@rustwirebot/rustplus.js 2.5.0

package/vendor/push-receiver/parser.js

@@ -0,0 +1,276 @@
+const EventEmitter = require('events');
+const path = require('path');
+const { load, BufferReader } = require('protobufjs');
+const {
+  MCS_VERSION_TAG_AND_SIZE,
+  MCS_TAG_AND_SIZE,
+  MCS_SIZE,
+  MCS_PROTO_BYTES,
+
+  kVersionPacketLen,
+  kTagPacketLen,
+  kSizePacketLenMin,
+  kMCSVersion,
+
+  kHeartbeatPingTag,
+  kHeartbeatAckTag,
+  kLoginRequestTag,
+  kLoginResponseTag,
+  kCloseTag,
+  kIqStanzaTag,
+  kDataMessageStanzaTag,
+  kStreamErrorStanzaTag,
+} = require('./constants');
+
+const DEBUG = () => {};
+// uncomment the line below to output debug messages
+// const DEBUG = console.log;
+
+let proto = null;
+
+// Parser parses wire data from gcm.
+// This takes the role of WaitForData in the chromium connection handler.
+//
+// The main differences from the chromium implementation are:
+// - Did not use a max packet length (kDefaultDataPacketLimit), instead we just
+//   buffer data in this._data
+// - Error handling around protobufs
+// - Setting timeouts while waiting for data
+//
+// ref: https://cs.chromium.org/chromium/src/google_apis/gcm/engine/connection_handler_impl.cc?rcl=dc7c41bc0ee5fee0ed269495dde6b8c40df43e40&l=178
+module.exports = class Parser extends EventEmitter {
+  static async init() {
+    if (proto) {
+      return;
+    }
+    proto = await load(path.resolve(__dirname, 'mcs.proto'));
+  }
+
+  constructor(socket) {
+    super();
+    this._socket = socket;
+    this._state = MCS_VERSION_TAG_AND_SIZE;
+    this._data = Buffer.alloc(0);
+    this._sizePacketSoFar = 0;
+    this._messageTag = 0;
+    this._messageSize = 0;
+    this._handshakeComplete = false;
+    this._isWaitingForData = true;
+    this._onData = this._onData.bind(this);
+    this._socket.on('data', this._onData);
+  }
+
+  destroy() {
+    this._isWaitingForData = false;
+    this._socket.removeListener('data', this._onData);
+  }
+
+  _emitError(error) {
+    this.destroy();
+    this.emit('error', error);
+  }
+
+  _onData(buffer) {
+    DEBUG(`Got data: ${buffer.length}`);
+    this._data = Buffer.concat([this._data, buffer]);
+    if (this._isWaitingForData) {
+      this._isWaitingForData = false;
+      this._waitForData();
+    }
+  }
+
+  _waitForData() {
+    DEBUG(`waitForData state: ${this._state}`);
+
+    let minBytesNeeded = 0;
+
+    switch (this._state) {
+      case MCS_VERSION_TAG_AND_SIZE:
+        minBytesNeeded = kVersionPacketLen + kTagPacketLen + kSizePacketLenMin;
+        break;
+      case MCS_TAG_AND_SIZE:
+        minBytesNeeded = kTagPacketLen + kSizePacketLenMin;
+        break;
+      case MCS_SIZE:
+        minBytesNeeded = this._sizePacketSoFar + 1;
+        break;
+      case MCS_PROTO_BYTES:
+        minBytesNeeded = this._messageSize;
+        break;
+      default:
+        this._emitError(new Error(`Unexpected state: ${this._state}`));
+        return;
+    }
+
+    if (this._data.length < minBytesNeeded) {
+      // TODO(ibash) set a timeout and check for socket disconnect
+      DEBUG(
+        `Socket read finished prematurely. Waiting for ${minBytesNeeded -
+          this._data.length} more bytes`
+      );
+      this._isWaitingForData = true;
+      return;
+    }
+
+    DEBUG(`Processing MCS data: state == ${this._state}`);
+
+    switch (this._state) {
+      case MCS_VERSION_TAG_AND_SIZE:
+        this._onGotVersion();
+        break;
+      case MCS_TAG_AND_SIZE:
+        this._onGotMessageTag();
+        break;
+      case MCS_SIZE:
+        this._onGotMessageSize();
+        break;
+      case MCS_PROTO_BYTES:
+        this._onGotMessageBytes();
+        break;
+      default:
+        this._emitError(new Error(`Unexpected state: ${this._state}`));
+        return;
+    }
+  }
+
+  _onGotVersion() {
+    const version = this._data.readInt8(0);
+    this._data = this._data.slice(1);
+    DEBUG(`VERSION IS ${version}`);
+
