@sproutboat/runtime 0.6.3 → 0.6.4

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @sproutboat/runtime
 
+## 0.6.4
+
+### Patch Changes
+
+- 8ef3148: Fix (baronunread/sproutboat#180): `__sbToBytes` built its result with repeated
+  `s +=` in a loop, the same `O(n^2)` bug class the `__sbFromUtf8` fix in 0.6.3
+  addressed, just on the encode side. Porffor's strings have no rope/cons
+  optimization, so `+=` in a loop copies the whole accumulated string on every
+  append. Both of its branches were affected: the UTF-8 encode loop over string
+  input, and the byte-for-byte copy out of an ArrayBuffer or typed array.
+  
+  This one matters because `__sbToBytes` sits behind every `crypto.subtle` call a
+  handler makes: `digest`, `importKey`, `sign`, `verify` and the PBKDF2/scrypt
+  path all funnel their data, keys, salts and signatures through it. Hashing a
+  request body was quadratic in the body's size.
+  
+  `__sbHexOrBytes` had the same shape on a third crypto path (it decodes the
+  `expected` side of an HMAC verify) and was worse than a plain `+=` loop: on odd
+  iterations it rewrote the last character with `out = out.slice(0, -1) + ...`,
+  copying the accumulated string a second time per byte. It now holds the high
+  nibble in a local until its pair arrives and pushes one character per byte.
+  
+  Three further accumulators converted to the same array-and-join idiom for
+  consistency. These are bounded by header count, id length or parameter count
+  rather than by handler input, so they are hygiene rather than a fix:
+  `__SproutboatURLSearchParams.prototype.toString()` in the prelude, and `__sbHex`
+  plus the outbound-fetch header builder in `transport-embedded.js`.
+  
+  Covered by a new `to-bytes.test.js`, following the `utf8-decode.test.js`
+  convention of lifting the pure functions out of the text-only prelude: ASCII,
+  2-byte, 3-byte and surrogate-pair encodes checked byte-identical against
+  `TextEncoder`, the existing unpaired-surrogate behaviour pinned, typed-array and
+  ArrayBuffer input with high bytes, hex decode in both cases with its non-hex and
+  odd-length fallbacks, and long inputs (46KB string, 50,000-byte array, 20,000-byte
+  hex) for correctness at the size the quadratic version hurt.
+
 ## 0.6.3
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "license": "MIT",
   "type": "module",
   "main": "./src/index.ts",

package/src/native-fetch-prelude.js

@@ -171,12 +171,14 @@ class __SproutboatURLSearchParams {
     return this._keys.length;
   }
   toString() {
-    let out = "";
+    // Array + one join("&"), not `out +=` in a loop: see __sbToBytes. A query
+    // string is usually short, but a params object built from a large form or
+    // a paginated cursor list is not, and the fix costs nothing.
+    const out = [];
     for (let i = 0; i < this._keys.length; i++) {
-      if (i > 0) out += "&";
-      out += encodeURIComponent(this._keys[i]) + "=" + encodeURIComponent(this._vals[i]);
+      out.push(encodeURIComponent(this._keys[i]) + "=" + encodeURIComponent(this._vals[i]));
     }
-    return out;
+    return out.join("&");
   }
 }
 
