@swf2es/desktop 0.0.0-stage → 0.1.15

package/dist/main/network.js

@@ -0,0 +1,909 @@
+// The network a SWF reaches through the desktop app: every http and https
+// request it makes, sent by the main process rather than the page, and
+// judged as Flash Player judged it, by its sandbox and the policy files
+// of the sites it reaches, not by CORS; and the socket policies a remote
+// SWF's sockets need. So a SWF reaches http: and servers that never heard
+// of CORS, as it did in Flash, and nothing it should not.
+//
+// - A remote SWF's own origin is open to it. Another origin's data it
+//   reads as that origin's policy files grant its domain; content (a
+//   Loader's, a Sound's) and what sendToURL sends go anywhere. A
+//   local-with-networking SWF has no domain: only a policy granting "*"
+//   lets it read data.
+// - Nothing is sent with the user's credentials: no cookies, no
+//   authentication, no client certificate. So all a SWF gains by asking
+//   from here rather than its own server is this machine's place on the
+//   network, and that is the one thing guarded beyond Flash's rules:
+//   a request to an address more private than the SWF's own (addresses.ts)
+//   needs a policy from that address granting it, whatever its purpose,
+//   same origin or not. Each request resolves its host once and connects
+//   to that address, its policy file fetched from the same one, so DNS
+//   that changes its answer (rebinding) changes nothing.
+// - Requests are bounded: methods, headers, sizes, redirects, time, and
+//   how many run at once; and each movie's are aborted as the next opens.
+//
+// Without Electron, so that node tests it (tests/desktop/network.test.ts).
+import { lookup } from "node:dns/promises";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { connect, isIP, isIPv4 } from "node:net";
+import * as tls from "node:tls";
+import { addressClass, badPort, RANK } from "./addresses.js";
+import { DECODED, Decompressor } from "./decompress.js";
+import { allowsAccess, allowsHeaders, allowsSocket, forbiddenHeader, parsePolicy, policyContentType, socketMetaPolicy, urlMetaPolicy, usablePolicies, } from "./policy.js";
+/** A request refused, with why, for the terminal; the SWF sees a failed load. */
+export class Refused extends Error {
+}
+const LIMITS = {
+    url: 64 * 1024,
+    headers: 32,
+    headerBytes: 8 * 1024,
+    body: 32 * 1024 * 1024,
+    response: 128 * 1024 * 1024,
+    policy: 1024 * 1024,
+    redirects: 10,
+    timeout: 30_000,
+    deadline: 300_000,
+    policyTimeout: 10_000,
+    masterSocketTimeout: 3_000,
+    buffered: 256 * 1024 * 1024,
+    concurrent: 16,
+    queue: 1024,
+    policyFiles: 64,
+};
+/** What Flash Player 32 reported, sent as it sent it. */
+const FLASH_VERSION = "32,0,0,465";
+const USER_AGENT = "Mozilla/5.0 (compatible; swf2es) Shockwave Flash";
+const REDIRECTS = new Set([301, 302, 303, 307, 308]);
+const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+/** The system's trusted roots beside Node's, where this Node can tell them. */
+function defaultCa() {
+    const get = tls.getCACertificates;
+    if (typeof get !== "function") {
+        return undefined;
+    }
+    try {
+        return [...new Set([...get("default"), ...get("system")])];
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The hosts --ignore-certificate-errors names, of the app's arguments up to
+ * an AIR application's own after "--": null without the switch; with it
+ * alone, every host; with `=a.test,b.test`, those, whatever their case.
+ * A host is a name or an address, with no port: every port of it.
+ */
+export function unverifiedHosts(argv) {
+    const end = argv.indexOf("--");
+    const own = end < 0 ? argv : argv.slice(0, end);
+    let named = false;
+    let all = false;
+    const hosts = [];
+    for (const arg of own) {
+        if (arg === "--ignore-certificate-errors") {
+            named = true;
+            all = true;
+        }
+        else if (arg.startsWith("--ignore-certificate-errors=")) {
+            // The switch with nothing named ignores nothing, rather than everything by a slip.
