@swf2es/desktop 0.1.20 → 0.1.21

package/src/main/network.ts

@@ -26,15 +26,42 @@
 //   is asked for that address, not the name, so a proxy's DNS that answers
 //   otherwise than this machine's reaches nothing the judgement did not.
 //
+// Its types and limits are network-types.ts, and the rules that need no
+// instance network-rules.ts.
+//
 // Without Electron, so that node tests it (tests/desktop/network.test.ts).
 import { lookup } from "node:dns/promises";
 import { type ClientRequest, request as httpRequest, type IncomingMessage } from "node:http";
 import { request as httpsRequest } from "node:https";
-import { connect, isIP, isIPv4, type Socket } from "node:net";
+import { connect, isIP, type Socket } from "node:net";
 import type { Duplex } from "node:stream";
 import * as tls from "node:tls";
-import { type AddressClass, addressClass, badPort, RANK } from "./addresses.ts";
+import { type AddressClass, addressClass, RANK } from "./addresses.ts";
 import { DECODED, Decompressor } from "./decompress.ts";
+import {
+  abortable,
+  bare,
+  cached,
+  checkPort,
+  defaultCa,
+  describe,
+  proxyFault,
+  redirectOf,
+  refererFor,
+} from "./network-rules.ts";
+import {
+  type Budget,
+  LIMITS,
+  type Limits,
+  type Movie,
+  type NetRequest,
+  type NetResponse,
+  type NetworkOptions,
+  type Origin,
+  type Pinned,
+  Refused,
+  type Session,
+} from "./network-types.ts";
 import {
   allowsAccess,
   allowsHeaders,
@@ -49,203 +76,13 @@ import {
   urlMetaPolicy,
   usablePolicies,
 } from "./policy.ts";
-import { connectThrough, type ProxyConfig, ProxyError } from "./proxy.ts";
-
-export type Purpose = "movie" | "content" | "data" | "send";
-
-export interface NetRequest {
-  url: string;
-  method: string;
-  headers: [string, string][];
-  body: Uint8Array | null;
-  purpose: Purpose;
-  /**
-   * Whether the body of a response whose status is 400 or more is read
-   * too, which an AIR application's URLLoader and URLStream complete
-   * with; only an application is given it.
-   */
-  errorBody?: boolean;
-}
-
-export interface NetResponse {
-  bytes: Uint8Array | null;
-  status: number;
-  headers: [string, string][];
-  /** Where redirects took it, where that differs from the URL asked for. */
-  url?: string;
-}
-
-/** A request refused, with why, for the terminal; the SWF sees a failed load. */
-export class Refused extends Error {}
-
-export interface Limits {
-  /** The longest URL. */
-  url: number;
-  /** The most headers a SWF sends, and their names' and values' length all told. */
-  headers: number;
-  headerBytes: number;
-  /** The largest body a SWF sends. */
-  body: number;
-  /** The largest response read: a SWF, a sound, a level's data. */
-  response: number;
-  /** The largest policy file, URL or socket. */
-  policy: number;
-  redirects: number;
-  /** From the request to its response's headers, and from one chunk of its body to the next. */
-  timeout: number;
-  /**
-   * How long a request may take all told, however its bytes trickle in, so
-   * that a server sending a byte a second holds no turn for long; a policy
-   * file's whole fetch takes `policyTimeout` at most, as a movie keeps it.
-   */
-  deadline: number;
-  /** How long a policy file may take, and port 843's socket policy, which most servers lack. */
-  policyTimeout: number;
-  masterSocketTimeout: number;
-  /**
-   * The bytes a movie's responses may hold at once, all told: past it a
-   * response is refused, so many large ones together cannot take the
-   * main process's memory, as each alone may come near `response`.