@@ -295,31 +297,38 @@ function __sbHashBits(algo) {
 // TextEncoder); ArrayBuffer / typed-array input is copied byte for byte.
 function __sbToBytes(input) {
   if (input == null) return "";
+  // Collected into an array and joined once at the end, not built with
+  // repeated `out +=` -- Porffor's strings have no rope/cons optimization, so
+  // `+=` in a loop copies the whole accumulated string on every append,
+  // making the naive version O(n^2). Same fix as __sbFromUtf8 above, on the
+  // encode side (sits behind every crypto.subtle call).
   if (__sbIsStr(input)) {
-    let s = "";
+    const out = [];
     for (let i = 0; i < input.length; i++) {
       const c = input.charCodeAt(i);
-      if (c < 0x80) s += String.fromCharCode(c);
-      else if (c < 0x800) s += String.fromCharCode(0xc0 | (c >> 6)) + String.fromCharCode(0x80 | (c & 0x3f));
+      if (c < 0x80) out.push(String.fromCharCode(c));
+      else if (c < 0x800) out.push(String.fromCharCode(0xc0 | (c >> 6)) + String.fromCharCode(0x80 | (c & 0x3f)));
       else if (c >= 0xd800 && c < 0xdc00 && i + 1 < input.length) {
         const cp = 0x10000 + ((c - 0xd800) << 10) + (input.charCodeAt(++i) - 0xdc00);
-        s +=
+        out.push(
           String.fromCharCode(0xf0 | (cp >> 18)) +
-          String.fromCharCode(0x80 | ((cp >> 12) & 0x3f)) +
-          String.fromCharCode(0x80 | ((cp >> 6) & 0x3f)) +
-          String.fromCharCode(0x80 | (cp & 0x3f));
+            String.fromCharCode(0x80 | ((cp >> 12) & 0x3f)) +
+            String.fromCharCode(0x80 | ((cp >> 6) & 0x3f)) +
+            String.fromCharCode(0x80 | (cp & 0x3f))
+        );
       } else
-        s +=
+        out.push(
           String.fromCharCode(0xe0 | (c >> 12)) +
-          String.fromCharCode(0x80 | ((c >> 6) & 0x3f)) +
-          String.fromCharCode(0x80 | (c & 0x3f));
+            String.fromCharCode(0x80 | ((c >> 6) & 0x3f)) +
+            String.fromCharCode(0x80 | (c & 0x3f))
+        );
     }
-    return s;
+    return out.join("");
   }
   const view = input.length !== undefined && input.buffer !== undefined ? input : new Uint8Array(input);
-  let s = "";
-  for (let i = 0; i < view.length; i++) s += String.fromCharCode(view[i] & 0xff);
-  return s;
+  const out = [];
+  for (let i = 0; i < view.length; i++) out.push(String.fromCharCode(view[i] & 0xff));
+  return out.join("");
 }
 function __sbBufFrom(latin1) {
   const b = new Uint8Array(latin1.length);
@@ -434,15 +443,20 @@ function __sbEqCt(a, b) {
 // An even-length all-hex string -> its bytes; anything else -> its raw bytes.
 function __sbHexOrBytes(value) {
   if (__sbIsStr(value) && value.length > 0 && value.length % 2 === 0) {
-    let out = "";
+    // Array-and-join for the same reason as __sbToBytes above; the old version
+    // was worse than a plain `+=` loop, since rewriting the last char with
+    // `out.slice(0, -1) + ...` copied the whole string a second time per byte.
+    // The high nibble is held in a local until its pair arrives instead.
+    const out = [];
+    let hi = 0;
     for (let i = 0; i < value.length; i++) {
       const c = value.charCodeAt(i);
       const d = c >= 48 && c <= 57 ? c - 48 : c >= 97 && c <= 102 ? c - 87 : c >= 65 && c <= 70 ? c - 55 : -1;
       if (d < 0) return __sbToBytes(value);
-      if (i % 2 === 0) out += String.fromCharCode(d << 4);
-      else out = out.slice(0, -1) + String.fromCharCode(out.charCodeAt(out.length - 1) | d);
+      if (i % 2 === 0) hi = d << 4;
+      else out.push(String.fromCharCode(hi | d));
     }
-    return out;
+    return out.join("");
   }
   return __sbToBytes(value);
 }