+            named = true;
+            for (const host of arg.slice(arg.indexOf("=") + 1).split(",")) {
+                if (host.trim() !== "") {
+                    hosts.push(host.trim().toLowerCase());
+                }
+            }
+        }
+    }
+    return named ? { all, hosts } : null;
+}
+export class Network {
+    limits;
+    resolveHost;
+    classify;
+    ca;
+    unverified;
+    socketPolicyPort;
+    session = null;
+    running = 0;
+    waiting = [];
+    constructor(options = {}) {
+        this.limits = { ...LIMITS, ...options.limits };
+        this.resolveHost =
+            options.resolve ??
+                (async (host) => (await lookup(host, { all: true, verbatim: true })).map(({ address }) => address));
+        this.classify = options.classify ?? addressClass;
+        this.ca = options.ca ?? defaultCa();
+        this.unverified = options.unverified ?? (() => false);
+        this.socketPolicyPort = options.socketPolicyPort ?? 843;
+    }
+    /**
+     * Judge requests for `movie` from now on, or for none: what the last
+     * movie had under way is aborted, and its policy files forgotten.
+     */
+    play(movie) {
+        this.session?.abort.abort();
+        this.session = movie
+            ? {
+                movie,
+                origin: null,
+                abort: new AbortController(),
+                policies: new Map(),
+                socketPolicies: new Map(),
+                urlPolicyFiles: [],
+                socketPolicyFiles: [],
+                buffered: 0,
+            }
+            : null;
+    }
+    /** The movie's URL after its redirects, once it has come; null before, and for a local movie. */
+    get origin() {
+        return this.session?.origin?.url.href ?? null;
+    }
+    /**
+     * A policy file the movie named with Security.loadPolicyFile: an http(s)
+     * URL, or "xmlsocket://host:port" for a socket policy. It is fetched
+     * only when a request needs it.
+     */
+    addPolicyFile(text) {
+        const session = this.session;
+        if (!session ||
+            typeof text !== "string" ||
+            text.length > this.limits.url ||
+            session.urlPolicyFiles.length + session.socketPolicyFiles.length >= this.limits.policyFiles) {
+            return;
+        }
+        let url;
+        try {
+            url = new URL(text);
+        }
+        catch {
+            return;
+        }
+        if (url.protocol === "xmlsocket:") {
+            const port = Number(url.port);
+            if (url.hostname && Number.isInteger(port) && port > 0) {
+                // Lower case by hand: the URL standard keeps an unknown scheme's host as written.
+                session.socketPolicyFiles.push({ host: bare(url.hostname).toLowerCase(), port });
+            }
+        }
+        else if ((url.protocol === "http:" || url.protocol === "https:") &&
+            !url.username &&
+            !url.password &&
+            !session.urlPolicyFiles.some((u) => u.href === url.href)) {
+            url.hash = "";
+            session.urlPolicyFiles.push(url);
+        }
+    }
+    /**
+     * Send what the page asks, `request` as it came over IPC, checked here,
+     * if the movie may; `signal` aborts it. Refused, it throws a Refused
+     * saying why. `deliver` is handed the response while its bytes still
+     * count against the movie's budget, for a caller that copies them away
+     * (over IPC) before they are given back.
+     */
+    async fetch(request, signal, deliver) {
+        const session = this.session;
+        if (!session) {
+            throw new Refused("no SWF plays");
+        }
+        const checked = this.check(request);
+        const aborted = AbortSignal.any([signal, session.abort.signal]);
+        await this.turn(aborted);
+        // All told, from its turn: its redirects and the policy files it waits on included.
+        const deadline = AbortSignal.timeout(this.limits.deadline);
+        const bounded = AbortSignal.any([aborted, deadline]);
+        const budget = { session, taken: 0 };
+        try {
+            const response = checked.purpose === "movie"
+                ? await this.fetchMovie(session, checked, bounded, budget)
+                : await this.fetchFor(session, checked, bounded, budget);
+            deliver?.(response);
+            return response;
+        }
+        catch (error) {
+            throw deadline.aborted && !aborted.aborted ? new Refused("it took too long") : error;
+        }
+        finally {
+            session.buffered -= budget.taken;
+            this.done();
+        }
+    }
+    /**
+     * The address the movie's socket to `host`:`port` connects to, once its
+     * socket policy allows it, as Flash Player 9.0.124 and later asked of
+     * every socket a remote SWF opened, its own server's included: the
+     * master policy on port 843, then, as its meta-policy allows, those
+     * Security.loadPolicyFile named and the one on the port itself. Each
+     * fetched from the address the socket then connects to.
