@reclaimprotocol/attestor-core 5.0.6 → 5.0.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/lib/config/index.d.ts +2 -2
- package/lib/external-rpc/index.js +78 -29
- package/lib/index.js +78 -29
- package/lib/proto/api.d.ts +2 -0
- package/lib/proto/attest.d.ts +435 -0
- package/lib/proto/attestation.d.ts +261 -0
- package/lib/proto/google/protobuf/wrappers.d.ts +132 -0
- package/lib/proto/sevsnp.d.ts +144 -0
- package/lib/proto/state.d.ts +288 -0
- package/lib/proto/tdx.d.ts +165 -0
- package/lib/proto/tpm.d.ts +104 -0
- package/lib/providers/http/utils.d.ts +1 -2
- package/lib/server/utils/sev-snp/allowlist.d.ts +13 -0
- package/lib/server/utils/sev-snp/gcp.d.ts +15 -0
- package/lib/server/utils/sev-snp/nitrotpm.d.ts +19 -0
- package/lib/server/utils/sev-snp/sev-report.d.ts +11 -0
- package/lib/server/utils/sev-snp/verify.d.ts +59 -0
- package/lib/server/utils/sev-snp/verify.test.d.ts +1 -0
- package/package.json +6 -3
package/README.md
CHANGED
|
@@ -36,7 +36,7 @@ Read a longer brief [here](/docs/problem-statement.md).
|
|
|
36
36
|
|
|
37
37
|
This repository contains **Typescript** implementation of the attestor server & the SDK to interact with it. The SDK is compatible with the browser & NodeJS. However, to run the SDK on React Native/Mobile, refer to our [React Native guide](/docs/browser-rpc.md).
|
|
38
38
|
|
|
39
|
-
Note: if you're looking to build apps on Reclaim, we'd recommend you to use the [Reclaim SDK](https://docs.reclaimprotocol.org/) instead. This repository is intended for developers looking to contribute to the core protocol
|
|
39
|
+
Note: if you're looking to build apps on Reclaim, we'd recommend you to use the [Reclaim SDK](https://docs.reclaimprotocol.org/) instead. This repository is intended for developers looking to contribute to the core protocol
|
|
40
40
|
|
|
41
41
|
## Install
|
|
42
42
|
|
package/lib/config/index.d.ts
CHANGED
|
@@ -10,10 +10,10 @@ export declare const API_SERVER_PORT = 8001;
|
|
|
10
10
|
export declare const CONNECTION_TIMEOUT_MS = 10000;
|
|
11
11
|
export declare const DNS_SERVERS: string[];
|
|
12
12
|
export declare const MAX_CLAIM_TIMESTAMP_DIFF_S: number;
|
|
13
|
-
export declare const CURRENT_ATTESTOR_VERSION:
|
|
13
|
+
export declare const CURRENT_ATTESTOR_VERSION: 7;
|
|
14
14
|
export declare const DEFAULT_METADATA: InitRequest;
|
|
15
15
|
export declare const PROVIDER_CTX: {
|
|
16
|
-
version:
|
|
16
|
+
version: 7;
|
|
17
17
|
};
|
|
18
18
|
export declare const PING_INTERVAL_MS = 10000;
|
|
19
19
|
/**
|
|
@@ -2489,6 +2489,7 @@ var AttestorVersion = {
|
|
|
2489
2489
|
ATTESTOR_VERSION_2_0_1: 4,
|
|
2490
2490
|
ATTESTOR_VERSION_3_0_0: 5,
|
|
2491
2491
|
ATTESTOR_VERSION_3_1_0: 6,
|
|
2492
|
+
ATTESTOR_VERSION_3_2_0: 7,
|
|
2492
2493
|
UNRECOGNIZED: -1
|
|
2493
2494
|
};
|
|
2494
2495
|
function attestorVersionFromJSON(object) {
|
|
@@ -2514,6 +2515,9 @@ function attestorVersionFromJSON(object) {
|
|
|
2514
2515
|
case 6:
|
|
2515
2516
|
case "ATTESTOR_VERSION_3_1_0":
|
|
2516
2517
|
return AttestorVersion.ATTESTOR_VERSION_3_1_0;
|
|
2518
|
+
case 7:
|
|
2519
|
+
case "ATTESTOR_VERSION_3_2_0":
|
|
2520
|
+
return AttestorVersion.ATTESTOR_VERSION_3_2_0;
|
|
2517
2521
|
case -1:
|
|
2518
2522
|
case "UNRECOGNIZED":
|
|
2519
2523
|
default:
|
|
@@ -2536,6 +2540,8 @@ function attestorVersionToJSON(object) {
|
|
|
2536
2540
|
return "ATTESTOR_VERSION_3_0_0";
|
|
2537
2541
|
case AttestorVersion.ATTESTOR_VERSION_3_1_0:
|
|
2538
2542
|
return "ATTESTOR_VERSION_3_1_0";
|
|
2543
|
+
case AttestorVersion.ATTESTOR_VERSION_3_2_0:
|
|
2544
|
+
return "ATTESTOR_VERSION_3_2_0";
|
|
2539
2545
|
case AttestorVersion.UNRECOGNIZED:
|
|
2540
2546
|
default:
|
|
2541
2547
|
return "UNRECOGNIZED";
|
|
@@ -6901,7 +6907,7 @@ var WS_PATHNAME = "/ws";
|
|
|
6901
6907
|
var BROWSER_RPC_PATHNAME = "/browser-rpc";
|
|
6902
6908
|
var DEFAULT_REMOTE_FILE_FETCH_BASE_URL = `${BROWSER_RPC_PATHNAME}/resources`;
|
|
6903
6909
|
var MAX_CLAIM_TIMESTAMP_DIFF_S = 10 * 60;
|
|
6904
|
-
var CURRENT_ATTESTOR_VERSION = AttestorVersion.
