@poe-platform/safe-bash 0.1.773 → 0.1.774

package/dist/safe-bash-command-gpg/index.js

@@ -4,7 +4,7 @@ import {
 
 // packages/safe-bash-command-gpg/dist/index.js
 init_buffer();
-import { commandRuntimeIdentity, getCommandArguments, readBytes, writeText } from "../safe-bash-contracts/index.js";
+import { FsError, commandRuntimeIdentity, getCommandArguments, readBytes, writeText } from "../safe-bash-contracts/index.js";
 import { PublicDiagnostic } from "../safe-bash-contracts/diagnostics.js";
 import { writeFileOutput } from "../safe-bash-contracts/filesystem-output-budget.js";
 import { yieldTurn } from "../safe-bash-contracts/yield.js";
@@ -184,7 +184,7 @@ ${crc}
 `;
   return { armor, keyIdHex };
 }
-async function verifyOpenPgpDetachedSignature(armor, payload) {
+async function verifyOpenPgpDetachedSignature(armor, payload, keys) {
   const b64 = armor.split("\n").map((l) => l.trim()).filter((l) => !l.startsWith("-----") && !l.startsWith("=") && !l.includes(":") && l.length > 0).join("");
   const pkt = base64ToBytes(b64);
   if (pkt.byteLength < 10 || pkt[0] !== 194) {
@@ -234,6 +234,13 @@ async function verifyOpenPgpDetachedSignature(armor, payload) {
   if (!pubKey || unhashedEnd + 2 + 68 > body.byteLength) {
     return { valid: false, signerUid, keyIdHex };
   }
+  const fingerprint = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new Uint8Array(pubKey)));
+  const derivedKeyId = bytesToHex(fingerprint.slice(24, 32)).toUpperCase();
+  const trustedKey = keys.find((key) => key.keyIdHex === derivedKeyId && key.pubHex.toLowerCase() === bytesToHex(pubKey));
+  if (keyIdHex !== derivedKeyId || !trustedKey) {
+    return { valid: false, signerUid, keyIdHex };
+  }
+  signerUid = trustedKey.uid;
   const mpiStart = unhashedEnd + 2;
   const sigBytes = new Uint8Array(64);
   sigBytes.set(body.slice(mpiStart + 2, mpiStart + 34), 0);
@@ -327,6 +334,20 @@ async function collectSourceBytes(source, maxBytes, signal) {
   }
   return result;
 }
+async function readLimitedFile(context, path, maxBytes) {
+  try {
+    const bytes = await context.fs.readFile(path, { ...maxBytes === Infinity ? {} : { maxBytes }, signal: context.signal });
+    if (bytes.byteLength > maxBytes) {
+      throw new PublicDiagnostic(`input exceeds maximum buffered size of ${maxBytes} bytes`);
+    }
+    return bytes;
+  } catch (error) {
+    if (error instanceof FsError && error.code === "EFBIG") {
+      throw new PublicDiagnostic(`input exceeds maximum buffered size of ${maxBytes} bytes`);
+    }
+    throw error;
+  }
+}
 function createGpgCommand(options = {}) {
   const limits = settings(options);
   return {
@@ -416,7 +437,7 @@ ${bytesToBase64(textEncoder.encode(JSON.stringify(keys)), 64)}
           return { exitCode: 0 };
         }
         if (importKeys) {
-          const input = positionals[0] ? await context.fs.readFile(pathPosix.resolve(context.cwd, positionals[0])) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
+          const input = positionals[0] ? await readLimitedFile(context, pathPosix.resolve(context.cwd, positionals[0]), maxBytes) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
           const b64 = textDecoder.decode(input).split("\n").filter((l) => !l.startsWith("-----") && l.trim().length > 0).join("");
           const imported = JSON.parse(textDecoder.decode(base64ToBytes(b64)));
           const existing = await loadKeyring(context);
@@ -431,7 +452,7 @@ gpg:               imported: ${imported.length}
           return { exitCode: 0 };
         }
         if (detachSign) {
-          const payload = positionals[0] ? await context.fs.readFile(pathPosix.resolve(context.cwd, positionals[0])) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
+          const payload = positionals[0] ? await readLimitedFile(context, pathPosix.resolve(context.cwd, positionals[0]), maxBytes) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
           const key = await ensureKeyForUid(context, signerUid);
           const { armor, keyIdHex } = await createOpenPgpDetachedSignature(key.seed, key.pubKey, key.uid, payload);
           if (statusFd) {
@@ -449,9 +470,9 @@ gpg:               imported: ${imported.length}
           const sigPath = positionals[0];
           if (!sigPath)
             throw new PublicDiagnostic("missing signature file for --verify");
-          const sigArmor = textDecoder.decode(await context.fs.readFile(pathPosix.resolve(context.cwd, sigPath)));
-          const dataBytes = positionals[1] ? await context.fs.readFile(pathPosix.resolve(context.cwd, positionals[1])) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
-          const res = await verifyOpenPgpDetachedSignature(sigArmor, dataBytes);
+          const sigArmor = textDecoder.decode(await readLimitedFile(context, pathPosix.resolve(context.cwd, sigPath), maxBytes));
+          const dataBytes = positionals[1] ? await readLimitedFile(context, pathPosix.resolve(context.cwd, positionals[1]), maxBytes) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
+          const res = await verifyOpenPgpDetachedSignature(sigArmor, dataBytes, await loadKeyring(context));
           if (!res.valid) {
             await writeText(context.stderr, `gpg: BAD signature from "${res.signerUid}"
 `);

