@swf2es/desktop 0.1.20 → 0.1.22

package/src/main/menu.ts

@@ -0,0 +1,84 @@
+// The application menu, built again as what plays and the settings change.
+import { app, Menu, type MenuItemConstructorOptions } from "electron";
+import { chooseLibrary, refuse, resetLibrary, showOpenDialog, showUrlDialog } from "./dialogs.ts";
+import { closeMovie, current, openEntry } from "./open.ts";
+import { settings, window } from "./state.ts";
+
+export function buildMenu(): void {
+  const recent = settings.settings.recent;
+  const template: MenuItemConstructorOptions[] = [
+    ...(process.platform === "darwin" ? [{ role: "appMenu" as const }] : []),
+    {
+      label: "&File",
+      submenu: [
+        { label: "&Open…", accelerator: "CmdOrCtrl+O", click: () => void showOpenDialog() },
+        { label: "Open &URL…", accelerator: "CmdOrCtrl+L", click: showUrlDialog },
+        {
+          label: "Open &Recent",
+          submenu: [
+            ...recent.map((entry) => ({ label: entry, click: () => void openEntry(entry) })),
+            ...(recent.length > 0 ? [{ type: "separator" as const }] : []),
+            {
+              label: "Clear Recent",
+              enabled: recent.length > 0,
+              click: () => {
+                settings.clearRecent();
+                app.clearRecentDocuments();
+                buildMenu();
+              },
+            },
+          ],
+        },
+        {
+          id: "close-movie",
+          label: "&Close Movie",
+          accelerator: "CmdOrCtrl+W",
+          enabled: !!current,
+          click: closeMovie,
+        },
+        { type: "separator" },
+        { label: "Choose playerglobal.abc…", click: () => void chooseLibrary("playerglobal") },
+        {
+          label: "Use the App's playerglobal",
+          enabled: !!settings.settings.playerglobal,
+          click: () => resetLibrary("playerglobal"),
+        },
+        { type: "separator" },
+        { role: "quit" },
+      ],
+    },
+    {
+      label: "&View",
+      submenu: [
+        {
+          id: "reload-movie",
+          label: "&Reload Movie",
+          accelerator: "CmdOrCtrl+R",
+          enabled: !!current,
+          click: () => current && void openEntry(current.path),
+        },
+        { role: "togglefullscreen", accelerator: "F11" },
+        { type: "separator" },
+        {
+          id: "stage3d",
+          label: "Stage3D",
+          type: "checkbox",
+          checked: settings.stage3D,
+          click: (item) => {
+            if (!settings.setStage3D(item.checked)) {
+              refuse(
+                "The settings could not be saved.",
+                "The Stage3D choice holds until you quit.",
+              );
+            }
+
+            window?.webContents.reload();
+          },
+        },
+        { type: "separator" },
+        { role: "toggleDevTools" },
+      ],
+    },
+  ];
+  Menu.setApplicationMenu(Menu.buildFromTemplate(template));
+}