+    if (version < kMCSVersion && version !== 38) {
+      this._emitError(new Error(`Got wrong version: ${version}`));
+      return;
+    }
+
+    // Process the LoginResponse message tag.
+    this._onGotMessageTag();
+  }
+
+  _onGotMessageTag() {
+    this._messageTag = this._data.readInt8(0);
+    this._data = this._data.slice(1);
+    DEBUG(`RECEIVED PROTO OF TYPE ${this._messageTag}`);
+
+    this._onGotMessageSize();
+  }
+
+  _onGotMessageSize() {
+    let incompleteSizePacket = false;
+    const reader = new BufferReader(this._data);
+
+    try {
+      this._messageSize = reader.int32();
+    } catch (error) {
+      if (error.message.startsWith('index out of range:')) {
+        incompleteSizePacket = true;
+      } else {
+        this._emitError(error);
+        return;
+      }
+    }
+
+    // TODO(ibash) in chromium code there is an extra check here of:
+    // if prev_byte_count >= kSizePacketLenMax then something else went wrong
+    // NOTE(ibash) I could only test this case by manually cutting the buffer
+    // above to be mid-packet like: new BufferReader(this._data.slice(0, 1))
+    if (incompleteSizePacket) {
+      this._sizePacketSoFar = reader.pos;
+      this._state = MCS_SIZE;
+      this._waitForData();
+      return;
+    }
+
+    this._data = this._data.slice(reader.pos);
+
+    DEBUG(`Proto size: ${this._messageSize}`);
+    this._sizePacketSoFar = 0;
+
+    if (this._messageSize > 0) {
+      this._state = MCS_PROTO_BYTES;
+      this._waitForData();
+    } else {
+      this._onGotMessageBytes();
+    }
+  }
+
+  _onGotMessageBytes() {
+    const protobuf = this._buildProtobufFromTag(this._messageTag);
+    if (!protobuf) {
+      this._emitError(new Error('Unknown tag'));
+      return;
+    }
+
+    // Messages with no content are valid; just use the default protobuf for
+    // that tag.
+    if (this._messageSize === 0) {
+      this.emit('message', {tag: this._messageTag, object: {}});
+      this._getNextMessage();
+      return;
+    }
+
+    if (this._data.length < this._messageSize) {
+      // Continue reading data.
+      DEBUG(
+        `Continuing data read. Buffer size is ${this._data.length}, expecting ${
+          this._messageSize
+        }`
+      );
+      this._state = MCS_PROTO_BYTES;
+      this._waitForData();
+      return;
+    }
+
+    const buffer = this._data.slice(0, this._messageSize);
+    this._data = this._data.slice(this._messageSize);
+    const message = protobuf.decode(buffer);
+    const object = protobuf.toObject(message, {
+      longs : String,
+      enums : String,
+      bytes : Buffer,
+    });
+
+    this.emit('message', {tag: this._messageTag, object: object});
+
+    if (this._messageTag === kLoginResponseTag) {
+      if (this._handshakeComplete) {
+        console.error('Unexpected login response');
+      } else {
+        this._handshakeComplete = true;
+        DEBUG('GCM Handshake complete.');
+      }
+    }
+
+    this._getNextMessage();
+  }
+
+  _getNextMessage() {
+    this._messageTag = 0;
+    this._messageSize = 0;
+    this._state = MCS_TAG_AND_SIZE;
+    this._waitForData();
+  }
+
+  _buildProtobufFromTag(tag) {
+    switch (tag) {
+      case kHeartbeatPingTag:
+        return proto.lookupType('mcs_proto.HeartbeatPing');
+      case kHeartbeatAckTag:
+        return proto.lookupType('mcs_proto.HeartbeatAck');
+      case kLoginRequestTag:
+        return proto.lookupType('mcs_proto.LoginRequest');
+      case kLoginResponseTag:
+        return proto.lookupType('mcs_proto.LoginResponse');
+      case kCloseTag:
+        return proto.lookupType('mcs_proto.Close');
+      case kIqStanzaTag:
+        return proto.lookupType('mcs_proto.IqStanza');
+      case kDataMessageStanzaTag:
+        return proto.lookupType('mcs_proto.DataMessageStanza');
+      case kStreamErrorStanzaTag:
+        return proto.lookupType('mcs_proto.StreamErrorStanza');
+      default:
+        return null;
+    }
+  }
+};

