@swf2es/desktop 0.0.0-stage → 0.1.15

package/src/main/protocol.ts

@@ -0,0 +1,237 @@
+// swf2es://, the one scheme the window loads anything from. swf2es://app/
+// is the page, its modules and the libraries; swf2es://file/ is the local
+// files the SWF playing may read, by its sandbox (sandbox.ts). They are
+// two origins, so a SWF's files never share the page's, and the file host
+// answers the page's fetches with CORS headers naming it.
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { readFile, stat } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname, extname, join, normalize, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { protocol, type Session } from "electron";
+import type { LibraryState } from "../shared/api.js";
+import { FILE_ORIGIN, type Sandbox } from "./sandbox.ts";
+
+const SCHEME = "swf2es";
+export const APP_ORIGIN = `${SCHEME}://app`;
+
+const appRoot = fileURLToPath(new URL("../../", import.meta.url));
+
+/**
+ * Before the app is ready: a standard, secure scheme, which fetch, CORS and storage treat as https.
+ */
+export function registerScheme(): void {
+  protocol.registerSchemesAsPrivileged([
+    {
+      scheme: SCHEME,
+      privileges: {
+        standard: true,
+        secure: true,
+        supportFetchAPI: true,
+        corsEnabled: true,
+        codeCache: true,
+      },
+    },
+  ]);
+}
+
+/** The directory a package's `specifier` resolves into, from `from`, and the package's root. */
+function packageRoot(specifier: string, from: string): string {
+  const name = specifier.startsWith("@")
+    ? specifier.split("/").slice(0, 2).join("/")
+    : specifier.split("/")[0];
+  let dir = dirname(createRequire(from).resolve(specifier));
+  for (;;) {
+    try {
+      if (JSON.parse(readFileSync(join(dir, "package.json"), "utf8")).name === name) {
+        return dir;
+      }
+    } catch {
+      // No package.json here; look further up.
+    }
+
+    const parent = dirname(dir);
+    if (parent === dir) {
+      throw new Error(`no package root for ${specifier}`);
+    }
+
+    dir = parent;
+  }
+}
+
+/**
+ * What /modules/<name>/ serves: the packages' builds and their libraries, as static/index.html's
+ * import map names them.
+ */
+function moduleMounts(): Map<string, string> {
+  const here = join(appRoot, "package.json");
+  const dist = (specifier: string, from = here) => join(packageRoot(specifier, from), "dist");
+  const player = join(dist("@swf2es/player"), "index.js");
+  const format = join(dist("@swf2es/format"), "index.js");
+  return new Map([
+    ["native", dist("@swf2es/native/compress", format)],
+    ["format", dist("@swf2es/format")],
+    ["context3d", dist("@swf2es/context3d/webgl")],
+    ["codegen", dist("@swf2es/codegen")],
+    ["runtime", dist("@swf2es/runtime", player)],
+    ["render", dist("@swf2es/render", player)],
+    ["player", dist("@swf2es/player")],
+    ["player-hosts", dist("@swf2es/player-hosts/indexeddb")],
+    ["web", dist("@swf2es/web")],
+  ]);
+}
+
+const TYPES: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".json": "application/json",
+  ".map": "application/json",
+  ".wasm": "application/wasm",
+  ".swf": "application/x-shockwave-flash",
+};
+
+const typeOf = (path: string) => TYPES[extname(path).toLowerCase()] ?? "application/octet-stream";
+
+/**
+ * The page's Content-Security-Policy. 'unsafe-eval' is the player's: it
+ * evaluates the modules it compiles with `new Function`; codegen is
+ * WebAssembly; the import map is allowed by its hash and no other inline
+ * script runs. The page reaches its own files and the SWF's, never the
+ * network: a SWF's http and https loads go through the main process
+ * (network.ts). Nothing is framed, embedded or posted to the page.