+     */
+    async socketAddress(host, port) {
+        const session = this.session;
+        const origin = session?.origin;
+        if (!session || !origin) {
+            throw new Refused("the SWF has not loaded");
+        }
+        // All told, its DNS and the policies of every port it tries included,
+        // each of which it stops waiting on when time is up.
+        const deadline = AbortSignal.timeout(this.limits.deadline);
+        try {
+            return await this.socketPolicyAddress(session, origin, host, port, deadline);
+        }
+        catch (error) {
+            throw deadline.aborted ? new Refused("it took too long") : error;
+        }
+    }
+    async socketPolicyAddress(session, origin, host, port, deadline) {
+        const target = await this.pin(host, deadline);
+        const policy = (at, timeout) => abortable(cached(session.socketPolicies, `${target.address}|${at}`, () => this.socketPolicy(target.address, at, timeout, session.abort.signal)), deadline);
+        const master = await policy(this.socketPolicyPort, this.limits.masterSocketTimeout);
+        if (allowsSocket(master, [], origin.requester, port)) {
+            return target.address;
+        }
+        if (socketMetaPolicy(master) === "all") {
+            const ports = [
+                ...session.socketPolicyFiles
+                    .filter((f) => f.host === bare(host).toLowerCase())
+                    .map((f) => f.port),
+                port,
+            ];
+            for (const at of new Set(ports)) {
+                if (at === this.socketPolicyPort) {
+                    continue;
+                }
+                const other = await policy(at, this.limits.policyTimeout);
+                if (other && allowsSocket(master, [other], origin.requester, port)) {
+                    return target.address;
+                }
+            }
+        }
+        throw new Refused(`no socket policy on ${host} grants ${describe(origin.requester)}`);
+    }
+    /** `request` checked and made plain: only what Flash Player let a SWF send. */
+    check(request) {
+        const r = request;
+        if (typeof r !== "object" || r === null || typeof r.url !== "string") {
+            throw new Refused("not a request");
+        }
+        if (r.url.length > this.limits.url) {
+            throw new Refused("its URL is too long");
+        }
+        let target;
+        try {
+            target = new URL(r.url);
+        }
+        catch {
+            throw new Refused("not a URL");
+        }
+        if (target.protocol !== "http:" && target.protocol !== "https:") {
+            throw new Refused(`no ${target.protocol} URL is fetched for a SWF`);
+        }
+        if (target.username || target.password) {
+            throw new Refused("a URL with credentials");
+        }
+        target.hash = "";
+        const purpose = r.purpose;
+        if (purpose !== "movie" && purpose !== "content" && purpose !== "data" && purpose !== "send") {
+            throw new Refused("no purpose");
+        }
+        // Flash Player outside AIR sent GET and POST only.
+        const method = typeof r.method === "string" ? r.method.toUpperCase() : "";
+        if (method !== "GET" && method !== "POST") {
+            throw new Refused(`no ${String(r.method)} request is sent for a SWF`);
+        }
+        const body = method === "POST" && r.body instanceof Uint8Array ? r.body : null;
+        if (body && body.length > this.limits.body) {
+            throw new Refused("its body is too large");
+        }
+        const headers = [];
+        let bytes = 0;
+        if (!Array.isArray(r.headers) || r.headers.length > this.limits.headers) {
+            throw new Refused("too many headers");
+        }
+        for (const header of r.headers) {
+            if (!Array.isArray(header) || header.length !== 2) {
+                throw new Refused("not a header");
+            }
+            const [name, value] = header;
+            if (typeof name !== "string" || typeof value !== "string" || !TOKEN.test(name)) {
+                throw new Refused("not a header");
+            }
+            // No control characters, line breaks among them, which would start a header of
+            // their own, and nothing HTTP's Latin-1 does not hold: what Node would throw for.