package/src/main/network-rules.ts

@@ -0,0 +1,199 @@
+// The rules network.ts applies that need none of its state: Referers,
+// redirects, ports, the certificate switch, and the small helpers its
+// requests share. Without Electron, as network.ts is.
+import { isIPv4 } from "node:net";
+import * as tls from "node:tls";
+import { addressClass, badPort } from "./addresses.ts";
+import { type NetResponse, Refused } from "./network-types.ts";
+import type { Requester } from "./policy.ts";
+import { ProxyError } from "./proxy.ts";
+
+const REDIRECTS = new Set([301, 302, 303, 307, 308]);
+
+/** The system's trusted roots beside Node's, where this Node can tell them. */
+export function defaultCa(): string[] | undefined {
+  const get = (tls as { getCACertificates?: (type: string) => string[] }).getCACertificates;
+  if (typeof get !== "function") {
+    return undefined;
+  }
+
+  try {
+    return [...new Set([...get("default"), ...get("system")])];
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The hosts --ignore-certificate-errors names, of the app's arguments up to
+ * an AIR application's own after "--": null without the switch; with it
+ * alone, every host; with `=a.test,b.test`, those, whatever their case.
+ * A host is a name or an address, with no port: every port of it.
+ */
+export function unverifiedHosts(argv: string[]): { all: boolean; hosts: string[] } | null {
+  const end = argv.indexOf("--");
+  const own = end < 0 ? argv : argv.slice(0, end);
+  let named = false;
+  let all = false;
+  const hosts: string[] = [];
+  for (const arg of own) {
+    if (arg === "--ignore-certificate-errors") {
+      named = true;
+      all = true;
+    } else if (arg.startsWith("--ignore-certificate-errors=")) {
+      // The switch with nothing named ignores nothing, rather than everything by a slip.
+      named = true;
+      for (const host of arg.slice(arg.indexOf("=") + 1).split(",")) {
+        if (host.trim() !== "") {
+          hosts.push(host.trim().toLowerCase());
+        }
+      }
+    }
+  }
+
+  return named ? { all, hosts } : null;
+}
+
+/**
+ * Whether `url` is potentially trustworthy, as the Secure Contexts
+ * specification has it for a Referer: https, or this machine by its
+ * loopback address or a name under localhost.
+ */
+function trustworthy(url: URL): boolean {
+  if (url.protocol === "https:") {
+    return true;
+  }
+
+  // A name with its root's dot is the same name; of IPv6 addresses the
+  // specification names ::1 alone, not an IPv4 loopback address inside one.
+  const host = bare(url.hostname).toLowerCase().replace(/\.$/, "");
+  return (
+    host === "localhost" ||
+    host.endsWith(".localhost") ||
+    host === "::1" ||
+    (isIPv4(host) && addressClass(host) === "loopback")
+  );
+}
+
+/** The longest Referer sent whole, as the Referrer Policy specification has it. */
+const MAX_REFERER = 4096;
+
+/**
+ * The Referer a request from the SWF at `swf` to `target` carries, as
+ * browsers' strict-origin-when-cross-origin has it: the SWF's URL to its
+ * own origin, its origin alone to another, and nothing from https to what
+ * is not potentially trustworthy; a URL longer than 4096 characters goes
+ * as its origin.
+ */
+export function refererFor(swf: URL | null, target: URL): string | null {
+  if (!swf || (swf.protocol === "https:" && !trustworthy(target))) {
+    return null;
+  }
+
+  const origin = `${swf.origin}/`;
+  if (swf.origin !== target.origin || swf.href.length > MAX_REFERER) {
+    return origin.length > MAX_REFERER ? null : origin;
+  }
+
+  return swf.href;
+}
+
+/** `promise`, or a Refused once `signal` aborts: a request stops waiting on a shared policy. */
+export function abortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {
+  if (signal.aborted) {
+    return Promise.reject(new Refused("aborted"));
+  }
+
+  return new Promise((resolve, reject) => {
+    const stop = () => reject(new Refused("aborted"));
+    signal.addEventListener("abort", stop, { once: true });
+    promise.then(
+      (value) => {
+        signal.removeEventListener("abort", stop);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", stop);
+        reject(error);
+      },
+    );
+  });
+}
+
+/** A host name without an IPv6 address's brackets. */
+export function bare(host: string): string {
+  return host.replace(/^\[(.*)\]$/, "$1");
+}
+
+export function checkPort(url: URL): void {
+  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+  if (badPort(port)) {
+    throw new Refused(`port ${port} is not for HTTP`);
+  }
+}
+
+/** Where a redirect goes, if `response` is one, to http or https; one elsewhere is refused. */
+export function redirectOf(url: URL, response: NetResponse): URL | null {
+  if (!REDIRECTS.has(response.status)) {
+    return null;
+  }
+
+  const location = response.headers.find(([n]) => n.toLowerCase() === "location")?.[1];
+  if (location === undefined) {
+    return null;
+  }
+
+  let next: URL;
+  try {
+    next = new URL(location, url);
+  } catch {
+    throw new Refused("a redirect to no URL");
+  }
+
+  if (next.protocol !== "http:" && next.protocol !== "https:") {
+    throw new Refused(`a redirect to ${next.protocol}`);
+  }
+
+  if (next.username || next.password) {
+    throw new Refused("a redirect to a URL with credentials");
+  }
+
+  next.hash = "";
+  return next;
+}
+
+/** `key`'s value in `cache`, made once with `make`; a cache grown past its bound starts again. */
+export function cached<T>(
+  cache: Map<string, Promise<T>>,
+  key: string,
+  make: () => Promise<T>,
+): Promise<T> {
+  let value = cache.get(key);
+  if (!value) {
+    if (cache.size >= 512) {
+      cache.clear();
+    }
+
+    value = make();
+    cache.set(key, value);
+    // A failure, a proxy's, is not kept: the next request asks again.
+    const made = value;
+    made.catch(() => {
+      if (cache.get(key) === made) {
+        cache.delete(key);
+      }
+    });
+  }
+
+  return value;
+}
+
+/** Whether `error` is a refusal for a proxy that failed, not a server it did not reach. */
+export function proxyFault(error: unknown): boolean {
+  const cause = (error as Error | null)?.cause;
+  return cause instanceof ProxyError && cause.fault;
+}
+
+export function describe(requester: Requester): string {
+  return requester.host === null ? 'a local SWF (domain="*")' : requester.host;
+}