+ */
+function contentSecurityPolicy(page: string): string {
+  const map = /<script type="importmap">([\s\S]*?)<\/script>/.exec(page)?.[1];
+  const hash = map === undefined ? "" : createHash("sha256").update(map).digest("base64");
+  return [
+    "default-src 'none'",
+    // A page without the player's import map, the URL dialog, runs only its own scripts.
+    map === undefined
+      ? "script-src 'self'"
+      : `script-src 'self' 'unsafe-eval' 'wasm-unsafe-eval' 'sha256-${hash}'`,
+    // The element's shadow root has <style>s of its own.
+    "style-src 'self' 'unsafe-inline'",
+    `img-src 'self' ${FILE_ORIGIN} data: blob:`,
+    `media-src 'self' ${FILE_ORIGIN} data: blob:`,
+    `font-src 'self' data:`,
+    `connect-src 'self' ${FILE_ORIGIN} data: blob:`,
+    "base-uri 'none'",
+    "form-action https:",
+    "frame-ancestors 'none'",
+  ].join("; ");
+}
+
+const notFound = () => new Response(null, { status: 404 });
+
+/**
+ * What makes the app's pages cross-origin isolated, as a shareable
+ * ByteArray's shared memory needs (docs/workers.md), on the app's own
+ * responses, its workers' scripts among them. The page loads only the
+ * app's files and the SWF's, which the file host serves with CORS, and a
+ * SWF's network loads go through the main process, so it costs nothing.
+ */
+const ISOLATION = {
+  "cross-origin-opener-policy": "same-origin",
+  "cross-origin-embedder-policy": "credentialless",
+};
+
+/**
+ * Serve swf2es:// in `session`: the app, its modules, the libraries `libraries` finds, and what
+ * `sandbox` lets the SWF read.
+ */
+export function serve(session: Session, sandbox: Sandbox, libraries: () => LibraryState): void {
+  const mounts = moduleMounts();
+  const staticDir = join(appRoot, "static");
+  const rendererDir = join(appRoot, "dist", "renderer");
+
+  /** `path` under `dir`, or null if it would leave it. */
+  const under = (dir: string, path: string): string | null => {
+    const file = normalize(join(dir, path));
+    return file.startsWith(dir + sep) ? file : null;
+  };
+
+  const app = async (path: string): Promise<Response> => {
+    // Each page with its policy: the player's and the URL dialog.
+    const pageName = path === "/" ? "index.html" : /^\/([a-z-]+\.html)$/.exec(path)?.[1];
+    if (pageName) {
+      let page: string;
+      try {
+        page = await readFile(join(staticDir, pageName), "utf8");
+      } catch {
+        return notFound();
+      }
+
+      return new Response(page, {
+        headers: {
+          "content-type": TYPES[".html"],
+          "content-security-policy": contentSecurityPolicy(page),
+          ...ISOLATION,
+        },
+      });
+    }
+
+    const [, top, ...rest] = path.split("/");
+    let file: string | null = null;
+    switch (top) {
+      case "renderer":
+        file = under(rendererDir, rest.join("/"));
+        break;
+      case "modules": {
+        const dir = mounts.get(rest[0]);
+        file = dir ? under(dir, rest.slice(1).join("/")) : null;
+        break;
+      }
+      case "libraries": {
+        file = rest.join("/") === "playerglobal.abc" ? libraries().playerglobal : null;
+        break;
+      }
+      default:
+        file = under(staticDir, path.slice(1));
+    }
+
+    return file ? fileResponse(file, ISOLATION) : notFound();
+  };
+
+  session.protocol.handle(SCHEME, async (request) => {
+    const url = new URL(request.url);
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      return new Response(null, { status: 405 });
+    }
+
+    let path: string;
+    try {
+      path = decodeURIComponent(url.pathname);
+    } catch {
+      // Malformed %-escapes name no file.