-   */
-  buffered: number;
-  /** Requests under way at once; the rest wait their turn, up to `queue`. */
-  concurrent: number;
-  queue: number;
-  /** Policy files a movie may name with Security.loadPolicyFile. */
-  policyFiles: number;
-}
-
-const LIMITS: Limits = {
-  url: 64 * 1024,
-  headers: 32,
-  headerBytes: 8 * 1024,
-  body: 32 * 1024 * 1024,
-  response: 128 * 1024 * 1024,
-  policy: 1024 * 1024,
-  redirects: 10,
-  timeout: 30_000,
-  deadline: 300_000,
-  policyTimeout: 10_000,
-  masterSocketTimeout: 3_000,
-  buffered: 256 * 1024 * 1024,
-  concurrent: 16,
-  queue: 1024,
-  policyFiles: 64,
-};
-
-/**
- * The movie whose requests are judged: a remote SWF by its URL, a local
- * one with networking, or an AIR application, whose sandbox reaches the
- * network unjudged, as AIR's application sandbox does: any address, no
- * policy file.
- */
-export type Movie = { kind: "remote"; url: string } | { kind: "local" } | { kind: "application" };
-
-export interface NetworkOptions {
-  /** A host name's addresses, in order of preference: the system's resolver by default. */
-  resolve?: (host: string) => Promise<string[]>;
-  /** Where an address is: addresses.ts's by default; null for one never reached. */
-  classify?: (address: string) => AddressClass | null;
-  /** The certificate authorities HTTPS trusts, in place of Node's and the system's. */
-  ca?: string | string[];
-  /**
-   * Hosts whose HTTPS certificate is not verified: a server with one it
-   * signed itself, as a developer's own has (--ignore-certificate-errors).
-   * None by default.
-   */
-  unverified?: (host: string) => boolean;
-  limits?: Partial<Limits>;
-  /** Where a socket server keeps its master policy: 843. */
-  socketPolicyPort?: number;
-  /** What every connection goes through (--proxy); none by default. */
-  proxy?: ProxyConfig | null;
-}
+import { connectThrough, type ProxyConfig, type ProxyError } from "./proxy.ts";
 
 /** What Flash Player 32 reported, sent as it sent it. */
 const FLASH_VERSION = "32,0,0,465";
 const USER_AGENT = "Mozilla/5.0 (compatible; swf2es) Shockwave Flash";
-
-/** A remote movie once its SWF has come, where from. */
-interface Origin {
-  /** Its URL after redirects: its loaderInfo.url, and its Referer. */
-  url: URL;
-  requester: Requester;
-  rank: number;
-}
-
-interface Pinned {
-  address: string;
-  rank: number;
-}
-
-/** What one movie's requests share, and lose as the next opens. */
-/** What one request's responses hold of its movie's `buffered`, given back as it is answered. */
-interface Budget {
-  session: Session;
-  taken: number;
-}
-
-interface Session {
-  movie: Movie;
-  origin: Origin | null;
-  abort: AbortController;
-  /** URL and socket policies, by where they came from and the address they came from. */
-  policies: Map<string, Promise<UrlPolicy | null>>;
-  socketPolicies: Map<string, Promise<SocketPolicy | null>>;
-  /** What Security.loadPolicyFile named: http(s) URLs, and xmlsocket "host:port"s. */
-  urlPolicyFiles: URL[];
-  socketPolicyFiles: { host: string; port: number }[];
-  /** The bytes its responses hold now, of `buffered`. */
-  buffered: number;
-}
-
-const REDIRECTS = new Set([301, 302, 303, 307, 308]);
 const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 
-/** The system's trusted roots beside Node's, where this Node can tell them. */
-function defaultCa(): string[] | undefined {
-  const get = (tls as { getCACertificates?: (type: string) => string[] }).getCACertificates;
-  if (typeof get !== "function") {
-    return undefined;
-  }
-
-  try {
-    return [...new Set([...get("default"), ...get("system")])];
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * The hosts --ignore-certificate-errors names, of the app's arguments up to
- * an AIR application's own after "--": null without the switch; with it
- * alone, every host; with `=a.test,b.test`, those, whatever their case.
- * A host is a name or an address, with no port: every port of it.
