@oneuptime/common 12.0.32 → 12.0.34

package/build/dist/Server/Utils/VM/VMRunner.js

@@ -7,13 +7,23 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import axios from "axios";
+import HTTPResponseBodyReader, { HTTPResponseBodyBudget, } from "../../../Utils/HTTPResponseBodyReader";
+import axios, { AxiosError } from "axios";
 import crypto from "crypto";
 import http from "http";
 import https from "https";
 import ivm from "isolated-vm";
-import CaptureSpan from "../Telemetry/CaptureSpan";
+import DataSourceEgressGuard from "../DataSource/EgressGuard";
 import SSRFProtection from "../SSRFProtection";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+/*
+ * How often to wake Node's event loop while sandboxed code is running. See
+ * the comment on hostBridgeTicker in runCodeInSandbox: the isolate's host
+ * bridges only advance on an event-loop turn, and a loop with nothing else
+ * pending sleeps until its next timer. 5ms is small against any real host
+ * operation and costs one empty callback per tick.
+ */
+const HOST_BRIDGE_TICK_MS = 5;
 export default class VMRunner {
     /*
      * Works out which URL the sandbox's axios call will actually dial, so the
@@ -26,27 +36,36 @@ export default class VMRunner {
      * than guessed at.
      */
     static resolveEffectiveRequestUrl(data) {
-        var _a, _b;
-        const baseUrl = typeof ((_a = data.config) === null || _a === void 0 ? void 0 : _a["baseURL"]) === "string"
-            ? data.config["baseURL"]
-            : "";
-        let target = data.url || "";
-        if (data.method === "request" || !target) {
-            const configUrl = (_b = data.config) === null || _b === void 0 ? void 0 : _b["url"];
-            target = typeof configUrl === "string" ? configUrl : target;
-        }
-        let absolute = target;
-        const absoluteUrlRegex = /^https?:\/\//i;
-        if (!absoluteUrlRegex.test(absolute)) {
-            if (!baseUrl) {
+        var _a, _b, _c;
+        const baseUrl = (_a = data.config) === null || _a === void 0 ? void 0 : _a["baseURL"];
+        const requestedUrl = data.method === "request" ? (_b = data.config) === null || _b === void 0 ? void 0 : _b["url"] : data.url;
+        const allowAbsoluteUrls = (_c = data.config) === null || _c === void 0 ? void 0 : _c["allowAbsoluteUrls"];
+        const axiosAbsoluteUrlPattern = new RegExp("^([a-z][a-z\\d+\\-.]*:)?//", "i");
+        const httpUrlPattern = new RegExp("^https?://", "i");
+        /*
+         * Mirror Axios's buildFullPath/isAbsoluteURL decision exactly before the
+         * SSRF guard sees the target. In particular, protocol-relative URLs and
+         * every RFC 3986 scheme count as absolute to Axios, while
+         * allowAbsoluteUrls:false deliberately combines even an absolute URL with
+         * baseURL. Direct-method positional URLs remain authoritative when they
+         * are the empty string; config.url must not silently replace them.
+         */
+        const isAxiosAbsoluteUrl = typeof requestedUrl === "string" &&
+            axiosAbsoluteUrlPattern.test(requestedUrl);
+        let effectiveUrl = requestedUrl;
+        if (baseUrl && (!isAxiosAbsoluteUrl || allowAbsoluteUrls === false)) {
+            if (typeof baseUrl !== "string") {
                 throw new Error("Request URL must be an absolute http or https URL.");
             }
-            absolute = `${baseUrl.replace(/\/+$/, "")}/${absolute.replace(/^\/+/, "")}`;
+            effectiveUrl = requestedUrl
+                ? `${baseUrl.replace(/\/?\/$/, "")}/${String(requestedUrl).replace(/^\/+/, "")}`
+                : baseUrl;
         }
-        if (!absoluteUrlRegex.test(absolute)) {
+        if (typeof effectiveUrl !== "string" ||
+            !httpUrlPattern.test(effectiveUrl)) {
             throw new Error("Request URL must be an absolute http or https URL.");
         }
-        return absolute;
+        return effectiveUrl;
     }
     static async runCodeInSandbox(data) {
         const { code, options } = data;
@@ -57,7 +76,14 @@ export default class VMRunner {
         const MAX_LOG_MESSAGES = 1000;
         const MAX_LOG_BYTES = 1000000;
         const MAX_SCRIPT_ERROR_MESSAGE_LENGTH = 10000;
+        const MAX_HTTP_RESPONSE_BYTES = 10 * 1024 * 1024;
+        const MAX_HTTP_REQUEST_BYTES = 10 * 1024 * 1024;
+        const MAX_HTTP_CONFIG_BYTES = 256 * 1024;
+        const MAX_HTTP_URL_BYTES = 16 * 1024;
+        const MAX_BASE64_RESPONSE_SOURCE_BYTES = Math.floor(((MAX_HTTP_RESPONSE_BYTES - 64 * 1024) * 3) / 4);
         let logBytes = 0;
+        let serializedHttpRequestBytes = 0;
+        const httpResponseBodyBudget = new HTTPResponseBodyBudget(MAX_HTTP_RESPONSE_BYTES);
         const pendingHostTimeouts = new Set();
         const pendingAxiosControllers = new Set();
         let acceptingHostOperations = true;
@@ -265,17 +291,57 @@ export default class VMRunner {
                 let config = configStr
                     ? JSON.parse(configStr)
                     : undefined;
-                // Reconstruct real http/https Agents from serialized markers
+                if (method === "request" && config) {
+                    const requestBody = config["data"];
+                    const configWithoutBody = Object.assign({}, config);
+                    delete configWithoutBody["data"];
+                    if (Buffer.byteLength(JSON.stringify(requestBody) || "", "utf8") >
+                        MAX_HTTP_REQUEST_BYTES) {
+                        throw new Error("HTTP request body exceeded the allowed size.");
+                    }
+                    if (Buffer.byteLength(JSON.stringify(configWithoutBody), "utf8") >
+                        MAX_HTTP_CONFIG_BYTES) {
+                        throw new Error("HTTP request config exceeded the allowed size.");
+                    }
+                }
+                let suppliedHttpsAgentOptions = {};
+                const pickAgentOptions = (source, allowedKeys) => {
+                    const picked = {};
+                    if (!source) {
+                        return picked;
+                    }
+                    for (const key of allowedKeys) {
+                        if (source[key] !== undefined) {
+                            picked[key] = source[key];
+                        }
+                    }
+                    return picked;
+                };
+                /*
+                 * Preserve only TLS semantics from a serialized HTTPS Agent. Network
+                 * and pooling options are intentionally discarded: host/port/path and
+                 * custom socket hooks can steer around the validated URL, while a
+                 * per-request keep-alive agent would leave an idle socket behind.