+      return new Response(null, { status: 400 });
+    }
+
+    if (url.host === "app") {
+      return app(path);
+    }
+
+    if (url.host === "file") {
+      const file = await sandbox.resolve(path);
+      return file ? fileResponse(file, { "access-control-allow-origin": APP_ORIGIN }) : notFound();
+    }
+
+    return notFound();
+  });
+}
+
+async function fileResponse(file: string, headers: Record<string, string>): Promise<Response> {
+  try {
+    if (!(await stat(file)).isFile()) {
+      return notFound();
+    }
+
+    return new Response(await readFile(file), {
+      headers: { "content-type": typeOf(file), ...headers },
+    });
+  } catch {
+    return notFound();
+  }
+}

package/src/main/sandbox.ts

@@ -0,0 +1,213 @@
+// The sandbox of the SWF playing, as Flash Player chose one for a local
+// SWF by FileAttributes' UseNetwork bit: local-with-filesystem reads the
+// files in the SWF's own directory and below, and reaches no network;
+// local-with-networking reaches the network, and no local file but
+// itself. A SWF opened by its URL is remote: no local file at all, and
+// the network as its origin's (network.ts judges it). An AIR application
+// opened by its descriptor plays in AIR's application sandbox: any local
+// file, through File and its URLs, and the network as an application's,
+// unjudged. Only the SWF playing now has a grant: opening another, or
+// closing it, revokes it.
+// What the SWF loads plays in its sandbox too.
+// Apart from Electron, so that node tests it (tests/desktop/sandbox.test.ts).
+import { createHash } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { realpath } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join, parse, relative, sep } from "node:path";
+
+export const FILE_ORIGIN = "swf2es://file";
+
+export type SandboxType = "localWithFile" | "localWithNetwork" | "remote" | "application";
+
+interface Grant {
+  /** The SWF's real path, links followed; a remote SWF's URL. */
+  swf: string;
+  /** The directory it may read under, or null for none: its own file alone. */
+  root: string | null;
+  /** The URL's first segment, standing for the SWF's directory; null for a remote SWF. */
+  token: string | null;
+  type: SandboxType;
+}
+
+/**
+ * The OS's realpath, links followed, as both the grant and a request use it; null for no such file.
+ */
+async function real(path: string): Promise<string | null> {
+  try {
+    return await realpath(path);
+  } catch {
+    return null;
+  }
+}
+
+/** Whether `path` lies under `root`, not `root` itself. */
+function inside(root: string, path: string): boolean {
+  const rest = relative(root, path);
+  return rest !== "" && rest !== ".." && !rest.startsWith(`..${sep}`) && !isAbsolute(rest);
+}
+
+export class Sandbox {
+  private grant: Grant | null = null;
+  /**
+   * The grant of a SWF opened but not yet asked for. It takes effect as the
+   * page fetches the SWF, which it does once it has let the last SWF go,
+   * so that one never runs, for a frame, in the next one's sandbox.
+   */
+  private pending: Grant | null = null;
+  /** Directories never granted whole. */
+  private readonly shared: Set<string>;
+
+  /**
+   * `home` is the user's directory, never granted whole, nor the one that
+   * holds every user's (/home, /Users, C:\\Users), nor a temporary one
+   * every program shares: a SWF in any of them reads only itself.
+   */
+  constructor(home = homedir()) {
+    const resolve = (path: string) => {
+      try {
+        return realpathSync.native(path);
+      } catch {
+        // No such directory: compared as given.
+        return path;
+      }
+    };
+    // Each as given and as it really is: a SWF's directory is compared real,
+    // and /tmp is /private/tmp on macOS, a home may be a link.