package/src/to-bytes.test.js

@@ -0,0 +1,114 @@
+// sproutboat #180 — __sbToBytes lives inline in native-fetch-prelude.js (the
+// prelude is prepended as text and cannot import), so this test lifts that one
+// pure-JS function (plus its __sbIsStr dependency) out and exercises it
+// directly. If it moves or its boundary markers change, this fails loudly
+// rather than silently testing nothing.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
+const isStrStart = src.indexOf("function __sbIsStr(");
+const isStrEnd = src.indexOf("function __sbIsFn(");
+const start = src.indexOf("function __sbToBytes(");
+const end = src.indexOf("function __sbBufFrom(");
+const hexStart = src.indexOf("function __sbHexOrBytes(");
+const hexEnd = src.indexOf("\nif (globalThis.crypto.subtle");
+if (isStrStart === -1 || isStrEnd === -1 || start === -1 || end === -1 || end < start) {
+  throw new Error("__sbToBytes (or __sbIsStr) block not found in prelude");
+}
+if (hexStart === -1 || hexEnd === -1 || hexEnd < hexStart) throw new Error("__sbHexOrBytes block not found in prelude");
+
+// oxlint-disable-next-line no-function-constructor -- lifting pure blocks out of the text-only prelude for test
+const load = new Function(
+  `${src.slice(isStrStart, isStrEnd)}\n${src.slice(start, end)}\n${src.slice(hexStart, hexEnd)}\nreturn { __sbToBytes, __sbHexOrBytes };`,
+);
+const { __sbToBytes, __sbHexOrBytes } = load();
+
+/** The real bytestring shape (one char per raw byte) as a normal JS array of byte values, for comparison. */
+function bytesOf(bytestring) {
+  const out = [];
+  for (let i = 0; i < bytestring.length; i++) out.push(bytestring.charCodeAt(i));
+  return out;
+}
+
+test("ASCII string encodes byte-identically to TextEncoder", () => {
+  const text = "hello world 123";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("2-byte (Latin-1 range) sequences encode byte-identically to TextEncoder", () => {
+  const text = "café";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("3-byte sequences encode byte-identically to TextEncoder", () => {
+  const text = "porffor · x86_64 ✓";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("surrogate-pair (4-byte) sequences encode byte-identically to TextEncoder", () => {
+  const text = "🌱 sprout 🌱";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("a lone unpaired surrogate falls into the 3-byte branch, matching charCodeAt-based encoders", () => {
+  const lone = String.fromCharCode(0xd800); // high surrogate with no following low surrogate
+  const view = __sbToBytes(lone);
+  // WHATWG TextEncoder would replace this with U+FFFD; __sbToBytes intentionally
+  // encodes the raw code unit instead (matches the historical/legacy behavior it
+  // already had) -- this test only pins that behavior isn't disturbed by the fix.
+  expect(bytesOf(view)).toEqual([0xe0 | (0xd800 >> 12), 0x80 | ((0xd800 >> 6) & 0x3f), 0x80 | (0xd800 & 0x3f)]);
+});
+
+test("null/undefined input returns empty", () => {
+  expect(__sbToBytes(null)).toBe("");
+  expect(__sbToBytes(undefined)).toBe("");
+});
+
+test("ArrayBuffer / typed-array input is copied byte for byte, high bytes included", () => {
+  const bytes = new Uint8Array([0x00, 0x7f, 0x80, 0xff, 0x01, 0xfe]);
+  expect(bytesOf(__sbToBytes(bytes))).toEqual([...bytes]);
+  expect(bytesOf(__sbToBytes(bytes.buffer))).toEqual([...bytes]);
+});
+
+// __sbToBytes builds its result via an array + one join(), not repeated
+// `out +=` / `s +=`. Porffor's strings have no rope/cons optimization, so `+=`
+// in a loop copies the whole accumulated string on every append, making a
+// large encode O(n^2) -- the same bug class __sbFromUtf8 was fixed for
+// (see utf8-decode.test.js). This is a correctness check (long input still
+// round-trips exactly), not a timing assertion.
+test("a long, multi-chunk mixed-width string round-trips byte-identically", () => {
+  const chunk = "porffor · src/index.js → 1.25 MB · x86_64-musl ✓ café 🌱 ";
+  const text = chunk.repeat(800); // ~46KB, comparable to the __sbFromUtf8 regression case
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("a long high-byte typed array round-trips byte for byte", () => {
+  const bytes = new Uint8Array(50000);
+  for (let i = 0; i < bytes.length; i++) bytes[i] = (i * 37 + 0x80) & 0xff;
+  expect(bytesOf(__sbToBytes(bytes))).toEqual([...bytes]);
+});
+
+// __sbHexOrBytes had the same O(n^2) shape on a third path (it backs the
+// `expected` side of the HMAC verify), plus a `slice(0, -1) + ...` rewrite that
+// copied the accumulated string a second time per byte. Same array+join fix.
+test("an even-length hex string decodes to its bytes, both cases", () => {
+  expect(bytesOf(__sbHexOrBytes("00ff107a"))).toEqual([0x00, 0xff, 0x10, 0x7a]);
+  expect(bytesOf(__sbHexOrBytes("00FF107A"))).toEqual([0x00, 0xff, 0x10, 0x7a]);
+  expect(bytesOf(__sbHexOrBytes("aAbB"))).toEqual([0xaa, 0xbb]);
+});
+
+test("a non-hex or odd-length string falls back to raw bytes", () => {
+  expect(__sbHexOrBytes("zz")).toBe(__sbToBytes("zz"));
+  expect(__sbHexOrBytes("abc")).toBe(__sbToBytes("abc")); // odd length
+  expect(__sbHexOrBytes("")).toBe(__sbToBytes(""));
+  expect(bytesOf(__sbHexOrBytes(new Uint8Array([0x80, 0x01])))).toEqual([0x80, 0x01]);
+});
+
+test("a long hex string decodes byte for byte", () => {
+  const bytes = new Uint8Array(20000);
+  for (let i = 0; i < bytes.length; i++) bytes[i] = (i * 37 + 0x80) & 0xff;
+  const hex = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+  expect(bytesOf(__sbHexOrBytes(hex))).toEqual([...bytes]);
+});

package/src/transport-embedded.js

@@ -1191,13 +1191,13 @@ function __sbEnsureSchema() {
 }
 
 function __sbHex(n) {
-  let out = "";
+  const out = [];
   const bytes = __sbRandomBytes(String(n));
   for (let i = 0; i < bytes.length; i++) {
     const h = bytes.charCodeAt(i).toString(16);
-    out += h.length === 1 ? "0" + h : h;
+    out.push(h.length === 1 ? "0" + h : h);
   }
-  return out;
+  return out.join("");
 }
 
 function __sbEmbeddedDispatch(msg) {
@@ -1279,14 +1279,15 @@ function __sbEmbeddedDispatch(msg) {
     if (!tls && url.protocol !== "http:") throw new Error("unsupported protocol: " + url.protocol);
     const allow = bindingsOutbound();
     if (allow.indexOf(url.host) === -1) throw new Error("host not in outbound allowlist: " + url.host);
-    let headerText = "";
+    const headerParts = [];
     const pairs = msg.headers || [];
     for (let i = 0; i < pairs.length; i++) {
       const key = String(pairs[i][0]).toLowerCase();
       // Host, Connection and Content-Length are ours to set.
       if (key === "host" || key === "connection" || key === "content-length") continue;
-      headerText += pairs[i][0] + ": " + pairs[i][1] + "\r\n";
+      headerParts.push(pairs[i][0] + ": " + pairs[i][1] + "\r\n");
     }
+    const headerText = headerParts.join("");
     const port = url.port ? url.port : tls ? "443" : "80";
     const reply = JSON.parse(
       __sbHttpRaw(