- */
-export function unverifiedHosts(argv: string[]): { all: boolean; hosts: string[] } | null {
-  const end = argv.indexOf("--");
-  const own = end < 0 ? argv : argv.slice(0, end);
-  let named = false;
-  let all = false;
-  const hosts: string[] = [];
-  for (const arg of own) {
-    if (arg === "--ignore-certificate-errors") {
-      named = true;
-      all = true;
-    } else if (arg.startsWith("--ignore-certificate-errors=")) {
-      // The switch with nothing named ignores nothing, rather than everything by a slip.
-      named = true;
-      for (const host of arg.slice(arg.indexOf("=") + 1).split(",")) {
-        if (host.trim() !== "") {
-          hosts.push(host.trim().toLowerCase());
-        }
-      }
-    }
-  }
-
-  return named ? { all, hosts } : null;
-}
-
 export class Network {
   private readonly limits: Limits;
   private readonly resolveHost: (host: string) => Promise<string[]>;
@@ -1181,147 +1018,3 @@ export class Network {
     });
   }
 }
-
-/**
- * Whether `url` is potentially trustworthy, as the Secure Contexts
- * specification has it for a Referer: https, or this machine by its
- * loopback address or a name under localhost.
- */
-function trustworthy(url: URL): boolean {
-  if (url.protocol === "https:") {
-    return true;
-  }
-
-  // A name with its root's dot is the same name; of IPv6 addresses the
-  // specification names ::1 alone, not an IPv4 loopback address inside one.
-  const host = bare(url.hostname).toLowerCase().replace(/\.$/, "");
-  return (
-    host === "localhost" ||
-    host.endsWith(".localhost") ||
-    host === "::1" ||
-    (isIPv4(host) && addressClass(host) === "loopback")
-  );
-}
-
-/** The longest Referer sent whole, as the Referrer Policy specification has it. */
-const MAX_REFERER = 4096;
-
-/**
- * The Referer a request from the SWF at `swf` to `target` carries, as
- * browsers' strict-origin-when-cross-origin has it: the SWF's URL to its
- * own origin, its origin alone to another, and nothing from https to what
- * is not potentially trustworthy; a URL longer than 4096 characters goes
- * as its origin.
- */
-export function refererFor(swf: URL | null, target: URL): string | null {
-  if (!swf || (swf.protocol === "https:" && !trustworthy(target))) {
-    return null;
-  }
-
-  const origin = `${swf.origin}/`;
-  if (swf.origin !== target.origin || swf.href.length > MAX_REFERER) {
-    return origin.length > MAX_REFERER ? null : origin;
-  }
-
-  return swf.href;
-}
-
-/** `promise`, or a Refused once `signal` aborts: a request stops waiting on a shared policy. */
-function abortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {
-  if (signal.aborted) {
-    return Promise.reject(new Refused("aborted"));
-  }
-
-  return new Promise((resolve, reject) => {
-    const stop = () => reject(new Refused("aborted"));
-    signal.addEventListener("abort", stop, { once: true });
-    promise.then(
-      (value) => {
-        signal.removeEventListener("abort", stop);
-        resolve(value);
-      },
-      (error) => {
-        signal.removeEventListener("abort", stop);
-        reject(error);
-      },
-    );
-  });
-}
-
-/** A host name without an IPv6 address's brackets. */
-function bare(host: string): string {
-  return host.replace(/^\[(.*)\]$/, "$1");
-}
-
-function checkPort(url: URL): void {
-  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
-  if (badPort(port)) {
-    throw new Refused(`port ${port} is not for HTTP`);
-  }
-}
-
-/** Where a redirect goes, if `response` is one, to http or https; one elsewhere is refused. */
-function redirectOf(url: URL, response: NetResponse): URL | null {
-  if (!REDIRECTS.has(response.status)) {
-    return null;
-  }
-
-  const location = response.headers.find(([n]) => n.toLowerCase() === "location")?.[1];
-  if (location === undefined) {
-    return null;
-  }
-
-  let next: URL;
-  try {
-    next = new URL(location, url);
-  } catch {
-    throw new Refused("a redirect to no URL");
-  }
-
-  if (next.protocol !== "http:" && next.protocol !== "https:") {
-    throw new Refused(`a redirect to ${next.protocol}`);
-  }
-
-  if (next.username || next.password) {
-    throw new Refused("a redirect to a URL with credentials");
-  }
-
-  next.hash = "";
-  return next;
-}
-
-/** `key`'s value in `cache`, made once with `make`; a cache grown past its bound starts again. */
-function cached<T>(
-  cache: Map<string, Promise<T>>,
-  key: string,
-  make: () => Promise<T>,
-): Promise<T> {
-  let value = cache.get(key);
-  if (!value) {
-    if (cache.size >= 512) {
-      cache.clear();
-    }
-
-    value = make();
-    cache.set(key, value);
-    // A failure, a proxy's, is not kept: the next request asks again.