+                 */
                 if (config) {
                     const httpsAgentConfig = config["httpsAgent"];
                     if (httpsAgentConfig &&
                         httpsAgentConfig["__agentType"] === "__https_agent__") {
-                        config["httpsAgent"] = new https.Agent(httpsAgentConfig["options"]);
-                    }
-                    const httpAgentConfig = config["httpAgent"];
-                    if (httpAgentConfig &&
-                        httpAgentConfig["__agentType"] === "__http_agent__") {
-                        config["httpAgent"] = new http.Agent(httpAgentConfig["options"]);
+                        suppliedHttpsAgentOptions = pickAgentOptions(httpsAgentConfig["options"], [
+                            "rejectUnauthorized",
+                            "ca",
+                            "cert",
+                            "key",
+                            "pfx",
+                            "passphrase",
+                            "ciphers",
+                            "minVersion",
+                            "maxVersion",
+                            "secureProtocol",
+                            "honorCipherOrder",
+                            "ALPNProtocols",
+                            "servername",
+                        ]);
                     }
                 }
                 /**
@@ -311,8 +377,9 @@ export default class VMRunner {
                     url,
                     config,
                 });
-                await SSRFProtection.validateWebhookTargetIsSafe(effectiveUrl, {
+                const validatedTarget = await SSRFProtection.validateAndResolveWebhookTarget(effectiveUrl, {
                     allowPrivateNetworkTargets: options.allowPrivateNetworkRequests === true,
+                    privateNetworkAccessIsAllowed: options.privateNetworkAccessIsAllowed,
                     /*
                      * "Webhook URL" is wrong here in both directions: sandboxed code
                      * requests whatever it likes, and one of this runner's two callers
@@ -321,69 +388,250 @@ export default class VMRunner {
                     targetLabel: "Request URL",
                     privateNetworkHint: options.privateNetworkHint,
                 });
+                const canonicalUrl = validatedTarget.url.toString();
+                const pinnedLookup = DataSourceEgressGuard.createPinnedLookup(validatedTarget.addresses);
                 /*
-                 * The URL that was just validated has to be the URL that gets
-                 * dialled. Each of these would otherwise steer the connection
+                 * The canonical URL that was just validated has to be the URL that
+                 * gets dialled. Each of these would otherwise steer the connection
                  * somewhere else entirely, past the check above:
-                 *   proxy      - sends the request to an arbitrary host:port
+                 *   proxy      - sends the request to an arbitrary host:port; setting
+                 *                it false also disables Axios's environment proxies
                  *   socketPath - connects to a unix socket (/var/run/docker.sock)
                  *   transport / adapter - replaces the transport wholesale
+                 *   HTTP/2 - uses Axios's shared session pool instead of these agents
+                 *   lookup - takes precedence over the pinned Agent lookup
+                 *   baseURL / config.url / allowAbsoluteUrls - reinterpret the URL
                  * and a redirect would let a validated public host nominate an
-                 * internal one on the second hop.
+                 * internal one on the second hop. The pinned lookup closes the DNS
+                 * rebinding window between policy validation and socket creation.
                  */
-                const safeConfig = config || {};
-                delete safeConfig["proxy"];
+                const safeConfig = Object.assign({}, (config || {}));
                 delete safeConfig["socketPath"];
                 delete safeConfig["transport"];
                 delete safeConfig["adapter"];
+                delete safeConfig["http2Options"];
+                delete safeConfig["lookup"];
+                delete safeConfig["baseURL"];
+                delete safeConfig["url"];
+                delete safeConfig["allowAbsoluteUrls"];
+                safeConfig["proxy"] = false;
                 safeConfig["maxRedirects"] = 0;
+                safeConfig["httpVersion"] = 1;
+                const getEffectiveByteLimit = (configuredLimit, securityLimit) => {
+                    if (typeof configuredLimit === "number" &&
+                        Number.isFinite(configuredLimit) &&
+                        configuredLimit >= 0) {
+                        return Math.min(Math.floor(configuredLimit), securityLimit);
+                    }
+                    return securityLimit;
+                };
+                const effectiveMaxContentLength = getEffectiveByteLimit(config === null || config === void 0 ? void 0 : config["maxContentLength"], MAX_HTTP_RESPONSE_BYTES);
+                const effectiveMaxBodyLength = getEffectiveByteLimit(config === null || config === void 0 ? void 0 : config["maxBodyLength"], MAX_HTTP_REQUEST_BYTES);
+                /*
+                 * The reader below is the sole response cap so every crossed byte is
+                 * charged to the execution-wide budget before a rejection.