+    const shared = [home, dirname(home), tmpdir(), "/tmp", "/var/tmp"];
+    this.shared = new Set([...shared, ...shared.map(resolve), dirname(resolve(home))]);
+  }
+
+  /** The sandbox of the SWF playing; null when none plays. */
+  get type(): SandboxType | null {
+    return this.grant?.type ?? null;
+  }
+
+  /** The real path of the SWF playing, or opened to play next, or its URL; null when none. */
+  get swf(): string | null {
+    return (this.pending ?? this.grant)?.swf ?? null;
+  }
+
+  /**
+   * Grant `swf` its sandbox, in place of the last SWF's, and give the URL
+   * the page plays it from. The URL names the SWF's directory by a token,
+   * not its path, so neither loaderInfo.url nor anything the SWF sends
+   * tells where on the disk it is, or whose disk; the token, a hash of the
+   * path, stays the same from run to run for the SWF's SharedObjects.
+   * The shared directories (the constructor's) and a file system's root
+   * are never granted whole: a SWF there reads only itself.
+   */
+  play(swf: string, network: boolean): string {
+    const path = realpathSync.native(swf);
+    const directory = dirname(path);
+    const whole = this.shared.has(directory) || directory === parse(directory).root;
+    const token = createHash("sha256").update(directory).digest("hex").slice(0, 16);
+    this.grant = null;
+    this.pending = {
+      swf: path,
+      root: network || whole ? null : directory,
+      token,
+      type: network ? "localWithNetwork" : "localWithFile",
+    };
+    return `${FILE_ORIGIN}/${token}/${encodeURIComponent(basename(path))}`;
+  }
+
+  /**
+   * Grant the remote SWF at `url` its sandbox, in place of the last SWF's:
+   * no local file, and the network as network.ts judges it. It takes
+   * effect as the page asks for that URL (startRemote).
+   */
+  playRemote(url: string): void {
+    this.grant = null;
+    this.pending = { swf: url, root: null, token: null, type: "remote" };
+  }
+
+  /**
+   * The page asks for the remote SWF at `url`: whether that is the one
+   * opened, whose grant then takes effect, or the one playing.
+   */
+  startRemote(url: string): boolean {
+    const pending = this.pending;
+    if (pending?.type === "remote" && pending.swf === url) {
+      this.grant = pending;
+      this.pending = null;
+      return true;
+    }
+
+    return this.grant?.type === "remote" && this.grant.swf === url && this.pending === null;
+  }
+
+  /**
+   * Grant the AIR application whose content SWF is at `content` its
+   * sandbox, in place of the last SWF's. It takes effect as the page reads
+   * that file (startApplication).
+   */
+  playApplication(content: string): void {
+    this.grant = null;
+    this.pending = { swf: content, root: null, token: null, type: "application" };
+  }
+
+  /**
+   * The page reads the local file at `path`: whether an AIR application
+   * plays that may, its grant taking effect as the page reads its content SWF.
+   */
+  startApplication(path: string): boolean {
+    const pending = this.pending;
+    if (pending?.type === "application" && pending.swf === path) {
+      this.grant = pending;
+      this.pending = null;
+      return true;
+    }
+
+    return this.application;
+  }
+
+  /** Whether an AIR application plays, whose File reads the file system. */
+  get application(): boolean {
+    return this.grant?.type === "application" && this.pending === null;
+  }
+
+  /** Nothing plays: every grant revoked. */
+  stop(): void {
+    this.grant = null;
+    this.pending = null;
+  }
+
+  /** Whether the SWF playing may reach the network: in local-with-networking, remote, or an AIR application. */
+  networkAllowed(): boolean {
+    const type = this.grant?.type;
+    return type === "localWithNetwork" || type === "remote" || type === "application";
+  }
+
+  /**
+   * The local file a swf2es://file URL names, if the SWF playing may read it; its path, decoded, is
+   * `pathname`.