package/vendor/push-receiver/register/index.js

@@ -0,0 +1,18 @@
+const { v4: uuidv4 } = require('uuid');
+const { register: registerGCM } = require('../gcm');
+const registerFCM = require('../fcm');
+
+module.exports = register;
+
+async function register(senderId) {
+  // Should be unique by app - One GCM registration/token by app/appId
+  const appId = `wp:receiver.push.com#${uuidv4()}`;
+  const subscription = await registerGCM(appId);
+  const result = await registerFCM({
+    token : subscription.token,
+    senderId,
+    appId,
+  });
+  // Need to be saved by the client
+  return Object.assign({}, result, { gcm : subscription });
+}

package/vendor/push-receiver/utils/base64/index.js

@@ -0,0 +1,15 @@
+module.exports = {
+  escape,
+  toBase64,
+};
+
+function escape(string) {
+  return string
+    .replace(/=/g, '')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_');
+}
+
+function toBase64(input) {
+  return escape(input.toString('base64'));
+}

package/vendor/push-receiver/utils/decrypt/index.js

@@ -0,0 +1,23 @@
+const crypto = require('crypto');
+const ece = require('http_ece');
+
+module.exports = decrypt;
+
+// https://tools.ietf.org/html/draft-ietf-webpush-encryption-03
+function decrypt(object, keys) {
+  const cryptoKey = object.appData.find(item => item.key === 'crypto-key');
+  if (!cryptoKey) throw new Error('crypto-key is missing');
+  const salt = object.appData.find(item => item.key === 'encryption');
+  if (!salt) throw new Error('salt is missing');
+  const dh = crypto.createECDH('prime256v1');
+  dh.setPrivateKey(keys.privateKey, 'base64');
+  const params = {
+    version    : 'aesgcm',
+    authSecret : keys.authSecret,
+    dh         : cryptoKey.value.slice(3),
+    privateKey : dh,
+    salt       : salt.value.slice(5),
+  };
+  const decrypted = ece.decrypt(object.rawData, params);
+  return JSON.parse(decrypted);
+}

package/vendor/push-receiver/utils/http-request/index.js

@@ -0,0 +1,43 @@
+// Minimal request-promise-compatible HTTP client built on axios.
+//
+// This replaces the original `request`/`request-promise` dependency (both
+// deprecated and flagged with known vulnerabilities) while preserving the
+// exact call signature and return-value semantics the vendored
+// push-receiver code was written against:
+//   - options: { url, method, headers, form, body, encoding }
+//   - `form`  -> sent as application/x-www-form-urlencoded
+//   - `body`  -> sent as-is (string or Buffer, e.g. protobuf bytes)
+//   - default return value: response body as a UTF-8 string
+//   - `encoding: null` -> return value is the raw response Buffer
+//     (used for binary/protobuf responses, e.g. the GCM checkin call)
+//   - non-2xx responses throw, same as request-promise's default behaviour
+const axios = require('axios');
+const querystring = require('querystring');
+
+module.exports = async function httpRequest(options = {}) {
+  const { url, method = 'GET', headers = {}, form, body, encoding } = options;
+
+  let data = body;
+  const finalHeaders = { ...headers };
+
+  if (form) {
+    data = querystring.stringify(form);
+    if (!Object.keys(finalHeaders).some((h) => h.toLowerCase() === 'content-type')) {
+      finalHeaders['Content-Type'] = 'application/x-www-form-urlencoded';
+    }
+  }
+
+  const response = await axios.request({
+    url,
+    method,
+    headers: finalHeaders,
+    data,
+    responseType: 'arraybuffer',
+    // Prevent axios from trying to JSON-parse the body for us — callers
+    // expect a raw string/Buffer, exactly like request-promise returned.
+    transformResponse: [(d) => d],
+  });
+
+  const buffer = Buffer.from(response.data);
+  return encoding === null ? buffer : buffer.toString('utf8');
+};

package/vendor/push-receiver/utils/request/index.js

@@ -0,0 +1,27 @@
+const request = require('../http-request');
+const { waitFor } = require('../timeout');
+
+// In seconds
+const MAX_RETRY_TIMEOUT = 15;
+// Step in seconds
+const RETRY_STEP = 5;
+
+module.exports = requestWithRety;
+
+function requestWithRety(...args) {
+  return retry(0, ...args);
+}
+
+async function retry(retryCount = 0, ...args) {
+  try {
+    const result = await request(...args);
+    return result;
+  } catch (e) {
+    const timeout = Math.min(retryCount * RETRY_STEP, MAX_RETRY_TIMEOUT);
+    console.error(`Request failed : ${e.message}`);
+    console.error(`Retrying in ${timeout} seconds`);
+    await waitFor(timeout * 1000);
+    const result = await retry(retryCount + 1, ...args);
+    return result;
+  }
+}

package/vendor/push-receiver/utils/timeout/index.js

@@ -0,0 +1,7 @@
+module.exports = {
+  waitFor,
+};
+
+function waitFor(timeout) {
+  return new Promise(resolve => setTimeout(resolve, timeout));
+}