+                 */
+                safeConfig["maxContentLength"] = -1;
+                safeConfig["maxBodyLength"] = effectiveMaxBodyLength;
+                const requestedResponseType = typeof safeConfig["responseType"] === "string"
+                    ? safeConfig["responseType"]
+                    : undefined;
+                const requestedResponseEncoding = typeof safeConfig["responseEncoding"] === "string"
+                    ? safeConfig["responseEncoding"]
+                    : undefined;
+                const transitionalConfig = safeConfig["transitional"] &&
+                    typeof safeConfig["transitional"] === "object"
+                    ? safeConfig["transitional"]
+                    : undefined;
+                const forcedJsonParsing = typeof (transitionalConfig === null || transitionalConfig === void 0 ? void 0 : transitionalConfig["forcedJSONParsing"]) === "boolean"
+                    ? transitionalConfig["forcedJSONParsing"]
+                    : true;
+                const silentJsonParsing = typeof (transitionalConfig === null || transitionalConfig === void 0 ? void 0 : transitionalConfig["silentJSONParsing"]) === "boolean"
+                    ? transitionalConfig["silentJSONParsing"]
+                    : true;
+                const shouldParseResponseAsJson = requestedResponseType === "json" ||
+                    (forcedJsonParsing && !requestedResponseType);
+                const strictJsonParsing = requestedResponseType === "json" && !silentJsonParsing;
+                safeConfig["responseType"] = "stream";
+                safeConfig["httpAgent"] = new http.Agent({
+                    lookup: pinnedLookup,
+                });
+                safeConfig["httpsAgent"] = new https.Agent(Object.assign(Object.assign({}, suppliedHttpsAgentOptions), { lookup: pinnedLookup }));
                 Object.defineProperty(safeConfig, "signal", {
                     value: signal,
                     enumerable: true,
                     configurable: true,
                 });
                 config = safeConfig;
+                const responseDataEncoding = requestedResponseType === "arraybuffer"
+                    ? "base64-arraybuffer"
+                    : shouldParseResponseAsJson
+                        ? "base64-json-or-text"
+                        : "base64-text";
+                const serializedResponseConfig = {
+                    method: method === "request"
+                        ? String(safeConfig["method"] || "get").toLowerCase()
+                        : method,
+                    url: canonicalUrl,
+                    maxContentLength: effectiveMaxContentLength,
+                    maxBodyLength: effectiveMaxBodyLength,
+                };
+                if (requestedResponseType !== undefined) {
+                    serializedResponseConfig["responseType"] = requestedResponseType;
+                }
+                if (requestedResponseEncoding !== undefined) {
+                    serializedResponseConfig["responseEncoding"] =
+                        requestedResponseEncoding;
+                }
+                const encodeResponseBody = (body) => {
+                    if (body.length > MAX_BASE64_RESPONSE_SOURCE_BYTES) {
+                        throw new Error("Remote response exceeded the allowed serialized size.");
+                    }
+                    return {
+                        data: body.toString("base64"),
+                        encoding: responseDataEncoding,
+                    };
+                };
+                const wrapResponseBodyReadError = (error, response) => {
+                    const wrappedError = AxiosError.from(error, AxiosError.ERR_BAD_RESPONSE, response.config, response.request, response, { __oneuptimeResponseBodyReadFailed: true });
+                    /*
+                     * Axios's streamed maxContentLength wrapper can throw an AxiosError
+                     * before attaching its response. Restore the association here so
+                     * interceptors and catch handlers retain status, headers, config,
+                     * and request context just as they do for buffered responses.
+                     */
+                    wrappedError.response = response;
+                    wrappedError.config = response.config;
+                    wrappedError.request = response.request;
+                    return wrappedError;
+                };
+                const normalizeResponseData = async (response) => {
+                    const responseData = response.data;
+                    const isStream = Boolean(responseData &&
+                        typeof responseData === "object" &&
+                        typeof responseData[Symbol.asyncIterator] === "function");
+                    if (!isStream) {
+                        /*
+                         * Test adapters can return an already-decoded value. Convert that
+                         * value back to bounded bytes so every path uses the same base64
+                         * bridge and none can trigger host-side JSON escaping or Buffer's
+                         * decimal-array serialization.