+            if (/[^\t\x20-\x7e\x80-\xff]/.test(value)) {
+                throw new Refused(`the header ${name} has a character no header may hold`);
+            }
+            if (forbiddenHeader(name)) {
+                throw new Refused(`a SWF may not send the header ${name}`);
+            }
+            bytes += name.length + value.length;
+            headers.push([name, value]);
+        }
+        if (bytes > this.limits.headerBytes) {
+            throw new Refused("its headers are too long");
+        }
+        return { url: target.href, target, method, headers, body, purpose };
+    }
+    /** Wait for a turn among the requests under way: at most `concurrent` at once. */
+    async turn(signal) {
+        if (this.running < this.limits.concurrent) {
+            this.running++;
+            return;
+        }
+        if (this.waiting.length >= this.limits.queue) {
+            throw new Refused("too many requests at once");
+        }
+        await new Promise((go, fail) => {
+            const start = () => {
+                signal.removeEventListener("abort", stop);
+                go();
+            };
+            const stop = () => {
+                const at = this.waiting.indexOf(start);
+                if (at >= 0) {
+                    this.waiting.splice(at, 1);
+                }
+                fail(new Refused("aborted"));
+            };
+            if (signal.aborted) {
+                stop();
+                return;
+            }
+            signal.addEventListener("abort", stop, { once: true });
+            this.waiting.push(start);
+        });
+        this.running++;
+    }
+    done() {
+        this.running--;
+        this.waiting.shift()?.();
+    }
+    /** `host`'s address, its resolver's first, and how private; refused where none is reached. */
+    async pin(host, signal) {
+        const name = bare(host);
+        let address;
+        if (isIP(name)) {
+            address = name;
+        }
+        else {
+            let addresses;
+            try {
+                addresses = await (signal
+                    ? abortable(this.resolveHost(name), signal)
+                    : this.resolveHost(name));
+            }
+            catch {
+                throw new Refused(signal?.aborted ? "aborted" : `${name} has no address`);
+            }
+            if (addresses.length === 0) {
+                throw new Refused(`${name} has no address`);
+            }
+            address = addresses[0];
+        }
+        const place = this.classify(address);
+        if (place === null) {
+            throw new Refused(`${name} is at ${address}, which no request reaches`);
+        }
+        return { address, rank: RANK[place] };
+    }
+    /** The movie's SWF, from wherever the user asked; no redirect takes it somewhere more private. */
+    async fetchMovie(session, request, signal, budget) {
+        const movie = session.movie;
+        if (movie.kind !== "remote" || request.url !== new URL(movie.url).href) {
+            throw new Refused("not the SWF that was opened");
+        }
+        let url = request.target;
+        let first = null;
+        for (let hop = 0; hop <= this.limits.redirects; hop++) {
+            const target = await this.pin(url.hostname, signal);
+            checkPort(url);
+            first ??= target.rank;
+            if (target.rank > first) {
+                throw new Refused(`a redirect to ${url.href}, somewhere more private`);
+            }
+            const response = await this.send(url, target.address, "GET", [], null, signal, {
+                read: true,
+                max: this.limits.response,
+                referer: null,
+                budget,
+            });
+            const next = redirectOf(url, response);
+            if (next) {
+                url = next;
+                continue;
+            }
+            if (response.bytes) {
+                session.origin = {
+                    url,
+                    requester: { host: bare(url.hostname).toLowerCase(), scheme: url.protocol.slice(0, -1) },
+                    rank: target.rank,
+                };
+            }
+            return { ...response, ...(url.href === request.url ? {} : { url: url.href }) };
+        }
+        throw new Refused("too many redirects");
+    }
+    /** A request of the SWF's, each hop of its redirects judged as if asked for itself. */
+    async fetchFor(session, request, signal, budget) {
+        let requester;
+        let rank;
+        let origin;
+        const application = session.movie.kind === "application";
+        if (application) {
+            requester = { host: null, scheme: null };
+            // Nothing is more private than an application: it reaches its own machine too.
+            rank = Number.POSITIVE_INFINITY;
+            origin = null;
+        }
+        else if (session.movie.kind === "local") {
+            requester = { host: null, scheme: null };
+            // A local SWF stands for nothing on the network: it reaches no private address of itself.