|
|
6910
|
+
var CURRENT_ATTESTOR_VERSION = AttestorVersion.ATTESTOR_VERSION_3_2_0;
|
|
6905
6911
|
var DEFAULT_METADATA = {
|
|
6906
6912
|
signatureType: ServiceSignatureType.SERVICE_SIGNATURE_TYPE_ETH,
|
|
6907
6913
|
clientVersion: CURRENT_ATTESTOR_VERSION,
|
|
@@ -8422,7 +8428,6 @@ import {
|
|
|
8422
8428
|
import { JSONPath } from "jsonpath-plus";
|
|
8423
8429
|
import { parse } from "parse5";
|
|
8424
8430
|
import { adapter as htmlAdapter } from "parse5-htmlparser2-tree-adapter";
|
|
8425
|
-
import RE2 from "re2";
|
|
8426
8431
|
import xpath from "xpath";
|
|
8427
8432
|
function extractHTMLElement(html, xpathExpression, contentsOnly) {
|
|
8428
8433
|
const { start, end } = extractHTMLElementIndex(html, xpathExpression, contentsOnly);
|
|
@@ -8589,8 +8594,16 @@ function parseHttpResponse(buff) {
|
|
|
8589
8594
|
parser.streamEnded();
|
|
8590
8595
|
return parser.res;
|
|
8591
8596
|
}
|
|
8597
|
+
var RE2;
|
|
8598
|
+
import("re2").then((m) => {
|
|
8599
|
+
RE2 = m.default;
|
|
8600
|
+
}).catch(() => {
|
|
8601
|
+
});
|
|
8592
8602
|
function makeRegex(str) {
|
|
8593
|
-
|
|
8603
|
+
if (RE2) {
|
|
8604
|
+
return RE2(str, "sgiu");
|
|
8605
|
+
}
|
|
8606
|
+
return new RegExp(str, "sgiu");
|
|
8594
8607
|
}
|
|
8595
8608
|
var TEMPLATE_START_CHARCODE = "{".charCodeAt(0);
|
|
8596
8609
|
var TEMPLATE_END_CHARCODE = "}".charCodeAt(0);
|
|
@@ -8677,8 +8690,8 @@ function isValidProxySessionId(sessionId) {
|
|
|
8677
8690
|
|
|
8678
8691
|
// src/providers/http/index.ts
|
|
8679
8692
|
var OK_HTTP_HEADER = "HTTP/1.1 200";
|
|
8680
|
-
var MIN_INJECTION_STR = " HTTP/1.1\r\
|
|
8681
|
-
var MAX_REDACTIONS_IN_PATH = MIN_INJECTION_STR.length - 1;
|
|
8693
|
+
var MIN_INJECTION_STR = " HTTP/1.1\r\n\r\n";
|
|
8694
|
+
var MAX_REDACTIONS_IN_PATH = +(getEnvVariable("HTTP_MAX_REDACTIONS_IN_PATH") ?? MIN_INJECTION_STR.length - 1);
|
|
8682
8695
|
var dateHeaderRegex = "[dD]ate: ((?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (?:[0-3][0-9]) (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (?:[0-9]{4}) (?:[01][0-9]|2[0-3])(?::[0-5][0-9]){2} GMT)";
|
|
8683
8696
|
var dateDiff = 1e3 * 60 * 10;
|
|
8684
8697
|
var HTTP_PROVIDER = {
|
|
@@ -8798,6 +8811,7 @@ var HTTP_PROVIDER = {
|
|
|
8798
8811
|
logger2.error({ response: encodeBase643(response) });
|
|
8799
8812
|
throw new Error("Failed to find response body");
|
|
8800
8813
|
}
|
|
8814
|
+
const revealFraming = shouldRevealChunkFraming(ctx.version);
|
|
8801
8815
|
const reveals = [
|
|
8802
8816
|
{ fromIndex: 0, toIndex: headerEndIndex }
|
|
8803
8817
|
];
|
|
@@ -8814,6 +8828,9 @@ var HTTP_PROVIDER = {
|
|
|
8814
8828
|
if (res.headerIndices["date"]) {
|
|
8815
8829
|
reveals.push(res.headerIndices["date"]);
|
|
8816
8830
|
}
|
|
8831
|
+
if (revealFraming && res.headerIndices["transfer-encoding"]) {
|
|
8832
|
+
reveals.push(res.headerIndices["transfer-encoding"]);
|
|
8833
|
+
}
|
|
8817
8834
|
const body = uint8ArrayToBinaryStr2(res.body);
|
|
8818
8835
|
const redactions = [];
|
|
8819
8836
|
for (const rs of params.responseRedactions || []) {