+                         */
+                        let body;
+                        if (Buffer.isBuffer(responseData)) {
+                            body = responseData;
+                        }
+                        else if (ArrayBuffer.isView(responseData)) {
+                            body = Buffer.from(responseData.buffer, responseData.byteOffset, responseData.byteLength);
+                        }
+                        else if (responseData instanceof ArrayBuffer) {
+                            body = Buffer.from(responseData);
+                        }
+                        else {
+                            const serialized = typeof responseData === "string"
+                                ? responseData
+                                : JSON.stringify(responseData !== null && responseData !== void 0 ? responseData : "");
+                            body = Buffer.from(serialized, "utf8");
+                        }
+                        try {
+                            httpResponseBodyBudget.consume(body.length);
+                            return encodeResponseBody(body);
+                        }
+                        catch (error) {
+                            throw wrapResponseBodyReadError(error, response);
+                        }
+                    }
+                    let body;
+                    try {
+                        body = await HTTPResponseBodyReader.read(responseData, {
+                            budget: httpResponseBodyBudget,
+                            statusCode: response.status,
+                            headers: response.headers,
+                            limitRedirectResponseBody: false,
+                            isHeadResponse: method === "head" ||
+                                (method === "request" &&
+                                    String(safeConfig["method"] || "").toLowerCase() === "head"),
+                            maximumResponseBytes: effectiveMaxContentLength,
+                        });
+                    }
+                    catch (error) {
+                        throw wrapResponseBodyReadError(error, response);
+                    }
+                    /*
+                     * Never put raw bytes or decoded attacker text directly into the
+                     * host-side JSON envelope. Buffer.toJSON creates a decimal array,
+                     * while JSON escaping can turn one control byte into six characters;
+                     * either form multiplies memory outside the isolate. Base64 has a
+                     * fixed 4/3 expansion. The reserved 64 KiB covers status/headers and
+                     * wrapper fields, keeping the complete bridge string under 10 MiB.
+                     * Decoding and best-effort JSON parsing happen inside the isolate's
+                     * 128 MiB memory limit.
+                     */
+                    try {
+                        return encodeResponseBody(body);
+                    }
+                    catch (error) {
+                        throw wrapResponseBodyReadError(error, response);
+                    }
+                };
+                const serializeResponseEnvelope = (metadata, responseData) => {
+                    /*
+                     * Keep the attacker-controlled body outside the JSON metadata.
+                     * Parsing a JSON object that contains a near-limit base64 string
+                     * otherwise allocates a second full copy inside the isolate. A JSON
+                     * line followed by base64 is unambiguous because JSON escapes any
+                     * newline found in metadata values.
+                     */
+                    const envelope = `${JSON.stringify(Object.assign(Object.assign({}, metadata), { __oneuptimeDataEncoding: responseData.encoding, __oneuptimeResponseEncoding: requestedResponseEncoding, __oneuptimeShouldParseJson: shouldParseResponseAsJson, __oneuptimeStrictJsonParsing: strictJsonParsing, __oneuptimeConfig: serializedResponseConfig, __oneuptimeHasRequest: true }))}\n${responseData.data}`;
+                    if (Buffer.byteLength(envelope, "utf8") > MAX_HTTP_RESPONSE_BYTES) {
+                        throw new Error("Remote response exceeded the allowed serialized size.");
+                    }
+                    return envelope;
+                };
                 try {
                     let response;
                     switch (method) {
                         case "get":
-                            response = await axios.get(url, config);
+                            response = await axios.get(canonicalUrl, config);
                             break;
                         case "head":
-                            response = await axios.head(url, config);
+                            response = await axios.head(canonicalUrl, config);
                             break;
                         case "options":
-                            response = await axios.options(url, config);
+                            response = await axios.options(canonicalUrl, config);
                             break;
                         case "post":
-                            response = await axios.post(url, body, config);
+                            response = await axios.post(canonicalUrl, body, config);
                             break;
                         case "put":
-                            response = await axios.put(url, body, config);
+                            response = await axios.put(canonicalUrl, body, config);
                             break;
                         case "patch":
-                            response = await axios.patch(url, body, config);
+                            response = await axios.patch(canonicalUrl, body, config);
                             break;
                         case "delete":
-                            response = await axios.delete(url, config);
+                            response = await axios.delete(canonicalUrl, config);
                             break;
-                        case "request":
+                        case "request": {
+                            config["url"] = canonicalUrl;
                             response = await axios.request(config);
                             break;
+                        }
                         default:
                             throw new Error(`Unsupported HTTP method: ${method}`);
                     }
+                    const normalizedResponseData = await normalizeResponseData(response);
                     /*
                      * Convert AxiosHeaders to a plain object before serializing.
                      * JSON.stringify calls AxiosHeaders.toJSON(key) with a truthy key,
                      * which makes it join array headers (like set-cookie) with commas.
                      * This produces invalid Cookie headers when user code forwards them.