+            rank = RANK.public;
+            origin = null;
+        }
+        else if (session.origin) {
+            ({ requester, rank } = session.origin);
+            origin = session.origin.url.origin;
+        }
+        else {
+            throw new Refused("the SWF has not loaded");
+        }
+        let { method, headers, body } = request;
+        let url = request.target;
+        for (let hop = 0; hop <= this.limits.redirects; hop++) {
+            checkPort(url);
+            const target = await this.pin(url.hostname, signal);
+            const same = origin === url.origin;
+            const morePrivate = target.rank > rank;
+            const custom = headers.map(([n]) => n).filter((n) => n.toLowerCase() !== "content-type");
+            const needsAccess = !application && (morePrivate || (!same && request.purpose === "data"));
+            const needsHeaders = !application && !same && custom.length > 0;
+            if (needsAccess || needsHeaders) {
+                const policies = await abortable(this.policiesFor(session, url, target.address), signal);
+                if (needsAccess && !allowsAccess(policies, requester, url)) {
+                    throw new Refused(morePrivate
+                        ? `${url.host} is at ${target.address}, more private than the SWF, ` +
+                            `and no policy file there grants ${describe(requester)}`
+                        : `no policy file on ${url.origin} grants ${describe(requester)}`);
+                }
+                if (needsHeaders && !allowsHeaders(policies, requester, url, custom)) {
+                    throw new Refused(`no policy file on ${url.origin} lets it send ${custom.join(", ")}`);
+                }
+            }
+            const response = await this.send(url, target.address, method, headers, body, signal, {
+                // sendToURL's answer is no one's to read.
+                read: request.purpose !== "send",
+                max: this.limits.response,
+                budget,
+                referer: refererFor(session.origin?.url ?? null, url),
+            });
+            const next = redirectOf(url, response);
+            if (!next) {
+                return { ...response, ...(url.href === request.url ? {} : { url: url.href }) };
+            }
+            // As browsers do: a 303, and a 301 or 302 after a POST, go on as a GET without the body.
+            if (response.status === 303 || (method === "POST" && response.status <= 302)) {
+                method = "GET";
+                body = null;
+                headers = [];
+            }
+            url = next;
+        }
+        throw new Refused("too many redirects");
+    }
+    /**
+     * The policy files of `url`'s site that count, fetched from `address`:
+     * its master policy file, and those the movie named under it as the
+     * master's meta-policy allows. Each is fetched once a movie and address,
+     * and aborted only with the movie, not with the request that first asked:
+     * the next finds it as it came.
+     */
+    async policiesFor(session, url, address) {
+        const get = (policyUrl) => cached(session.policies, `${policyUrl.href}|${address}`, () => this.urlPolicy(policyUrl, address, session.abort.signal));
+        const master = await get(new URL("/crossdomain.xml", url.origin));
+        const meta = urlMetaPolicy(master);
+        const others = [];
+        if (meta === "all" || meta === "by-content-type") {
+            for (const named of session.urlPolicyFiles) {
+                const directory = named.pathname.slice(0, named.pathname.lastIndexOf("/") + 1);
+                if (named.origin === url.origin &&
+                    named.pathname !== "/crossdomain.xml" &&
+                    url.pathname.startsWith(directory)) {
+                    const other = await get(named);
+                    if (other) {
+                        others.push(other);
+                    }
+                }
+            }
+        }
+        return usablePolicies(master, others);
+    }
+    /** A URL policy file, or null: missing, redirected, mistyped, refusing to be one, or none. */
+    async urlPolicy(url, address, signal) {
+        let response;
+        try {
+            response = await this.send(url, address, "GET", [], null, signal, {
+                read: true,
+                max: this.limits.policy,
+                referer: null,
+                timeout: this.limits.policyTimeout,
+                deadline: this.limits.policyTimeout,
+            });
+        }
+        catch {
+            return null;
+        }
+        // Redirects are not followed: the specification ignores one to another
+        // domain, and one within a site would move the file's scope.