|
|
@@ -8821,23 +8838,34 @@ var HTTP_PROVIDER = {
|
|
|
8821
8838
|
body,
|
|
8822
8839
|
rs,
|
|
8823
8840
|
bodyStartIdx,
|
|
8824
|
-
res.chunks
|
|
8841
|
+
res.chunks,
|
|
8842
|
+
revealFraming
|
|
8825
8843
|
);
|
|
8826
8844
|
for (const { reveal, redactions: reds } of processor) {
|
|
8827
8845
|
reveals.push(reveal);
|
|
8828
8846
|
redactions.push(...reds);
|
|
8829
8847
|
}
|
|
8830
8848
|
}
|
|
8831
|
-
|
|
8849
|
+
if (revealFraming && res.chunks?.length) {
|
|
8850
|
+
let prev = res.headerEndIdx + 4;
|
|
8851
|
+
for (const chunk of res.chunks) {
|
|
8852
|
+
reveals.push({ fromIndex: prev, toIndex: chunk.fromIndex });
|
|
8853
|
+
prev = chunk.toIndex;
|
|
8854
|
+
}
|
|
8855
|
+
reveals.push({ fromIndex: prev, toIndex: response.length });
|
|
8856
|
+
}
|
|
8857
|
+
reveals.sort((a, b) => a.fromIndex - b.fromIndex);
|
|
8832
8858
|
if (reveals.length > 1) {
|
|
8833
8859
|
let currentIndex = 0;
|
|
8834
8860
|
for (const r of reveals) {
|
|
8835
8861
|
if (currentIndex < r.fromIndex) {
|
|
8836
8862
|
redactions.push({ fromIndex: currentIndex, toIndex: r.fromIndex });
|
|
8837
8863
|
}
|
|
8838
|
-
currentIndex = r.toIndex;
|
|
8864
|
+
currentIndex = Math.max(currentIndex, r.toIndex);
|
|
8865
|
+
}
|
|
8866
|
+
if (currentIndex < response.length) {
|
|
8867
|
+
redactions.push({ fromIndex: currentIndex, toIndex: response.length });
|
|
8839
8868
|
}
|
|
8840
|
-
redactions.push({ fromIndex: currentIndex, toIndex: response.length });
|
|
8841
8869
|
}
|
|
8842
8870
|
for (const r of reveals) {
|
|
8843
8871
|
if (!r.hash) {
|
|
@@ -8887,7 +8915,9 @@ var HTTP_PROVIDER = {
|
|
|
8887
8915
|
if (connectionHeader !== "close") {
|
|
8888
8916
|
throw new Error(`Connection header must be "close", got "${connectionHeader}"`);
|
|
8889
8917
|
}
|
|
8890
|
-
const
|
|
8918
|
+
const allServerBlocks = receipt.filter((s) => s.sender === "server").map((r) => r.message);
|
|
8919
|
+
const firstRealIdx = allServerBlocks.findIndex((b) => !b.every((x) => x === REDACTION_CHAR_CODE2));
|
|
8920
|
+
const serverBlocks = firstRealIdx === -1 ? [] : allServerBlocks.slice(firstRealIdx);
|
|
8891
8921
|
const response = concatArrays(...serverBlocks);
|
|
8892
8922
|
let res;
|
|
8893
8923
|
res = uint8ArrayToStr(response);
|
|
@@ -8930,8 +8960,11 @@ var HTTP_PROVIDER = {
|
|
|
8930
8960
|
if (paramBody.length > 0 && !matchRedactedStrings(paramBody, req.body)) {
|
|
8931
8961
|
throw new Error("request body mismatch");
|
|
8932
8962
|
}
|
|
8933
|
-
if (
|
|
8934
|
-
|
|
8963
|
+
if (shouldRevealChunkFraming(clientVersion)) {
|
|
8964
|
+
const headersStr = res.slice(0, bodyStart);
|
|
8965
|
+
res = /transfer-encoding:\s*chunked/i.test(headersStr) ? headersStr + dechunkResponseBody(res.slice(bodyStart)) : res;
|
|
8966
|
+
} else if (!secretParams) {
|
|
8967
|
+
res = res.slice(bodyStart).replace(/\*{3,}/g, "");
|
|
8935
8968
|
}
|
|
8936
8969
|
for (const { type, value, invert } of params.responseMatches || []) {
|
|
8937
8970
|
const inv = Boolean(invert);
|
|
@@ -9018,6 +9051,16 @@ function assertNoSmuggle(reqBuffer, params) {