                      */
-                    return JSON.stringify({
+                    return serializeResponseEnvelope({
                         status: response.status,
+                        statusText: response.statusText,
                         headers: toPlainHeaders(response.headers),
-                        data: response.data,
-                    });
+                    }, normalizedResponseData);
                 }
                 catch (err) {
                     /*
@@ -393,14 +641,29 @@ export default class VMRunner {
                      */
                     const axiosErr = err;
                     if (axiosErr.isAxiosError && axiosErr.response) {
-                        return JSON.stringify({
+                        let errorForEnvelope = axiosErr;
+                        let normalizedResponseData;
+                        if (axiosErr.__oneuptimeResponseBodyReadFailed) {
+                            normalizedResponseData = encodeResponseBody(Buffer.alloc(0));
+                        }
+                        else {
+                            try {
+                                normalizedResponseData = await normalizeResponseData(axiosErr.response);
+                            }
+                            catch (responseReadError) {
+                                errorForEnvelope = responseReadError;
+                                normalizedResponseData = encodeResponseBody(Buffer.alloc(0));
+                            }
+                        }
+                        return serializeResponseEnvelope({
                             __isAxiosError: true,
-                            message: axiosErr.message || "Request failed",
+                            message: errorForEnvelope.message || "Request failed",
+                            code: errorForEnvelope.code,
+                            name: errorForEnvelope.name,
                             status: axiosErr.response.status,
                             statusText: axiosErr.response.statusText,
                             headers: toPlainHeaders(axiosErr.response.headers),
-                            data: axiosErr.response.data,
-                        });
+                        }, normalizedResponseData);
                     }
                     throw err;
                 }
@@ -417,6 +680,50 @@ export default class VMRunner {
                     });
                     return operationId;
                 }
+                try {
+                    const urlBytes = Buffer.byteLength(url || "", "utf8");
+                    const arg1Bytes = Buffer.byteLength(arg1 || "", "utf8");
+                    const arg2Bytes = Buffer.byteLength(arg2 || "", "utf8");
+                    const hasBody = ["post", "put", "patch"].includes(method);
+                    if (urlBytes > MAX_HTTP_URL_BYTES) {
+                        throw new Error("HTTP request URL exceeded the allowed size.");
+                    }
+                    if (hasBody) {
+                        if (arg1Bytes > MAX_HTTP_REQUEST_BYTES) {
+                            throw new Error("HTTP request body exceeded the allowed size.");
+                        }
+                        if (arg2Bytes > MAX_HTTP_CONFIG_BYTES) {
+                            throw new Error("HTTP request config exceeded the allowed size.");
+                        }
+                    }
+                    else if (method === "request") {
+                        if (arg1Bytes > MAX_HTTP_REQUEST_BYTES + MAX_HTTP_CONFIG_BYTES) {
+                            throw new Error("HTTP request data exceeded the allowed size.");
+                        }
+                    }
+                    else if (arg1Bytes > MAX_HTTP_CONFIG_BYTES) {
+                        throw new Error("HTTP request config exceeded the allowed size.");
+                    }
+                    const operationBytes = urlBytes + arg1Bytes + arg2Bytes;
+                    if (serializedHttpRequestBytes + operationBytes >
+                        MAX_HTTP_REQUEST_BYTES) {
+                        throw new Error("Sandbox HTTP requests exceeded the allowed cumulative request size.");
+                    }
+                    /*
+                     * This budget is deliberately never replenished. Keeping a
+                     * per-execution total prevents many individually legal requests
+                     * from retaining close to the full limit while DNS or sockets are
+                     * pending outside the isolate's memory limit.
+                     */
+                    serializedHttpRequestBytes += operationBytes;
+                }
+                catch (error) {
+                    pendingAxiosOperations.set(operationId, {
+                        status: "rejected",
+                        errorMessage: sanitizeScriptError(error).message,
+                    });
+                    return operationId;
+                }
                 pendingAxiosOperations.set(operationId, { status: "pending" });
                 const abortController = new AbortController();
                 pendingAxiosControllers.add(abortController);
@@ -444,15 +751,22 @@ export default class VMRunner {
             const axiosPollCallback = new ivm.Callback((operationId) => {
                 const operation = pendingAxiosOperations.get(operationId);
                 if (!operation) {
-                    return JSON.stringify({
-                        status: "rejected",
-                        errorMessage: "HTTP request result is unavailable",
-                    });
+                    return `E${JSON.stringify("HTTP request result is unavailable")}`;
+                }
+                if (operation.status === "pending") {
+                    return "P";
                 }
-                if (operation.status !== "pending") {
-                    pendingAxiosOperations.delete(operationId);
+                pendingAxiosOperations.delete(operationId);
+                if (operation.status === "rejected") {
+                    return `E${JSON.stringify(operation.errorMessage)}`;
                 }
-                return JSON.stringify(operation);
+                /*
+                 * The fulfilled value is already a bounded JSON envelope. Prefix
+                 * it instead of embedding it in another JSON document; otherwise
+                 * a response near the byte limit is copied and escaped a second
+                 * time while crossing into the isolate.
+                 */
+                return `F${operation.value}`;
             }, { async: true });
             await jail.set("__oneuptimeHostAxiosStartCallback", axiosStartCallback);
             await jail.set("__oneuptimeHostAxiosPollCallback", axiosPollCallback);
@@ -463,23 +777,71 @@ export default class VMRunner {
         delete globalThis.__oneuptimeHostAxiosStartCallback;
         delete globalThis.__oneuptimeHostAxiosPollCallback;
         const axiosPollWaitArray = new Int32Array(new SharedArrayBuffer(4));
+        let serializedRequestCharacters = 0;
+
+        function assertSerializedRequestLength(method, url, arg1, arg2) {
+          const urlCharacters = typeof url === 'string' ? url.length : 0;
+          const arg1Characters = typeof arg1 === 'string' ? arg1.length : 0;
+          const arg2Characters = typeof arg2 === 'string' ? arg2.length : 0;
+          const hasBody = ['post', 'put', 'patch'].includes(method);
+
+          if (urlCharacters > ${MAX_HTTP_URL_BYTES}) {
+            throw new Error('HTTP request URL exceeded the allowed size.');
+          }
+          if (hasBody && arg1Characters > ${MAX_HTTP_REQUEST_BYTES}) {
+            throw new Error('HTTP request body exceeded the allowed size.');
+          }
+          if (hasBody && arg2Characters > ${MAX_HTTP_CONFIG_BYTES}) {
+            throw new Error('HTTP request config exceeded the allowed size.');
+          }
+          if (
+            method === 'request' &&
+            arg1Characters > ${MAX_HTTP_REQUEST_BYTES + MAX_HTTP_CONFIG_BYTES}
+          ) {
+            throw new Error('HTTP request data exceeded the allowed size.');
+          }
+          if (
+            !hasBody &&
+            method !== 'request' &&
+            arg1Characters > ${MAX_HTTP_CONFIG_BYTES}
+          ) {
+            throw new Error('HTTP request config exceeded the allowed size.');
+          }
+
+          const operationCharacters =
+            urlCharacters + arg1Characters + arg2Characters;
+          if (
+            serializedRequestCharacters + operationCharacters >
+            ${MAX_HTTP_REQUEST_BYTES}
+          ) {
+            throw new Error(
+              'Sandbox HTTP requests exceeded the allowed cumulative request size.'