+        if (response.status !== 200 || !response.bytes) {
+            return null;
+        }
+        const header = (name) => response.headers
+            .filter(([n]) => n.toLowerCase() === name)
+            .flatMap(([, v]) => v.split(","))
+            .map((v) => v.trim().toLowerCase())
+            .filter((v) => v !== "");
+        const contentType = (header("content-type")[0] ?? "").split(";")[0].trim();
+        const permitted = header("x-permitted-cross-domain-policies");
+        if (!policyContentType(contentType) || permitted.includes("none-this-response")) {
+            return null;
+        }
+        const policy = parsePolicy(new TextDecoder().decode(response.bytes));
+        return policy && { policy, url, contentType, permitted };
+    }
+    /**
+     * A socket policy: a connection to `address`:`port` that asks for one
+     * with <policy-file-request/> and its NUL, and reads the answer up to
+     * its NUL or its close; null where none comes in `timeout`.
+     */
+    socketPolicy(address, port, timeout, signal) {
+        return new Promise((answer) => {
+            const chunks = [];
+            let length = 0;
+            const socket = connect({ host: address, port });
+            const finish = (policy) => {
+                clearTimeout(timer);
+                signal.removeEventListener("abort", abort);
+                socket.destroy();
+                answer(policy);
+            };
+            const read = () => {
+                const text = Buffer.concat(chunks).toString("utf8");
+                const policy = parsePolicy(text.split("\0")[0]);
+                finish(policy && { policy, port });
+            };
+            const abort = () => finish(null);
+            const timer = setTimeout(abort, timeout);
+            signal.addEventListener("abort", abort, { once: true });
+            socket.on("connect", () => socket.write("<policy-file-request/>\0"));
+            socket.on("data", (chunk) => {
+                length += chunk.length;
+                if (length > this.limits.policy) {
+                    finish(null);
+                    return;
+                }
+                chunks.push(chunk);
+                if (chunk.includes(0)) {
+                    read();
+                }
+            });
+            socket.on("end", read);
+            socket.on("error", () => finish(null));
+        });
+    }
+    /**
+     * One HTTP exchange with `address`, the URL's host pinned to it: its
+     * status and headers, and its body if `read` and the status is a
+     * success, up to `max` bytes. No cookies, no credentials, no
+     * compression asked for, no connection kept.
+     */
+    send(url, address, method, headers, body, signal, options) {
+        const timeout = options.timeout ?? this.limits.timeout;
+        const deadline = options.deadline ?? this.limits.deadline;
+        return new Promise((answer, fail) => {
+            if (signal.aborted) {
+                fail(new Refused("aborted"));
+                return;
+            }
+            const host = bare(url.hostname);
+            const outgoing = {
+                "User-Agent": USER_AGENT,
+                Accept: "*/*",
+                "x-flash-version": FLASH_VERSION,
+            };
+            if (options.referer) {
+                outgoing.Referer = options.referer;
+            }
+            for (const [name, value] of headers) {
+                outgoing[name] = value;
+            }
+            if (body) {
+                outgoing["Content-Length"] = String(body.length);
+            }
+            const https = url.protocol === "https:";
+            const family = isIP(address);
+            let request;
+            try {
+                request = (https ? httpsRequest : httpRequest)({
+                    host,
+                    port: url.port || (https ? 443 : 80),
+                    path: `${url.pathname}${url.search}`,
+                    method,
+                    headers: outgoing,
+                    agent: false,
+                    // The address pinned for this request, whatever the resolver would say now.
+                    lookup: (_name, opts, callback) => {
+                        if (opts.all) {
+                            callback(null, [
+                                { address, family },
+                            ]);
+                        }
+                        else {
+                            callback(null, address, family);
+                        }
+                    },
+                    ...(https ? { servername: isIP(host) ? undefined : host, ca: this.ca } : {}),
+                    // Only where the user asked for this host: its certificate goes unchecked.
+                    ...(https && this.unverified(host) ? { rejectUnauthorized: false } : {}),
+                });
+            }
+            catch (error) {
+                // What check() let through and Node still refuses: a refusal like any other.