|
|
|
9018
9051
|
function shouldRevealCrlf({ version }) {
|
|
9019
9052
|
return version >= AttestorVersion.ATTESTOR_VERSION_2_0_1;
|
|
9020
9053
|
}
|
|
9054
|
+
function shouldRevealChunkFraming(version) {
|
|
9055
|
+
return version >= AttestorVersion.ATTESTOR_VERSION_3_2_0;
|
|
9056
|
+
}
|
|
9057
|
+
function dechunkResponseBody(body) {
|
|
9058
|
+
const parser = makeHttpResponseParser();
|
|
9059
|
+
parser.onChunk(
|
|
9060
|
+
strToUint8Array("HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n" + body)
|
|
9061
|
+
);
|
|
9062
|
+
return uint8ArrayToStr(parser.res.body ?? new Uint8Array());
|
|
9063
|
+
}
|
|
9021
9064
|
function getHostPort(params, secretParams) {
|
|
9022
9065
|
const { host } = new URL(getURL(params, secretParams));
|
|
9023
9066
|
if (!host) {
|
|
@@ -9031,7 +9074,7 @@ function getHostHeaderString(url) {
|
|
|
9031
9074
|
return port && +port !== DEFAULT_HTTPS_PORT ? `${host}:${port}` : host;
|
|
9032
9075
|
}
|
|
9033
9076
|
var paramsRegex = /{{([^{}]+)}}/sgi;
|
|
9034
|
-
function* processRedactionRequest(body, rs, bodyStartIdx, resChunks) {
|
|
9077
|
+
function* processRedactionRequest(body, rs, bodyStartIdx, resChunks, revealFraming) {
|
|
9035
9078
|
let element = body;
|
|
9036
9079
|
let elementIdx = 0;
|
|
9037
9080
|
let elementLength = -1;
|
|
@@ -9121,19 +9164,13 @@ function* processRedactionRequest(body, rs, bodyStartIdx, resChunks) {
|
|
|
9121
9164
|
elementLength = element.length;
|
|
9122
9165
|
yield* addRedaction(null);
|
|
9123
9166
|
}
|
|
9124
|
-
function* addRedaction(hash = rs.hash
|
|
9167
|
+
function* addRedaction(hash = rs.hash) {
|
|
9125
9168
|
if (elementIdx < 0 || !elementLength) {
|
|
9126
9169
|
return;
|
|
9127
9170
|
}
|
|
9128
9171
|
const reveal = getReveal(elementIdx, elementLength, hash || void 0);
|
|
9129
|
-
|
|
9130
|
-
|
|
9131
|
-
redactions: getRedactionsForChunkHeaders(
|
|
9132
|
-
reveal.fromIndex,
|
|
9133
|
-
reveal.toIndex,
|
|
9134
|
-
_resChunks
|
|
9135
|
-
)
|
|
9136
|
-
};
|
|
9172
|
+
const redactions = revealFraming ? [] : getRedactionsForChunkHeaders(reveal.fromIndex, reveal.toIndex, resChunks);
|
|
9173
|
+
yield { reveal, redactions };
|
|
9137
9174
|
}
|
|
9138
9175
|
function getReveal(startIdx, len, hash) {
|
|
9139
9176
|
const from = convertResponsePosToAbsolutePos(
|
|
@@ -9692,13 +9729,25 @@ async function _createClaimOnAttestor({
|
|
|
9692
9729
|
}
|
|
9693
9730
|
revealedPackets.push(...packets.filter((p) => p.sender === "server"));
|
|
9694
9731
|
} else {
|
|
9695
|
-
|
|
9696
|
-
block,
|
|
9697
|
-
|
|
9698
|
-
|
|
9699
|
-
|
|
9700
|
-
|
|
9701
|
-
|
|
9732
|
+
const revealByBlock = new Map(
|
|
9733
|
+
serverPacketsToReveal.map((r) => [r.block, r])
|
|
9734
|
+
);
|
|
9735
|
+
for (const sb of serverBlocks) {
|
|
9736
|
+
const reveal = revealByBlock.get(sb);
|
|
9737
|
+
if (!reveal) {
|
|
9738
|
+
revealedPackets.push({
|
|
9739
|
+
sender: "server",
|
|
9740
|
+
message: new Uint8Array(sb.plaintext.length).fill(REDACTION_CHAR_CODE2)
|
|
9741
|
+
});
|
|
9742
|
+
continue;