+   */
+  async resolve(pathname: string): Promise<string | null> {
+    const [empty, token, ...rest] = pathname.split("/");
+    const pending = this.pending;
+    if (pending?.token && empty === "" && token === pending.token && rest.length > 0) {
+      const path = await real(join(dirname(pending.swf), ...rest));
+      if (path === pending.swf && this.pending === pending) {
+        this.grant = pending;
+        this.pending = null;
+      }
+    }
+
+    const grant = this.grant;
+    if (!grant?.token || empty !== "" || token !== grant.token || rest.length === 0) {
+      return null;
+    }
+
+    const path = await real(join(dirname(grant.swf), ...rest));
+    if (path === null || this.grant !== grant) {
+      return null;
+    }
+
+    if (path === grant.swf) {
+      return path;
+    }
+
+    return grant.root !== null && inside(grant.root, path) ? path : null;
+  }
+}

package/src/main/settings.ts

@@ -0,0 +1,117 @@
+// What the app remembers between runs, in settings.json under its user
+// data: a playerglobal.abc the user chose, and the SWFs opened last.
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import type { LibraryName, LibraryState } from "../shared/api.js";
+
+export interface Settings {
+  stage3D: boolean;
+  playerglobal?: string;
+  /** Most recent first. */
+  recent: string[];
+  /**
+   * The servers, "host:port", each SWF, by its real path, is always allowed to connect a socket to.
+   */
+  sockets: Record<string, string[]>;
+}
+
+const RECENT = 10;
+
+const strings = (value: unknown): string[] =>
+  Array.isArray(value) ? value.filter((v): v is string => typeof v === "string") : [];
+
+export class SettingsFile {
+  private readonly path: string;
+  private current: Settings;
+
+  constructor(directory: string) {
+    this.path = join(directory, "settings.json");
+    this.current = this.read();
+  }
+
+  get settings(): Readonly<Settings> {
+    return this.current;
+  }
+
+  /** The playerglobal.abc the user chose, where it still is; builtin.abc ships with the player. */
+  libraries(): LibraryState {
+    return { playerglobal: this.found(this.current.playerglobal) };
+  }
+
+  /** Whether it was saved; it holds for this run either way. */
+  setLibrary(name: LibraryName, path: string): boolean {
+    return this.update({ [name]: path });
+  }
+
+  setStage3D(enabled: boolean): boolean {
+    return this.update({ stage3D: enabled });
+  }
+
+  /** `path` opened: first in the recent list. */
+  opened(path: string): void {
+    this.update({
+      recent: [path, ...this.current.recent.filter((p) => p !== path)].slice(0, RECENT),
+    });
+  }
+
+  /** Whether `swf` is always allowed a socket to `endpoint`, "host:port". */
+  socketAllowed(swf: string, endpoint: string): boolean {
+    return Object.hasOwn(this.current.sockets, swf) && this.current.sockets[swf].includes(endpoint);
+  }
+
+  /** Allow `swf` a socket to `endpoint` from now on: whether that was saved. */
+  allowSocket(swf: string, endpoint: string): boolean {
+    const allowed = Object.hasOwn(this.current.sockets, swf) ? this.current.sockets[swf] : [];
+    return this.update({ sockets: { ...this.current.sockets, [swf]: [...allowed, endpoint] } });
+  }
+
+  clearRecent(): void {
+    this.update({ recent: [] });
+  }
+
+  private found(path: string | undefined): string | null {
+    return path && existsSync(path) ? path : null;
+  }
+
+  private read(): Settings {
+    try {
+      const read = JSON.parse(readFileSync(this.path, "utf8"));
+      const text = (value: unknown) => (typeof value === "string" ? value : undefined);
+      return {
+        stage3D: read.stage3D === true,
+        playerglobal: text(read.playerglobal),
+        recent: strings(read.recent),
+        sockets: Object.fromEntries(
+          Object.entries(
+            typeof read.sockets === "object" && read.sockets !== null ? read.sockets : {},
+          ).map(([swf, endpoints]) => [swf, strings(endpoints)]),
+        ),
+      };
+    } catch {
+      // None yet, or unreadable: start again rather than refuse to start.
+      return { stage3D: false, recent: [], sockets: {} };
+    }
+  }
+
+  /**
+   * Apply `change`, and write the settings: whether they were written. A
+   * user data directory that cannot be written keeps them for this run.