package/src/main/network-types.ts

@@ -0,0 +1,150 @@
+// What network.ts's requests are and what bounds them: the request and
+// response a SWF's fetch carries, the movie they are judged for, the
+// limits, and the state one movie's requests share.
+import type { AddressClass } from "./addresses.ts";
+import type { Requester, SocketPolicy, UrlPolicy } from "./policy.ts";
+import type { ProxyConfig } from "./proxy.ts";
+
+export type Purpose = "movie" | "content" | "data" | "send";
+
+export interface NetRequest {
+  url: string;
+  method: string;
+  headers: [string, string][];
+  body: Uint8Array | null;
+  purpose: Purpose;
+  /**
+   * Whether the body of a response whose status is 400 or more is read
+   * too, which an AIR application's URLLoader and URLStream complete
+   * with; only an application is given it.
+   */
+  errorBody?: boolean;
+}
+
+export interface NetResponse {
+  bytes: Uint8Array | null;
+  status: number;
+  headers: [string, string][];
+  /** Where redirects took it, where that differs from the URL asked for. */
+  url?: string;
+}
+
+/** A request refused, with why, for the terminal; the SWF sees a failed load. */
+export class Refused extends Error {}
+
+export interface Limits {
+  /** The longest URL. */
+  url: number;
+  /** The most headers a SWF sends, and their names' and values' length all told. */
+  headers: number;
+  headerBytes: number;
+  /** The largest body a SWF sends. */
+  body: number;
+  /** The largest response read: a SWF, a sound, a level's data. */
+  response: number;
+  /** The largest policy file, URL or socket. */
+  policy: number;
+  redirects: number;
+  /** From the request to its response's headers, and from one chunk of its body to the next. */
+  timeout: number;
+  /**
+   * How long a request may take all told, however its bytes trickle in, so
+   * that a server sending a byte a second holds no turn for long; a policy
+   * file's whole fetch takes `policyTimeout` at most, as a movie keeps it.
+   */
+  deadline: number;
+  /** How long a policy file may take, and port 843's socket policy, which most servers lack. */
+  policyTimeout: number;
+  masterSocketTimeout: number;
+  /**
+   * The bytes a movie's responses may hold at once, all told: past it a
+   * response is refused, so many large ones together cannot take the
+   * main process's memory, as each alone may come near `response`.
+   */
+  buffered: number;
+  /** Requests under way at once; the rest wait their turn, up to `queue`. */
+  concurrent: number;
+  queue: number;
+  /** Policy files a movie may name with Security.loadPolicyFile. */
+  policyFiles: number;
+}
+
+export const LIMITS: Limits = {
+  url: 64 * 1024,
+  headers: 32,
+  headerBytes: 8 * 1024,
+  body: 32 * 1024 * 1024,
+  response: 128 * 1024 * 1024,
+  policy: 1024 * 1024,
+  redirects: 10,
+  timeout: 30_000,
+  deadline: 300_000,
+  policyTimeout: 10_000,
+  masterSocketTimeout: 3_000,
+  buffered: 256 * 1024 * 1024,
+  concurrent: 16,
+  queue: 1024,
+  policyFiles: 64,
+};
+
+/**
+ * The movie whose requests are judged: a remote SWF by its URL, a local
+ * one with networking, or an AIR application, whose sandbox reaches the
+ * network unjudged, as AIR's application sandbox does: any address, no
+ * policy file.
+ */
+export type Movie = { kind: "remote"; url: string } | { kind: "local" } | { kind: "application" };
+
+export interface NetworkOptions {
+  /** A host name's addresses, in order of preference: the system's resolver by default. */
+  resolve?: (host: string) => Promise<string[]>;
+  /** Where an address is: addresses.ts's by default; null for one never reached. */
+  classify?: (address: string) => AddressClass | null;
+  /** The certificate authorities HTTPS trusts, in place of Node's and the system's. */
+  ca?: string | string[];
+  /**
+   * Hosts whose HTTPS certificate is not verified: a server with one it
+   * signed itself, as a developer's own has (--ignore-certificate-errors).
+   * None by default.
+   */
+  unverified?: (host: string) => boolean;
+  limits?: Partial<Limits>;
+  /** Where a socket server keeps its master policy: 843. */
+  socketPolicyPort?: number;
+  /** What every connection goes through (--proxy); none by default. */
+  proxy?: ProxyConfig | null;
+}
+
+/** A remote movie once its SWF has come, where from. */
+export interface Origin {
+  /** Its URL after redirects: its loaderInfo.url, and its Referer. */
+  url: URL;
+  requester: Requester;
+  rank: number;
+}
+
+export interface Pinned {
+  address: string;
+  rank: number;
+}
+
+/** What one movie's requests share, and lose as the next opens. */
+/** What one request's responses hold of its movie's `buffered`, given back as it is answered. */
+export interface Budget {
+  session: Session;
+  taken: number;
+}
+
+export interface Session {
+  movie: Movie;
+  origin: Origin | null;
+  abort: AbortController;
+  /** URL and socket policies, by where they came from and the address they came from. */
+  policies: Map<string, Promise<UrlPolicy | null>>;
+  socketPolicies: Map<string, Promise<SocketPolicy | null>>;
+  /** What Security.loadPolicyFile named: http(s) URLs, and xmlsocket "host:port"s. */
+  urlPolicyFiles: URL[];
+  socketPolicyFiles: { host: string; port: number }[];
+  /** The bytes its responses hold now, of `buffered`. */
+  buffered: number;
+}