|
|
9743
|
+
}
|
|
9744
|
+
const {
|
|
9745
|
+
block,
|
|
9746
|
+
redactedPlaintext,
|
|
9747
|
+
overshotToprfFromPrevBlock,
|
|
9748
|
+
toprfs,
|
|
9749
|
+
oprfRawMarkers
|
|
9750
|
+
} = reveal;
|
|
9702
9751
|
setRevealOfMessage(block.message, {
|
|
9703
9752
|
type: "zk",
|
|
9704
9753
|
redactedPlaintext,
|
package/lib/index.js
CHANGED
|
@@ -155,6 +155,7 @@ var AttestorVersion = {
|
|
|
155
155
|
ATTESTOR_VERSION_2_0_1: 4,
|
|
156
156
|
ATTESTOR_VERSION_3_0_0: 5,
|
|
157
157
|
ATTESTOR_VERSION_3_1_0: 6,
|
|
158
|
+
ATTESTOR_VERSION_3_2_0: 7,
|
|
158
159
|
UNRECOGNIZED: -1
|
|
159
160
|
};
|
|
160
161
|
function attestorVersionFromJSON(object) {
|
|
@@ -180,6 +181,9 @@ function attestorVersionFromJSON(object) {
|
|
|
180
181
|
case 6:
|
|
181
182
|
case "ATTESTOR_VERSION_3_1_0":
|
|
182
183
|
return AttestorVersion.ATTESTOR_VERSION_3_1_0;
|
|
184
|
+
case 7:
|
|
185
|
+
case "ATTESTOR_VERSION_3_2_0":
|
|
186
|
+
return AttestorVersion.ATTESTOR_VERSION_3_2_0;
|
|
183
187
|
case -1:
|
|
184
188
|
case "UNRECOGNIZED":
|
|
185
189
|
default:
|
|
@@ -202,6 +206,8 @@ function attestorVersionToJSON(object) {
|
|
|
202
206
|
return "ATTESTOR_VERSION_3_0_0";
|
|
203
207
|
case AttestorVersion.ATTESTOR_VERSION_3_1_0:
|
|
204
208
|
return "ATTESTOR_VERSION_3_1_0";
|
|
209
|
+
case AttestorVersion.ATTESTOR_VERSION_3_2_0:
|
|
210
|
+
return "ATTESTOR_VERSION_3_2_0";
|
|
205
211
|
case AttestorVersion.UNRECOGNIZED:
|
|
206
212
|
default:
|
|
207
213
|
return "UNRECOGNIZED";
|
|
@@ -4284,7 +4290,7 @@ var DNS_SERVERS = [
|
|
|
4284
4290
|
"8.8.4.4"
|
|
4285
4291
|
];
|
|
4286
4292
|
var MAX_CLAIM_TIMESTAMP_DIFF_S = 10 * 60;
|
|
4287
|
-
var CURRENT_ATTESTOR_VERSION = AttestorVersion.
|
|
4293
|
+
var CURRENT_ATTESTOR_VERSION = AttestorVersion.ATTESTOR_VERSION_3_2_0;
|
|
4288
4294
|
var DEFAULT_METADATA = {
|
|
4289
4295
|
signatureType: ServiceSignatureType.SERVICE_SIGNATURE_TYPE_ETH,
|
|
4290
4296
|
clientVersion: CURRENT_ATTESTOR_VERSION,
|
|
@@ -6731,7 +6737,6 @@ import {
|
|
|
6731
6737
|
import { JSONPath } from "jsonpath-plus";
|
|
6732
6738
|
import { parse } from "parse5";
|
|
6733
6739
|
import { adapter as htmlAdapter } from "parse5-htmlparser2-tree-adapter";
|
|
6734
|
-
import RE2 from "re2";
|
|
6735
6740
|
import xpath from "xpath";
|
|
6736
6741
|
function extractHTMLElementsIndexes(html, xpathExpression, contentsOnly) {
|
|
6737
6742
|
return extractHTMLElementIndexesParse5(html, xpathExpression, contentsOnly);
|
|
@@ -6888,8 +6893,16 @@ function parseHttpResponse(buff) {
|
|
|
6888
6893
|
parser.streamEnded();
|
|
6889
6894
|
return parser.res;
|
|
6890
6895
|
}
|
|
6896
|
+
var RE2;
|
|
6897
|
+
import("re2").then((m) => {
|
|
6898
|
+
RE2 = m.default;
|
|
6899
|
+
}).catch(() => {
|
|
6900
|
+
});
|
|
6891
6901
|
function makeRegex(str) {
|
|
6892
|
-
|
|
6902
|
+
if (RE2) {
|
|
6903
|
+
return RE2(str, "sgiu");
|
|
6904
|
+
}
|
|
6905
|
+
return new RegExp(str, "sgiu");
|
|
6893
6906
|
}
|
|
6894
6907
|
var TEMPLATE_START_CHARCODE = "{".charCodeAt(0);
|
|
6895
6908
|
var TEMPLATE_END_CHARCODE = "}".charCodeAt(0);