package/dist/safe-bash-command-imagemagick/index.js

@@ -28,8 +28,8 @@ import {
   thresholdImage,
   tintImage,
   trimImage
-} from "../safe-bash/command-chunks/chunk-G3NVK25P.js";
-import "../safe-bash/command-chunks/chunk-B2MM5DIT.js";
+} from "../safe-bash/command-chunks/chunk-HH5QPKIN.js";
+import "../safe-bash/command-chunks/chunk-PM63UJE6.js";
 import {
   init_buffer
 } from "../safe-bash/command-chunks/chunk-HX3SHTCE.js";

package/dist/safe-bash-command-openssl/index.js

@@ -175,6 +175,20 @@ async function pbkdf2DeriveKeyAndIv(password, salt, iterations) {
     iv: derived.slice(32, 48)
   };
 }
+async function readLimitedFile(context, path, maxBytes) {
+  try {
+    const bytes = await context.fs.readFile(path, { ...maxBytes === Infinity ? {} : { maxBytes }, signal: context.signal });
+    if (bytes.byteLength > maxBytes) {
+      throw new PublicDiagnostic(`input exceeds maximum buffered size of ${maxBytes} bytes`);
+    }
+    return bytes;
+  } catch (error) {
+    if (error instanceof FsError && error.code === "EFBIG") {
+      throw new PublicDiagnostic(`input exceeds maximum buffered size of ${maxBytes} bytes`);
+    }
+    throw error;
+  }
+}
 function createOpensslCommand(options = {}) {
   const limits = settings(options);
   return {
@@ -216,7 +230,11 @@ function createOpensslCommand(options = {}) {
             throw new PublicDiagnostic(`invalid random byte count: ${numBytes}`);
           }
           const raw = new Uint8Array(numBytes);
-          globalThis.crypto.getRandomValues(raw);
+          for (let offset = 0; offset < raw.byteLength; offset += 65536) {
+            globalThis.crypto.getRandomValues(raw.subarray(offset, Math.min(offset + 65536, raw.byteLength)));
+            if (offset + 65536 < raw.byteLength)
+              await yieldTurn(context.signal);
+          }
           const out = hex ? textEncoder.encode(`${bytesToHex(raw)}
 `) : b64 ? textEncoder.encode(`${bytesToBase64(raw, true)}
 `) : raw;
@@ -241,7 +259,7 @@ function createOpensslCommand(options = {}) {
             else if (a === "-out" && i + 1 < rest.length)
               outFile = rest[++i];
           }
-          const input = inFile ? await context.fs.readFile(pathPosix.resolve(context.cwd, inFile)) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
+          const input = inFile ? await readLimitedFile(context, pathPosix.resolve(context.cwd, inFile), maxBytes) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
           if (input.byteLength > maxBytes) {
             throw new PublicDiagnostic(`input exceeds maximum buffered size of ${maxBytes} bytes`);
           }
@@ -290,7 +308,7 @@ function createOpensslCommand(options = {}) {
           const textLines = [];
           let lastBinary = new Uint8Array(0);
           for (const f of targets) {
-            const bytes = f ? await context.fs.readFile(pathPosix.resolve(context.cwd, f)) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
+            const bytes = f ? await readLimitedFile(context, pathPosix.resolve(context.cwd, f), maxBytes) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
             if (bytes.byteLength > maxBytes) {
               throw new PublicDiagnostic(`input exceeds maximum buffered size of ${maxBytes} bytes`);
             }
@@ -336,7 +354,7 @@ function createOpensslCommand(options = {}) {
             else if (a === "-out" && i + 1 < rest.length)
               outFile = rest[++i];
           }
-          const rawInput = inFile ? await context.fs.readFile(pathPosix.resolve(context.cwd, inFile)) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
+          const rawInput = inFile ? await readLimitedFile(context, pathPosix.resolve(context.cwd, inFile), maxBytes) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
           if (rawInput.byteLength > maxBytes) {
             throw new PublicDiagnostic(`input exceeds maximum buffered size of ${maxBytes} bytes`);
           }
@@ -406,7 +424,7 @@ ${bytesToBase64(pkcs8, true)}
             else if (rest[i] === "-pubout")
               pubOut = true;
           }
-          const inputBytes = inFile ? await context.fs.readFile(pathPosix.resolve(context.cwd, inFile)) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
+          const inputBytes = inFile ? await readLimitedFile(context, pathPosix.resolve(context.cwd, inFile), maxBytes) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
           const pemText = textDecoder.decode(inputBytes);
           const b64Body = pemText.split("\n").filter((l) => !l.startsWith("-----")).join("");
           const pkcs8 = base64ToBytes(b64Body);
@@ -486,7 +504,7 @@ ${bytesToBase64(textEncoder.encode(certMeta), true)}
             else if (a === "-dates")
               showDates = true;
           }
-          const inputBytes = inFile ? await context.fs.readFile(pathPosix.resolve(context.cwd, inFile)) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
+          const inputBytes = inFile ? await readLimitedFile(context, pathPosix.resolve(context.cwd, inFile), maxBytes) : await collectSourceBytes(context.stdin, maxBytes, context.signal);
           const pemText = textDecoder.decode(inputBytes);
           const b64Body = pemText.split("\n").filter((l) => !l.startsWith("-----")).join("");
           const rawCert = base64ToBytes(b64Body);