+            );
+          }
+          serializedRequestCharacters += operationCharacters;
+        }
 
         async function hostAxios(method, url, arg1, arg2) {
+          assertSerializedRequestLength(method, url, arg1, arg2);
           const operationId = await hostAxiosStart(method, url, arg1, arg2);
 
           while (true) {
-            const operation = JSON.parse(await hostAxiosPoll(operationId));
+            const operation = await hostAxiosPoll(operationId);
 
-            if (operation.status === 'pending') {
+            if (operation === 'P') {
               Atomics.wait(axiosPollWaitArray, 0, 0, 1);
               continue;
             }
 
-            if (operation.status === 'rejected') {
-              throw new Error(operation.errorMessage);
+            if (operation[0] === 'E') {
+              throw new Error(JSON.parse(operation.slice(1)));
+            }
+
+            if (operation[0] !== 'F') {
+              throw new Error('HTTP request result is invalid');
             }
 
-            return operation.value;
+            return operation.slice(1);
           }
         }
 
@@ -514,20 +876,330 @@ export default class VMRunner {
           }
         }
 
+        const base64Alphabet =
+          'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+        const base64Lookup = new Int16Array(128);
+        base64Lookup.fill(-1);
+        for (let index = 0; index < base64Alphabet.length; index += 1) {
+          base64Lookup[base64Alphabet.charCodeAt(index)] = index;
+        }
+
+        function decodeBase64(encoded) {
+          const padding = encoded.endsWith('==')
+            ? 2
+            : encoded.endsWith('=')
+              ? 1
+              : 0;
+          const decoded = new Uint8Array((encoded.length / 4) * 3 - padding);
+          let outputIndex = 0;
+
+          for (let index = 0; index < encoded.length; index += 4) {
+            const first = base64Lookup[encoded.charCodeAt(index)];
+            const second = base64Lookup[encoded.charCodeAt(index + 1)];
+            const third = encoded[index + 2] === '='
+              ? 0
+              : base64Lookup[encoded.charCodeAt(index + 2)];
+            const fourth = encoded[index + 3] === '='
+              ? 0
+              : base64Lookup[encoded.charCodeAt(index + 3)];
+            const combined =
+              (first << 18) | (second << 12) | (third << 6) | fourth;
+
+            if (outputIndex < decoded.length) {
+              decoded[outputIndex++] = (combined >> 16) & 0xff;
+            }
+            if (outputIndex < decoded.length) {
+              decoded[outputIndex++] = (combined >> 8) & 0xff;
+            }
+            if (outputIndex < decoded.length) {
+              decoded[outputIndex++] = combined & 0xff;
+            }
+          }
+
+          return decoded;
+        }
+
+        function decodeUtf8(bytes) {
+          const chunks = [];
+          const codeUnits = new Uint16Array(8192);
+          let codeUnitCount = 0;
+
+          function flushCodeUnits() {
+            if (codeUnitCount === 0) return;
+            chunks.push(
+              String.fromCharCode.apply(
+                null,
+                codeUnits.subarray(0, codeUnitCount)
+              )
+            );
+            codeUnitCount = 0;
+          }
+
+          function appendCodePoint(codePoint) {
+            if (codeUnitCount >= codeUnits.length - 1) {
+              flushCodeUnits();
+            }
+
+            if (codePoint <= 0xffff) {
+              codeUnits[codeUnitCount++] = codePoint;
+            } else {
+              const adjusted = codePoint - 0x10000;
+              codeUnits[codeUnitCount++] = 0xd800 + (adjusted >> 10);
+              codeUnits[codeUnitCount++] = 0xdc00 + (adjusted & 0x3ff);
+            }
+          }
+
+          for (let index = 0; index < bytes.length;) {
+            const first = bytes[index];
+            let codePoint = 0xfffd;
+            let width = 1;
+
+            if (first <= 0x7f) {
+              codePoint = first;
+            } else if (
+              first >= 0xc2 &&
+              first <= 0xdf &&
+              index + 1 < bytes.length &&
+              (bytes[index + 1] & 0xc0) === 0x80
+            ) {
+              codePoint = ((first & 0x1f) << 6) | (bytes[index + 1] & 0x3f);
+              width = 2;
+            } else if (
+              first >= 0xe0 &&
+              first <= 0xef &&
+              index + 2 < bytes.length &&
+              (bytes[index + 1] & 0xc0) === 0x80 &&
+              (bytes[index + 2] & 0xc0) === 0x80 &&
+              !(first === 0xe0 && bytes[index + 1] < 0xa0) &&
+              !(first === 0xed && bytes[index + 1] >= 0xa0)
+            ) {
+              codePoint =
+                ((first & 0x0f) << 12) |
+                ((bytes[index + 1] & 0x3f) << 6) |
+                (bytes[index + 2] & 0x3f);
+              width = 3;
+            } else if (
+              first >= 0xf0 &&
+              first <= 0xf4 &&
+              index + 3 < bytes.length &&
+              (bytes[index + 1] & 0xc0) === 0x80 &&
+              (bytes[index + 2] & 0xc0) === 0x80 &&
+              (bytes[index + 3] & 0xc0) === 0x80 &&
+              !(first === 0xf0 && bytes[index + 1] < 0x90) &&
+              !(first === 0xf4 && bytes[index + 1] >= 0x90)
+            ) {
+              codePoint =
+                ((first & 0x07) << 18) |
+                ((bytes[index + 1] & 0x3f) << 12) |