|
|
@@ -6957,8 +6970,8 @@ function isValidProxySessionId(sessionId) {
|
|
|
6957
6970
|
|
|
6958
6971
|
// src/providers/http/index.ts
|
|
6959
6972
|
var OK_HTTP_HEADER = "HTTP/1.1 200";
|
|
6960
|
-
var MIN_INJECTION_STR = " HTTP/1.1\r\
|
|
6961
|
-
var MAX_REDACTIONS_IN_PATH = MIN_INJECTION_STR.length - 1;
|
|
6973
|
+
var MIN_INJECTION_STR = " HTTP/1.1\r\n\r\n";
|
|
6974
|
+
var MAX_REDACTIONS_IN_PATH = +(getEnvVariable("HTTP_MAX_REDACTIONS_IN_PATH") ?? MIN_INJECTION_STR.length - 1);
|
|
6962
6975
|
var dateHeaderRegex = "[dD]ate: ((?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (?:[0-3][0-9]) (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (?:[0-9]{4}) (?:[01][0-9]|2[0-3])(?::[0-5][0-9]){2} GMT)";
|
|
6963
6976
|
var dateDiff = 1e3 * 60 * 10;
|
|
6964
6977
|
var HTTP_PROVIDER = {
|
|
@@ -7078,6 +7091,7 @@ var HTTP_PROVIDER = {
|
|
|
7078
7091
|
logger2.error({ response: encodeBase643(response) });
|
|
7079
7092
|
throw new Error("Failed to find response body");
|
|
7080
7093
|
}
|
|
7094
|
+
const revealFraming = shouldRevealChunkFraming(ctx.version);
|
|
7081
7095
|
const reveals = [
|
|
7082
7096
|
{ fromIndex: 0, toIndex: headerEndIndex }
|
|
7083
7097
|
];
|
|
@@ -7094,6 +7108,9 @@ var HTTP_PROVIDER = {
|
|
|
7094
7108
|
if (res.headerIndices["date"]) {
|
|
7095
7109
|
reveals.push(res.headerIndices["date"]);
|
|
7096
7110
|
}
|
|
7111
|
+
if (revealFraming && res.headerIndices["transfer-encoding"]) {
|
|
7112
|
+
reveals.push(res.headerIndices["transfer-encoding"]);
|
|
7113
|
+
}
|
|
7097
7114
|
const body = uint8ArrayToBinaryStr2(res.body);
|
|
7098
7115
|
const redactions = [];
|
|
7099
7116
|
for (const rs of params.responseRedactions || []) {
|
|
@@ -7101,23 +7118,34 @@ var HTTP_PROVIDER = {
|
|
|
7101
7118
|
body,
|
|
7102
7119
|
rs,
|
|
7103
7120
|
bodyStartIdx,
|
|
7104
|
-
res.chunks
|
|
7121
|
+
res.chunks,
|
|
7122
|
+
revealFraming
|
|
7105
7123
|
);
|
|
7106
7124
|
for (const { reveal, redactions: reds } of processor) {
|
|
7107
7125
|
reveals.push(reveal);
|
|
7108
7126
|
redactions.push(...reds);
|
|
7109
7127
|
}
|
|
7110
7128
|
}
|
|
7111
|
-
|
|
7129
|
+
if (revealFraming && res.chunks?.length) {
|
|
7130
|
+
let prev = res.headerEndIdx + 4;
|
|
7131
|
+
for (const chunk of res.chunks) {
|
|
7132
|
+
reveals.push({ fromIndex: prev, toIndex: chunk.fromIndex });
|
|
7133
|
+
prev = chunk.toIndex;
|
|
7134
|
+
}
|
|
7135
|
+
reveals.push({ fromIndex: prev, toIndex: response.length });
|
|
7136
|
+
}
|
|
7137
|
+
reveals.sort((a, b) => a.fromIndex - b.fromIndex);
|
|
7112
7138
|
if (reveals.length > 1) {
|
|
7113
7139
|
let currentIndex = 0;
|
|
7114
7140
|
for (const r of reveals) {
|
|
7115
7141
|
if (currentIndex < r.fromIndex) {
|
|
7116
7142
|
redactions.push({ fromIndex: currentIndex, toIndex: r.fromIndex });
|
|
7117
7143
|
}
|
|
7118
|
-
currentIndex = r.toIndex;
|
|
7144
|
+
currentIndex = Math.max(currentIndex, r.toIndex);
|
|
7145
|
+
}
|
|
7146
|
+
if (currentIndex < response.length) {
|
|
7147
|
+
redactions.push({ fromIndex: currentIndex, toIndex: response.length });