-    const made = value;
-    made.catch(() => {
-      if (cache.get(key) === made) {
-        cache.delete(key);
-      }
-    });
-  }
-
-  return value;
-}
-
-/** Whether `error` is a refusal for a proxy that failed, not a server it did not reach. */
-function proxyFault(error: unknown): boolean {
-  const cause = (error as Error | null)?.cause;
-  return cause instanceof ProxyError && cause.fault;
-}
-
-function describe(requester: Requester): string {
-  return requester.host === null ? 'a local SWF (domain="*")' : requester.host;
-}

package/src/main/open.ts

@@ -0,0 +1,302 @@
+// What plays, and opening it: a SWF by its path or its URL, or an AIR
+// application by its descriptor, from the command line, the menu, a
+// dialog or a drop; and closing it. Only this module changes what plays;
+// the others read it.
+import { statSync } from "node:fs";
+import { open as openFile, realpath } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileAttributes } from "@swf2es/format";
+import { app, dialog, safeStorage } from "electron";
+import type { OpenedMovie } from "../shared/api.js";
+import { type AirCommand, airLaunch, EncryptedItems } from "./air.ts";
+import { refuse } from "./dialogs.ts";
+import { buildMenu } from "./menu.ts";
+import type { Movie } from "./network-types.ts";
+import { listening, sandbox, settings, TITLE, window } from "./state.ts";
+import { network } from "./switches.ts";
+
+/** What the network judges the movie playing as; null for none, or one without networking. */
+export let networkMovie: Movie | null = null;
+export let current: { path: string; movie: OpenedMovie } | null = null;
+/** The servers the SWF playing was allowed, or denied, a socket to until it closes: "host:port". */
+export let allowedOnce = new Set<string>();
+export let deniedOnce = new Set<string>();
+
+/** The longest URL a SWF is opened by. */
+const MAX_URL = 8192;
+/** The AIR application playing, as its command line asked for it; null for none. */
+export let air: AirCommand | null = null;
+/** The EncryptedLocalStore of the AIR application playing, if one is. */
+export let encryptedItems: EncryptedItems | null = null;
+
+/**
+ * `text` as the URL of a remote SWF: http or https, with a host and no
+ * credentials, its fragment dropped; null if it is not one.
+ */
+export function remoteUrl(text: string): URL | null {
+  if (text.length > MAX_URL) {
+    return null;
+  }
+
+  let url: URL;
+  try {
+    url = new URL(text.trim());
+  } catch {
+    return null;
+  }
+
+  if ((url.protocol !== "http:" && url.protocol !== "https:") || !url.hostname) {
+    return null;
+  }
+
+  if (url.username || url.password) {
+    return null;
+  }
+
+  url.hash = "";
+  return url;
+}
+
+/**
+ * The SWF named on a command line, from `cwd`: the last argument after the
+ * app's own that is an http or https URL or names a .swf file there is.
+ * Chromium's and Electron's switches may take values of their own
+ * (`--switch value`), so the first argument that is not a switch could be one.
+ */
+export function movieFromArguments(argv: string[], cwd = process.cwd()): string | null {
+  const named = argv
+    .slice(process.defaultApp ? 2 : 1)
+    .filter((a) => !a.startsWith("-"))
+    .map((a) => remoteUrl(a)?.href ?? (/\.swf$/i.test(a) ? resolve(cwd, a) : null))
+    .filter((a) => a !== null);
+  return (
+    named.reverse().find((a) => remoteUrl(a) || statSync(a, { throwIfNoEntry: false })?.isFile()) ??