+                ((bytes[index + 2] & 0x3f) << 6) |
+                (bytes[index + 3] & 0x3f);
+              width = 4;
+            }
+
+            appendCodePoint(codePoint);
+            index += width;
+          }
+
+          flushCodeUnits();
+          return chunks.join('');
+        }
+
+        function decodeSingleByte(bytes, asciiOnly) {
+          const chunks = [];
+          const codeUnits = new Uint16Array(8192);
+
+          for (let offset = 0; offset < bytes.length; offset += 8192) {
+            const chunkLength = Math.min(8192, bytes.length - offset);
+            for (let index = 0; index < chunkLength; index += 1) {
+              codeUnits[index] = asciiOnly
+                ? bytes[offset + index] & 0x7f
+                : bytes[offset + index];
+            }
+            chunks.push(
+              String.fromCharCode.apply(
+                null,
+                codeUnits.subarray(0, chunkLength)
+              )
+            );
+          }
+
+          return chunks.join('');
+        }
+
+        function decodeUtf16Le(bytes) {
+          const chunks = [];
+          const codeUnits = new Uint16Array(8192);
+          const codeUnitLength = Math.floor(bytes.length / 2);
+
+          for (let offset = 0; offset < codeUnitLength; offset += 8192) {
+            const chunkLength = Math.min(8192, codeUnitLength - offset);
+            for (let index = 0; index < chunkLength; index += 1) {
+              const byteOffset = (offset + index) * 2;
+              codeUnits[index] =
+                bytes[byteOffset] | (bytes[byteOffset + 1] << 8);
+            }
+            chunks.push(
+              String.fromCharCode.apply(
+                null,
+                codeUnits.subarray(0, chunkLength)
+              )
+            );
+          }
+
+          return chunks.join('');
+        }
+
+        function encodeHex(bytes) {
+          const alphabet = '0123456789abcdef';
+          const chunks = [];
+
+          for (let offset = 0; offset < bytes.length; offset += 4096) {
+            const end = Math.min(offset + 4096, bytes.length);
+            let chunk = '';
+            for (let index = offset; index < end; index += 1) {
+              const value = bytes[index];
+              chunk += alphabet[value >> 4] + alphabet[value & 15];
+            }
+            chunks.push(chunk);
+          }
+
+          return chunks.join('');
+        }
+
+        function decodeResponseText(encoded, bytes, responseEncoding) {
+          const normalizedEncoding = responseEncoding
+            ? String(responseEncoding).toLowerCase()
+            : 'utf8';
+
+          switch (normalizedEncoding) {
+            case 'utf8':
+            case 'utf-8':
+              return decodeUtf8(bytes);
+            case 'latin1':
+            case 'binary':
+              return decodeSingleByte(bytes, false);
+            case 'ascii':
+              return decodeSingleByte(bytes, true);
+            case 'utf16le':
+            case 'utf-16le':
+            case 'ucs2':
+            case 'ucs-2':
+              return decodeUtf16Le(bytes);
+            case 'base64':
+              return encoded;
+            case 'base64url':
+              return encoded
+                .split('+').join('-')
+                .split('/').join('_')
+                .replace(/=+$/, '');
+            case 'hex':
+              return encodeHex(bytes);
+            default:
+              throw new TypeError(
+                'Unknown encoding: ' + responseEncoding
+              );
+          }
+        }
+
         function parseAxiosResult(r) {
-          const parsed = JSON.parse(r);
-          if (parsed && parsed.__isAxiosError) {
-            const err = new Error(parsed.message);
-            err.response = {
-              status: parsed.status,
-              statusText: parsed.statusText,
-              headers: parsed.headers,
-              data: parsed.data,
-            };
+          const metadataEnd = r.indexOf('\\n');
+          if (metadataEnd < 0) {
+            throw new Error('HTTP response envelope is invalid');
+          }
+
+          const parsed = JSON.parse(r.slice(0, metadataEnd));
+          const dataEncoding = parsed.__oneuptimeDataEncoding;
+          const responseEncoding = parsed.__oneuptimeResponseEncoding;
+          const shouldParseJson = parsed.__oneuptimeShouldParseJson === true;
+          const strictJsonParsing =
+            parsed.__oneuptimeStrictJsonParsing === true;
+          const responseConfig = parsed.__oneuptimeConfig || {};
+          const hasRequest = parsed.__oneuptimeHasRequest === true;
+          const isAxiosError = parsed.__isAxiosError === true;
+          const errorMessage = parsed.message || 'Request failed';
+          const errorCode = parsed.code;
+          const errorName = parsed.name;
+          const opaqueRequest = hasRequest
+            ? Object.freeze({ __oneuptimeOpaqueRequest: true })
+            : undefined;
+
+          delete parsed.__oneuptimeDataEncoding;
+          delete parsed.__oneuptimeResponseEncoding;
+          delete parsed.__oneuptimeShouldParseJson;
+          delete parsed.__oneuptimeStrictJsonParsing;
+          delete parsed.__oneuptimeConfig;
+          delete parsed.__oneuptimeHasRequest;
+          delete parsed.__isAxiosError;
+          delete parsed.message;
+          delete parsed.code;
+          delete parsed.name;
+
+          parsed.config = responseConfig;