|
|
7119
7148
|
}
|
|
7120
|
-
redactions.push({ fromIndex: currentIndex, toIndex: response.length });
|
|
7121
7149
|
}
|
|
7122
7150
|
for (const r of reveals) {
|
|
7123
7151
|
if (!r.hash) {
|
|
@@ -7167,7 +7195,9 @@ var HTTP_PROVIDER = {
|
|
|
7167
7195
|
if (connectionHeader !== "close") {
|
|
7168
7196
|
throw new Error(`Connection header must be "close", got "${connectionHeader}"`);
|
|
7169
7197
|
}
|
|
7170
|
-
const
|
|
7198
|
+
const allServerBlocks = receipt.filter((s) => s.sender === "server").map((r) => r.message);
|
|
7199
|
+
const firstRealIdx = allServerBlocks.findIndex((b) => !b.every((x) => x === REDACTION_CHAR_CODE2));
|
|
7200
|
+
const serverBlocks = firstRealIdx === -1 ? [] : allServerBlocks.slice(firstRealIdx);
|
|
7171
7201
|
const response = concatArrays(...serverBlocks);
|
|
7172
7202
|
let res;
|
|
7173
7203
|
res = uint8ArrayToStr(response);
|
|
@@ -7210,8 +7240,11 @@ var HTTP_PROVIDER = {
|
|
|
7210
7240
|
if (paramBody.length > 0 && !matchRedactedStrings(paramBody, req.body)) {
|
|
7211
7241
|
throw new Error("request body mismatch");
|
|
7212
7242
|
}
|
|
7213
|
-
if (
|
|
7214
|
-
|
|
7243
|
+
if (shouldRevealChunkFraming(clientVersion)) {
|
|
7244
|
+
const headersStr = res.slice(0, bodyStart);
|
|
7245
|
+
res = /transfer-encoding:\s*chunked/i.test(headersStr) ? headersStr + dechunkResponseBody(res.slice(bodyStart)) : res;
|
|
7246
|
+
} else if (!secretParams) {
|
|
7247
|
+
res = res.slice(bodyStart).replace(/\*{3,}/g, "");
|
|
7215
7248
|
}
|
|
7216
7249
|
for (const { type, value, invert } of params.responseMatches || []) {
|
|
7217
7250
|
const inv = Boolean(invert);
|
|
@@ -7298,6 +7331,16 @@ function assertNoSmuggle(reqBuffer, params) {
|
|
|
7298
7331
|
function shouldRevealCrlf({ version }) {
|
|
7299
7332
|
return version >= AttestorVersion.ATTESTOR_VERSION_2_0_1;
|
|
7300
7333
|
}
|
|
7334
|
+
function shouldRevealChunkFraming(version) {
|
|
7335
|
+
return version >= AttestorVersion.ATTESTOR_VERSION_3_2_0;
|
|
7336
|
+
}
|
|
7337
|
+
function dechunkResponseBody(body) {
|
|
7338
|
+
const parser = makeHttpResponseParser();
|
|
7339
|
+
parser.onChunk(
|
|
7340
|
+
strToUint8Array("HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n" + body)
|
|
7341
|
+
);
|
|
7342
|
+
return uint8ArrayToStr(parser.res.body ?? new Uint8Array());
|
|
7343
|
+
}
|
|
7301
7344
|
function getHostPort(params, secretParams) {
|
|
7302
7345
|
const { host } = new URL(getURL(params, secretParams));
|
|
7303
7346
|
if (!host) {
|
|
@@ -7311,7 +7354,7 @@ function getHostHeaderString(url) {
|
|
|
7311
7354
|
return port && +port !== DEFAULT_HTTPS_PORT ? `${host}:${port}` : host;
|
|
7312
7355
|
}
|
|
7313
7356
|
var paramsRegex = /{{([^{}]+)}}/sgi;
|
|
7314
|
-
function* processRedactionRequest(body, rs, bodyStartIdx, resChunks) {
|
|
7357
|
+
function* processRedactionRequest(body, rs, bodyStartIdx, resChunks, revealFraming) {
|
|
7315
7358
|
let element = body;
|
|
7316
7359
|
let elementIdx = 0;
|
|
7317
7360
|
let elementLength = -1;
|
|