+    null
+  );
+}
+
+/**
+ * How much of a SWF the main process reads to choose its sandbox: far more than FileAttributes
+ * takes compressed.
+ */
+const START = 64 * 1024;
+const USE_NETWORK = 0x01;
+
+/**
+ * The first `length` bytes of the file at `path`, or as many as it has, at least `least`; null
+ * otherwise.
+ */
+export async function readStart(
+  path: string,
+  length: number,
+  least = 8,
+): Promise<Uint8Array | null> {
+  try {
+    const file = await openFile(path);
+    try {
+      const bytes = new Uint8Array(length);
+      const { bytesRead } = await file.read(bytes, 0, length, 0);
+      return bytesRead >= Math.min(least, length) ? bytes.subarray(0, bytesRead) : null;
+    } finally {
+      await file.close();
+    }
+  } catch {
+    return null;
+  }
+}
+
+/** Open what the recent list, the command line or a reload names: a URL, a SWF's path or a descriptor's. */
+export function openEntry(entry: string): Promise<void> {
+  if (remoteUrl(entry)) {
+    return openUrl(entry);
+  }
+
+  // A descriptor reopened from the recent list or a reload, with the arguments it was run with.
+  if (/\.xml$/i.test(entry)) {
+    return openAir(
+      air?.descriptor === entry ? air : { descriptor: entry, root: null, arguments: [] },
+      process.cwd(),
+    );
+  }
+
+  return open(entry);
+}
+
+/**
+ * Run the AIR application `command` names, as adl does: its content SWF in
+ * the window, at the descriptor's size, in AIR's application sandbox, with
+ * its launch (shared/api.ts AirLaunch), from `cwd`.
+ */
+export async function openAir(command: AirCommand, cwd: string): Promise<void> {
+  const name = basename(command.descriptor);
+  let opened: ReturnType<typeof airLaunch>;
+  try {
+    opened = airLaunch(command, cwd, app.getPath("userData"), {
+      documents: app.getPath("documents"),
+      desktop: app.getPath("desktop"),
+      cache: app.getPath("temp"),
+    });
+  } catch (error) {
+    refuse(`${name} could not be opened.`, String(error));
+    return;
+  }
+
+  const head = await readStart(opened.content, START);
+  const signature = head ? String.fromCharCode(...head.subarray(0, 3)) : "";
+  if (!head || (signature !== "FWS" && signature !== "CWS" && signature !== "ZWS")) {
+    refuse(`${name}'s content is not a SWF.`, opened.content);
+    return;
+  }
+
+  const content = await realpath(opened.content);
+  sandbox.playApplication(content);
+  air = command;
+  // Beside its storage directory, by its id, as AIR keeps it; encrypted by the system's keychain where it has one.
+  encryptedItems = new EncryptedItems(
+    join(dirname(opened.launch.directories.applicationStorage), "EncryptedLocalStore"),
+    safeStorage.isEncryptionAvailable()
+      ? {
+          encrypt: (text) => new Uint8Array(safeStorage.encryptString(text)),
+          decrypt: (data) => safeStorage.decryptString(Buffer.from(data)),
+        }
+      : null,
+  );
+  if (window && opened.width && opened.height) {
+    window.setSize(opened.width, opened.height);
+  }
+
+  // Played from app:/, as AIR plays it: its relative URLs, and loaderInfo.url, are the application's.
+  const url = `app:/${opened.relative
+    .split("/")
+    .filter((s) => s !== "")
+    .map(encodeURIComponent)
+    .join("/")}`;
+  show(
+    command.descriptor,
+    { url, name: opened.title, sandbox: "application", air: opened.launch },
+    { kind: "application" },
+  );
+}
+
+/** Play `movie` in the window, in place of what plays: what the user opened, as `entry`. */
+function show(entry: string, movie: OpenedMovie, onNetwork: Movie | null): void {
+  current = { path: entry, movie };
+  playOnNetwork(onNetwork);
+  allowedOnce = new Set();
+  deniedOnce = new Set();
+  settings.opened(entry);
+  buildMenu();
+  if (window) {
+    // An AIR application's window is its own: its title alone, as adl shows it.