+                fail(new Refused(error.message));
+                return;
+            }
+            let timer;
+            const overall = setTimeout(() => stop(new Refused("it took too long")), deadline);
+            let finished = false;
+            /** What else a stop takes down: a decompressor. */
+            const stopping = [];
+            const stop = (error) => {
+                if (!finished) {
+                    finished = true;
+                    for (const down of stopping) {
+                        down();
+                    }
+                    clearTimeout(timer);
+                    clearTimeout(overall);
+                    signal.removeEventListener("abort", abort);
+                    request.destroy();
+                    fail(error);
+                }
+            };
+            const arm = () => {
+                clearTimeout(timer);
+                timer = setTimeout(() => stop(new Refused("it timed out")), timeout);
+            };
+            const abort = () => stop(new Refused("aborted"));
+            signal.addEventListener("abort", abort, { once: true });
+            arm();
+            request.on("error", (error) => stop(new Refused(error.message)));
+            request.on("response", (response) => {
+                const status = response.statusCode ?? 0;
+                const received = [];
+                const raw = response.rawHeaders;
+                for (let i = 0; i + 1 < raw.length; i += 2) {
+                    // The SWF has no cookie jar to keep them in.
+                    if (!/^set-cookie2?$/i.test(raw[i])) {
+                        received.push([raw[i], raw[i + 1]]);
+                    }
+                }
+                const ok = status >= 200 && status < 300;
+                const end = (bytes) => {
+                    if (!finished) {
+                        finished = true;
+                        clearTimeout(timer);
+                        clearTimeout(overall);
+                        signal.removeEventListener("abort", abort);
+                        request.destroy();
+                        answer({ bytes, status, headers: received });
+                    }
+                };
+                if (!ok || !options.read) {
+                    end(null);
+                    return;
+                }
+                const declared = Number(response.headers["content-length"]);
+                if (declared > options.max) {
+                    stop(new Refused(`its response is larger than ${options.max} bytes`));
+                    return;
+                }
+                // A body a server compressed though no one asked: decompressed as it
+                // comes, the limits counting what comes out. One coding is undone;
+                // more than one, which no server needs, is refused.
+                const codings = String(response.headers["content-encoding"] ?? "")
+                    .split(",")
+                    .map((c) => c.trim().toLowerCase())
+                    .filter((c) => c !== "" && c !== "identity");
+                if (codings.length > 1) {
+                    stop(new Refused(`its response is encoded ${codings.length} times`));
+                    return;
+                }
+                const coding = codings[0] ?? "";
+                const coded = DECODED.has(coding);
+                if (coded) {
+                    const named = (n) => /^content-(encoding|length)$/i.test(n);
+                    received.splice(0, received.length, ...received.filter(([n]) => !named(n)));
+                }
+                // The body, copied as it comes into one array that doubles as it
+                // fills: never a list of the chunks, which for a body sent a byte at
+                // a time would hold hundreds of times its size. It starts at the
+                // declared length, where that is believable, and so needs no copy at
+                // the end.
+                const budget = options.budget;
+                const exact = !coded && Number.isSafeInteger(declared) && declared >= 0;
+                let body = new Uint8Array(0);
+                let length = 0;
+                const reserve = (capacity) => {
+                    const more = capacity - body.length;
+                    if (budget) {
+                        if (budget.session.buffered + more > this.limits.buffered) {
+                            stop(new Refused("the SWF's responses under way hold too much at once"));
+                            return false;
+                        }
+                        budget.session.buffered += more;
+                        budget.taken += more;
+                    }
+                    const grown = new Uint8Array(capacity);
+                    grown.set(body.subarray(0, length));
+                    body = grown;
+                    return true;
+                };
+                if (exact && declared > 0 && !reserve(declared)) {
+                    return;
+                }
+                const take = (chunk) => {
+                    if (finished) {
+                        return;
+                    }
+                    if (length + chunk.length > options.max) {
+                        stop(new Refused(`its response is larger than ${options.max} bytes`));
+                        return;
+                    }
+                    if (length + chunk.length > body.length) {
+                        const capacity = Math.min(options.max, Math.max(length + chunk.length, body.length * 2));
+                        if (!reserve(capacity)) {
+                            return;
+                        }
+                    }
+                    body.set(chunk, length);
+                    length += chunk.length;
+                    arm();
+                };
+                // Bytes of their own, not a view of a larger array, whose rest IPC
+                // would carry to the page with them; the larger array let go of at
+                // once, so that it may be collected before IPC copies the rest.
