use
+  // ============================================================================
+
+  // These will be used by the SDK's network proxy
+  window.__MYWALLPAPER_ORIGINAL_FETCH__ = window.fetch;
+  window.__MYWALLPAPER_ORIGINAL_XHR__ = window.XMLHttpRequest;
+
+  // ============================================================================
+  // STEP 2: Create blocked versions with helpful error messages
+  // ============================================================================
+
+  const BLOCKED_MESSAGE =
+    '[MyWallpaper Security] Direct network access is blocked for security.\n' +
+    'Use window.MyWallpaper.network.fetch(url, options) instead.\n\n' +
+    'Example:\n' +
+    '  const response = await MyWallpaper.network.fetch("https://api.example.com/data");\n' +
+    '  if (response.ok) console.log(response.data);\n\n' +
+    'Make sure your domain is declared in manifest.json:\n' +
+    '  "permissions": { "network": { "domains": ["api.example.com"] } }';
+
+  // Blocked fetch function
+  function blockedFetch() {
+    console.error(BLOCKED_MESSAGE);
+    return Promise.reject(new Error(BLOCKED_MESSAGE));
+  }
+
+  // Blocked XMLHttpRequest class
+  class BlockedXMLHttpRequest {
+    constructor() {
+      console.error(BLOCKED_MESSAGE);
+      throw new Error(BLOCKED_MESSAGE);
+    }
+  }
+
+  // Make BlockedXMLHttpRequest look like the real XMLHttpRequest
+  Object.defineProperties(BlockedXMLHttpRequest, {
+    UNSENT: { value: 0 },
+    OPENED: { value: 1 },
+    HEADERS_RECEIVED: { value: 2 },
+    LOADING: { value: 3 },
+    DONE: { value: 4 },
+  });
+
+  // ============================================================================
+  // STEP 3: Replace global APIs with blocked versions
+  // ============================================================================
+
+  // Override fetch - make it non-configurable to prevent bypass attempts
+  Object.defineProperty(window, 'fetch', {
+    value: blockedFetch,
+    writable: false,
+    configurable: false,
+    enumerable: true
+  });
+
+  // Override XMLHttpRequest - make it non-configurable
+  Object.defineProperty(window, 'XMLHttpRequest', {
+    value: BlockedXMLHttpRequest,
+    writable: false,
+    configurable: false,
+    enumerable: true
+  });
+
+  // ============================================================================
+  // STEP 4: Also block in common bypass locations
+  // ============================================================================
+
+  // Block on globalThis (modern JS)
+  if (typeof globalThis !== 'undefined' && globalThis !== window) {
+    try {
+      Object.defineProperty(globalThis, 'fetch', {
+        value: blockedFetch,
+        writable: false,
+        configurable: false
+      });
+      Object.defineProperty(globalThis, 'XMLHttpRequest', {
+        value: BlockedXMLHttpRequest,
+        writable: false,
+        configurable: false
+      });
+    } catch (e) {
+      // Ignore if already defined
+    }
+  }
+
+  // Prevent restoration via prototype manipulation
+  try {
+    Object.freeze(Object.getPrototypeOf(blockedFetch));
+  } catch (e) {
+    // Ignore
+  }
+
+  // ============================================================================
+  // STEP 5: Block EventSource and WebSocket (optional - for future)
+  // ============================================================================
+
+  // EventSource (Server-Sent Events)
+  const BlockedEventSource = function() {
+    console.error('[MyWallpaper Security] EventSource is blocked. Use MyWallpaper.network.fetch() for data.');
+    throw new Error('EventSource is blocked for security. Use MyWallpaper.network.fetch()');
+  };
+
+  Object.defineProperty(window, 'EventSource', {
+    value: BlockedEventSource,
+    writable: false,
+    configurable: false,
+    enumerable: true
+  });
+
+  // WebSocket - block with helpful message
+  const OriginalWebSocket = window.WebSocket;
+  const BlockedWebSocket = function() {
+    console.error('[MyWallpaper Security] WebSocket is blocked. Real-time features are not supported in addons.');
+    throw new Error('WebSocket is blocked for security in addons');
+  };
+
+  // Copy static properties
+  if (OriginalWebSocket) {
+    BlockedWebSocket.CONNECTING = 0;
+    BlockedWebSocket.OPEN = 1;
+    BlockedWebSocket.CLOSING = 2;
+    BlockedWebSocket.CLOSED = 3;
+  }
+
+  Object.defineProperty(window, 'WebSocket', {
+    value: BlockedWebSocket,
+    writable: false,
+    configurable: false,
+    enumerable: true
+  });
+
+  // ============================================================================
+  // STEP 6: Log security initialization
+  // ============================================================================
+
+  console.warn('[MyWallpaper Security] Network sandbox active. Use MyWallpaper.network.fetch() for network requests.');
+})();