@@ -7401,19 +7444,13 @@ function* processRedactionRequest(body, rs, bodyStartIdx, resChunks) {
|
|
|
7401
7444
|
elementLength = element.length;
|
|
7402
7445
|
yield* addRedaction(null);
|
|
7403
7446
|
}
|
|
7404
|
-
function* addRedaction(hash = rs.hash
|
|
7447
|
+
function* addRedaction(hash = rs.hash) {
|
|
7405
7448
|
if (elementIdx < 0 || !elementLength) {
|
|
7406
7449
|
return;
|
|
7407
7450
|
}
|
|
7408
7451
|
const reveal = getReveal(elementIdx, elementLength, hash || void 0);
|
|
7409
|
-
|
|
7410
|
-
|
|
7411
|
-
redactions: getRedactionsForChunkHeaders(
|
|
7412
|
-
reveal.fromIndex,
|
|
7413
|
-
reveal.toIndex,
|
|
7414
|
-
_resChunks
|
|
7415
|
-
)
|
|
7416
|
-
};
|
|
7452
|
+
const redactions = revealFraming ? [] : getRedactionsForChunkHeaders(reveal.fromIndex, reveal.toIndex, resChunks);
|
|
7453
|
+
yield { reveal, redactions };
|
|
7417
7454
|
}
|
|
7418
7455
|
function getReveal(startIdx, len, hash) {
|
|
7419
7456
|
const from = convertResponsePosToAbsolutePos(
|
|
@@ -8173,13 +8210,25 @@ async function _createClaimOnAttestor({
|
|
|
8173
8210
|
}
|
|
8174
8211
|
revealedPackets.push(...packets.filter((p) => p.sender === "server"));
|
|
8175
8212
|
} else {
|
|
8176
|
-
|
|
8177
|
-
block,
|
|
8178
|
-
|
|
8179
|
-
|
|
8180
|
-
|
|
8181
|
-
|
|
8182
|
-
|
|
8213
|
+
const revealByBlock = new Map(
|
|
8214
|
+
serverPacketsToReveal.map((r) => [r.block, r])
|
|
8215
|
+
);
|
|
8216
|
+
for (const sb of serverBlocks) {
|
|
8217
|
+
const reveal = revealByBlock.get(sb);
|
|
8218
|
+
if (!reveal) {
|
|
8219
|
+
revealedPackets.push({
|
|
8220
|
+
sender: "server",
|
|
8221
|
+
message: new Uint8Array(sb.plaintext.length).fill(REDACTION_CHAR_CODE2)
|
|
8222
|
+
});
|
|
8223
|
+
continue;
|
|
8224
|
+
}
|
|
8225
|
+
const {
|
|
8226
|
+
block,
|
|
8227
|
+
redactedPlaintext,
|
|
8228
|
+
overshotToprfFromPrevBlock,
|
|
8229
|
+
toprfs,
|
|
8230
|
+
oprfRawMarkers
|
|
8231
|
+
} = reveal;
|
|
8183
8232
|
setRevealOfMessage(block.message, {
|
|
8184
8233
|
type: "zk",
|
|
8185
8234
|
redactedPlaintext,
|
package/lib/proto/api.d.ts
CHANGED
|
@@ -41,6 +41,7 @@ export declare const AttestorVersion: {
|
|
|
41
41
|
readonly ATTESTOR_VERSION_2_0_1: 4;
|
|
42
42
|
readonly ATTESTOR_VERSION_3_0_0: 5;
|
|
43
43
|
readonly ATTESTOR_VERSION_3_1_0: 6;
|
|
44
|
+
readonly ATTESTOR_VERSION_3_2_0: 7;
|
|
44
45
|
readonly UNRECOGNIZED: -1;
|
|
45
46
|
};
|
|
46
47
|
export type AttestorVersion = typeof AttestorVersion[keyof typeof AttestorVersion];
|
|
@@ -52,6 +53,7 @@ export declare namespace AttestorVersion {
|
|
|
52
53
|
type ATTESTOR_VERSION_2_0_1 = typeof AttestorVersion.ATTESTOR_VERSION_2_0_1;
|
|
53
54
|
type ATTESTOR_VERSION_3_0_0 = typeof AttestorVersion.ATTESTOR_VERSION_3_0_0;
|
|
54
55
|
type ATTESTOR_VERSION_3_1_0 = typeof AttestorVersion.ATTESTOR_VERSION_3_1_0;
|
|
56
|
+
type ATTESTOR_VERSION_3_2_0 = typeof AttestorVersion.ATTESTOR_VERSION_3_2_0;
|
|
55
57
|
type UNRECOGNIZED = typeof AttestorVersion.UNRECOGNIZED;
|
|
56
58
|
}
|
|
57
59
|
export declare function attestorVersionFromJSON(object: any): AttestorVersion;
|