+                const done = () => {
+                    const bytes = length === body.length ? body : body.slice(0, length);
+                    body = new Uint8Array(0);
+                    end(bytes);
+                };
+                arm();
+                if (!coded) {
+                    response.on("data", take);
+                    response.on("end", done);
+                }
+                else {
+                    const decompressor = new Decompressor(coding, take, done, () => stop(new Refused("its response does not decompress")));
+                    stopping.push(() => decompressor.destroy());
+                    decompressor.onDrain = () => response.resume();
+                    response.on("data", (chunk) => {
+                        arm();
+                        if (!decompressor.write(chunk)) {
+                            response.pause();
+                        }
+                    });
+                    response.on("end", () => decompressor.end());
+                }
+                response.on("error", (error) => stop(new Refused(error.message)));
+                response.on("aborted", () => stop(new Refused("the response broke off")));
+            });
+            request.end(body ?? undefined);
+        });
+    }
+}
+/**
+ * Whether `url` is potentially trustworthy, as the Secure Contexts
+ * specification has it for a Referer: https, or this machine by its
+ * loopback address or a name under localhost.
+ */
+function trustworthy(url) {
+    if (url.protocol === "https:") {
+        return true;
+    }
+    // A name with its root's dot is the same name; of IPv6 addresses the
+    // specification names ::1 alone, not an IPv4 loopback address inside one.
+    const host = bare(url.hostname).toLowerCase().replace(/\.$/, "");
+    return (host === "localhost" ||
+        host.endsWith(".localhost") ||
+        host === "::1" ||
+        (isIPv4(host) && addressClass(host) === "loopback"));
+}
+/** The longest Referer sent whole, as the Referrer Policy specification has it. */
+const MAX_REFERER = 4096;
+/**
+ * The Referer a request from the SWF at `swf` to `target` carries, as
+ * browsers' strict-origin-when-cross-origin has it: the SWF's URL to its
+ * own origin, its origin alone to another, and nothing from https to what
+ * is not potentially trustworthy; a URL longer than 4096 characters goes
+ * as its origin.
+ */
+export function refererFor(swf, target) {
+    if (!swf || (swf.protocol === "https:" && !trustworthy(target))) {
+        return null;
+    }
+    const origin = `${swf.origin}/`;
+    if (swf.origin !== target.origin || swf.href.length > MAX_REFERER) {
+        return origin.length > MAX_REFERER ? null : origin;
+    }
+    return swf.href;
+}
+/** `promise`, or a Refused once `signal` aborts: a request stops waiting on a shared policy. */
+function abortable(promise, signal) {
+    if (signal.aborted) {
+        return Promise.reject(new Refused("aborted"));
+    }
+    return new Promise((resolve, reject) => {
+        const stop = () => reject(new Refused("aborted"));
+        signal.addEventListener("abort", stop, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener("abort", stop);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener("abort", stop);
+            reject(error);
+        });
+    });
+}
+/** A host name without an IPv6 address's brackets. */
+function bare(host) {
+    return host.replace(/^\[(.*)\]$/, "$1");
+}
+function checkPort(url) {
+    const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+    if (badPort(port)) {
+        throw new Refused(`port ${port} is not for HTTP`);
+    }
+}
+/** Where a redirect goes, if `response` is one, to http or https; one elsewhere is refused. */
+function redirectOf(url, response) {
+    if (!REDIRECTS.has(response.status)) {
+        return null;
+    }
+    const location = response.headers.find(([n]) => n.toLowerCase() === "location")?.[1];
+    if (location === undefined) {
+        return null;
+    }
+    let next;
+    try {
+        next = new URL(location, url);
+    }
+    catch {
+        throw new Refused("a redirect to no URL");
+    }
+    if (next.protocol !== "http:" && next.protocol !== "https:") {
+        throw new Refused(`a redirect to ${next.protocol}`);
+    }
+    if (next.username || next.password) {
+        throw new Refused("a redirect to a URL with credentials");
+    }
+    next.hash = "";
+    return next;
+}
+/** `key`'s value in `cache`, made once with `make`; a cache grown past its bound starts again. */
+function cached(cache, key, make) {
+    let value = cache.get(key);
+    if (!value) {
+        if (cache.size >= 512) {
+            cache.clear();
+        }
+        value = make();
+        cache.set(key, value);
+    }
+    return value;
+}
+function describe(requester) {
+    return requester.host === null ? 'a local SWF (domain="*")' : requester.host;
+}
+//# sourceMappingURL=network.js.map