package/dist/safe-bash-command-pandoc/command.js

@@ -2,11 +2,11 @@ import {
   createPandocCommand,
   createPandocCommands,
   pandocCommands
-} from "../safe-bash/command-chunks/chunk-5VXZSNM2.js";
+} from "../safe-bash/command-chunks/chunk-4ZHDCMQX.js";
 import "../safe-bash/command-chunks/chunk-MKQVQMXO.js";
 import "../safe-bash/command-chunks/chunk-RDV7UCYZ.js";
-import "../safe-bash/command-chunks/chunk-G3NVK25P.js";
-import "../safe-bash/command-chunks/chunk-B2MM5DIT.js";
+import "../safe-bash/command-chunks/chunk-HH5QPKIN.js";
+import "../safe-bash/command-chunks/chunk-PM63UJE6.js";
 import "../safe-bash/command-chunks/chunk-Y2KHC6TZ.js";
 import "../safe-bash/command-chunks/chunk-YGYOVXTO.js";
 import "../safe-bash/command-chunks/chunk-I5GLTNVH.js";

package/dist/safe-bash-command-pandoc/index.js

@@ -21,11 +21,11 @@ import {
   readDocument,
   resolveConversionArgs,
   writeDocument
-} from "../safe-bash/command-chunks/chunk-5VXZSNM2.js";
+} from "../safe-bash/command-chunks/chunk-4ZHDCMQX.js";
 import "../safe-bash/command-chunks/chunk-MKQVQMXO.js";
 import "../safe-bash/command-chunks/chunk-RDV7UCYZ.js";
-import "../safe-bash/command-chunks/chunk-G3NVK25P.js";
-import "../safe-bash/command-chunks/chunk-B2MM5DIT.js";
+import "../safe-bash/command-chunks/chunk-HH5QPKIN.js";
+import "../safe-bash/command-chunks/chunk-PM63UJE6.js";
 import {
   createLuaFilterCapability
 } from "../safe-bash/command-chunks/chunk-Y2KHC6TZ.js";