+    window.setTitle(movie.air ? movie.name : `${movie.name} — ${TITLE}`);
+    if (listening) {
+      window.webContents.send("desktop:open", movie);
+    }
+  }
+}
+
+/**
+ * Play the SWF at `text`, an http or https URL, in Flash's remote sandbox:
+ * no local file, and the network as its origin's (network.ts). The page
+ * fetches it through the main process like anything it loads.
+ */
+export async function openUrl(text: string): Promise<void> {
+  const url = remoteUrl(text);
+  if (!url) {
+    refuse("Only an http or https URL opens.", text.slice(0, 200));
+    return;
+  }
+
+  const last = url.pathname.split("/").pop() ?? "";
+  let name: string;
+  try {
+    name = decodeURIComponent(last) || url.host;
+  } catch {
+    name = last;
+  }
+
+  air = null;
+  sandbox.playRemote(url.href);
+  show(url.href, { url: url.href, name, sandbox: "remote" }, { kind: "remote", url: url.href });
+}
+
+/**
+ * Open the file the user chose in the dialog, dropped on the window or
+ * opened with the app: an AIR application's descriptor (`.xml`) runs the
+ * application, anything else is played as a SWF.
+ */
+export async function openChosen(path: string): Promise<void> {
+  if (!/\.xml$/i.test(path)) {
+    return open(path);
+  }
+
+  // An application has an installed program's reach, which a file chosen in
+  // passing should not get unasked: asked once, until it leaves the recent list.
+  if (window && !settings.settings.recent.includes(path)) {
+    const { response } = await dialog.showMessageBox(window, {
+      type: "question",
+      message: `Run ${basename(path)} as an AIR application?`,
+      detail:
+        "An AIR application reads and writes your files and reaches the network unasked, as an installed program does. Run only one you trust.",
+      buttons: ["Run", "Cancel"],
+      defaultId: 1,
+      cancelId: 1,
+    });
+    if (response !== 0) {
+      return;
+    }
+  }
+
+  // Run from its own directory, with no arguments, as one started by its icon is.
+  return openAir({ descriptor: path, root: null, arguments: [] }, dirname(path));
+}
+
+/** Play the SWF at `path` in the window, in place of what plays, in its sandbox. */
+async function open(path: string): Promise<void> {
+  const name = basename(path);
+  // Its start alone: the main process never decompresses a SWF whole, whose
+  // header may name 4 GB. FileAttributes, the first tag, lies in it.
+  const head = await readStart(path, START);
+  const signature = head ? String.fromCharCode(...head.subarray(0, 3)) : "";
+  if (!head || (signature !== "FWS" && signature !== "CWS" && signature !== "ZWS")) {
+    refuse(`${name} is not a SWF.`, path);
+    return;
+  }
+
+  const useNetwork = (fileAttributes(head) & USE_NETWORK) !== 0;
+
+  let url: string;
+  try {
+    air = null;
+    url = sandbox.play(path, useNetwork);
+  } catch (error) {
+    // Gone, or unreadable, since it was read.
+    refuse(`${name} could not be opened.`, String(error));
+    return;
+  }
+
+  app.addRecentDocument(path);
+  show(
+    path,
+    { url, name, sandbox: useNetwork ? "localWithNetwork" : "localWithFile" },
+    useNetwork ? { kind: "local" } : null,
+  );
+}
+
+/** Judge requests for `movie` from now on: the last one's are aborted. */
+function playOnNetwork(movie: Movie | null): void {
+  networkMovie = movie;
+  network.play(movie);
+}
+
+export function closeMovie(): void {
+  current = null;
+  air = null;
+  sandbox.stop();
+  playOnNetwork(null);
+  buildMenu();
+  window?.setTitle(TITLE);
+  if (listening) {
+    window?.webContents.send("desktop:close");
+  }
+}