+          if (opaqueRequest) parsed.request = opaqueRequest;
+
+          function createAxiosError(message, code, name) {
+            const err = new Error(message);
+            err.name = name || 'AxiosError';
+            err.code = code;
+            err.config = responseConfig;
+            err.request = opaqueRequest;
+            err.response = parsed;
             err.isAxiosError = true;
             err.status = parsed.status;
-            throw err;
+            return err;
+          }
+
+          try {
+            const encoded = r.slice(metadataEnd + 1);
+            const decoded = decodeBase64(encoded);
+
+            if (dataEncoding === 'base64-arraybuffer') {
+              parsed.data = decoded;
+            } else {
+              let text = decodeResponseText(
+                encoded,
+                decoded,
+                responseEncoding
+              );
+
+              if (
+                (!responseEncoding || responseEncoding === 'utf8') &&
+                text.charCodeAt(0) === 0xfeff
+              ) {
+                text = text.slice(1);
+              }
+
+              parsed.data = text;
+
+              if (shouldParseJson && text) {
+                try {
+                  parsed.data = JSON.parse(text);
+                } catch (error) {
+                  if (strictJsonParsing) {
+                    throw createAxiosError(
+                      error.message,
+                      'ERR_BAD_RESPONSE',
+                      error.name
+                    );
+                  }
+                }
+              }
+            }
+          } catch (error) {
+            if (error && error.isAxiosError) throw error;
+            throw createAxiosError(
+              error && error.message
+                ? error.message
+                : 'Response could not be decoded',
+              error && error.code,
+              error && error.name
+            );
           }
+
+          if (isAxiosError) {
+            throw createAxiosError(errorMessage, errorCode, errorName);
+          }
+
           return parsed;
         }
 
@@ -540,6 +1212,13 @@ export default class VMRunner {
             if (defaults.headers && overrides.headers) {
               merged.headers = Object.assign({}, defaults.headers, overrides.headers);
             }
+            if (defaults.transitional && overrides.transitional) {
+              merged.transitional = Object.assign(
+                {},
+                defaults.transitional,
+                overrides.transitional
+              );
+            }
             return merged;
           }
 
@@ -604,6 +1283,9 @@ export default class VMRunner {
             const r = await hostAxios('delete', url, merged ? JSON.stringify(merged) : undefined);
             return parseAxiosResult(r);
           };
+          instance.isAxiosError = (payload) => {
+            return Boolean(payload && payload.isAxiosError === true);
+          };
           instance.create = (instanceDefaults) => {
             if (instanceDefaults) assertNoFunctions(instanceDefaults, 'defaults');
             const combinedDefaults = mergeConfig(instanceDefaults);
@@ -799,6 +1481,32 @@ export default class VMRunner {
       })()`;
             let result;
             let scriptError;
+            /*
+             * Keep Node's event loop turning for as long as sandboxed code is
+             * running.
+             *
+             * Every host bridge the sandbox has - axios, sleep, the log sink - is an
+             * isolated-vm async callback: the isolate posts a call onto THIS thread,
+             * this thread answers it, and the isolate resumes. Each of those hops
+             * only makes progress when the event loop takes a turn, and a loop with
+             * nothing else to do parks until its next TIMER rather than spinning. On
+             * an otherwise idle process the nearest timer is usually the overall
+             * timeout armed just below, so a single `await sleep(0)` - or a request
+             * the SSRF guard refuses synchronously, in microseconds - came back
+             * 20 seconds later as "Script execution timed out". Under Jest the
+             * nearest timer was whatever the runner happened to have queued, which
+             * is why the same test took 100ms on one run and 900ms on the next, and
+             * why the VMRunner suites failed on CI while passing locally.
+             *
+             * A no-op ticker gives the loop a reason to wake. It runs only while a
+             * script is in flight and is cleared before this method returns.
+             */
+            const hostBridgeTicker = global.setInterval(() => {
+                /*
+                 * Intentionally empty: existing only so libuv wakes on a known
+                 * cadence instead of sleeping until some unrelated timer.
+                 */
+            }, HOST_BRIDGE_TICK_MS);
             try {
                 // Run with overall timeout covering both CPU and I/O wait.
                 const resultPromise = context.eval(wrappedCode, {
@@ -817,6 +1525,9 @@ export default class VMRunner {
             catch (error) {
                 scriptError = sanitizeScriptError(error);
             }
+            finally {
+                global.clearInterval(hostBridgeTicker);
+            }
             // Parse the JSON string returned from inside the isolate
             let returnValue;
             if (typeof result === "string") {