+   */
+  private update(change: Partial<Settings>): boolean {
+    this.current = { ...this.current, ...change };
+    // Written whole and renamed into place, so a crash never leaves half a
+    // file, under a name no other write shares.
+    const temporary = `${this.path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+      mkdirSync(dirname(this.path), { recursive: true });
+      writeFileSync(temporary, `${JSON.stringify(this.current, null, 2)}\n`);
+      renameSync(temporary, this.path);
+      return true;
+    } catch (error) {
+      console.error(`swf2es: settings not saved to ${this.path}: ${error}`);
+      rmSync(temporary, { force: true });
+      return false;
+    }
+  }
+}

package/src/main/sockets.ts

@@ -0,0 +1,81 @@
+// flash.net.Socket's TCP connections, made here for the page, which has
+// no network of its own beyond fetch, and carried over IPC. Each page's
+// connections (connections.ts) close as it navigates, reloads or goes.
+import { type IpcMainEvent, ipcMain, type WebContents } from "electron";
+import { Connections, validEndpoint } from "./connections.ts";
+
+/**
+ * Carry socket messages from pages that `trusted` accepts, each connection
+ * made only as `permit` allows it, to the address it gives where it gives
+ * one; null refuses it.
+ */
+export function bridgeSockets(
+  trusted: (event: IpcMainEvent) => boolean,
+  permit: (host: string, port: number) => Promise<{ address?: string } | null>,
+): void {
+  const pages = new Map<WebContents, Connections>();
+
+  const connectionsOf = (contents: WebContents): Connections => {
+    const known = pages.get(contents);
+    if (known) {
+      return known;
+    }
+
+    const connections = new Connections((id, event) => {
+      if (!contents.isDestroyed()) {
+        contents.send("socket:event", id, event);
+      }
+    });
+    pages.set(contents, connections);
+    contents.on("did-start-navigation", (details) => {
+      if (details.isMainFrame && !details.isSameDocument) {
+        connections.closeAll();
+      }
+    });
+    contents.once("destroyed", () => {
+      connections.closeAll();
+      pages.delete(contents);
+    });
+    return connections;
+  };
+
+  ipcMain.on("socket:connect", (event, id: unknown, host: unknown, port: unknown) => {
+    if (!trusted(event) || typeof id !== "number") {
+      return;
+    }
+
+    const connections = connectionsOf(event.sender);
+    if (!validEndpoint(host, port)) {
+      connections.refuse(id);
+      return;
+    }
+
+    const generation = connections.generation;
+    void permit(host, port as number)
+      .catch(() => null)
+      .then((allowed) => {
+        // The page that asked may have gone while the user was asked.
+        if (connections.generation !== generation) {
+          return;
+        }
+
+        if (allowed) {
+          connections.connect(id, host, port, allowed.address);
+        } else {
+          connections.refuse(id);
+        }
+      });
+  });
+
+  ipcMain.on("socket:send", (event, id: unknown, bytes: unknown) => {
+    if (trusted(event) && typeof id === "number" && bytes instanceof Uint8Array) {
+      pages.get(event.sender)?.send(id, bytes);
+    }
+  });
+
+  ipcMain.on("socket:close", (event, id: unknown) => {
+    if (trusted(event) && typeof id === "number") {
+      pages.get(event.sender)?.close(id);
+    }
+  });
+}

package/src/main/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": ".",
+    "outDir": "../../dist/main",
+    "tsBuildInfoFile": "../../dist/main/.tsbuildinfo",
+    "types": ["node"],
+    // Its modules import each other by their .ts names, so that node runs
+    // them as they are in the tests, and the build writes .js.
+    "rewriteRelativeImportExtensions": true,
+    "lib": ["ES2022"]
+  },
+  "include": ["*.ts"],
+  "references": [{ "path": "../shared" }, { "path": "../../../../packages/format" }]
+}