@tinvar/renderer 0.4.0 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinvar/renderer",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "license": "MIT",
   "files": [
     "src",
@@ -41,6 +41,6 @@
     "vite": "^8.3.5"
   },
   "bin": {
-    "tinvar-renderer": "./bin/renderer.js"
+    "tinvar-renderer": "bin/renderer.js"
   }
 }

package/src/sandbox.js

@@ -166,6 +166,7 @@ export function sandboxFlags({ rendererRoot, appEntry, socketPath, extraRead = [
 
   return [
     permissionFlag(),
+    ...networkFlags(),
     ...links.map((l) => `--allow-fs-read=${l}`),
     // Without the ones a broader grant already covers: a package reached by
     // its dependencies that is also in a node_modules granted for real.
@@ -189,6 +190,24 @@ export function permissionFlag() {
     : '--experimental-permission';
 }
 
+/**
+ * The network, granted where Node's permission model governs it: from
+ * Node 25 it refuses every socket without `--allow-net`, the renderer's own
+ * among them, and the flag is all or nothing. Node 22's model has no
+ * network rule, so there the flag is unknown and left out. On both,
+ * lockNetwork() closes the network from inside the child -- every
+ * connection, lookup and datagram, and every listen but the renderer's
+ * socket -- so the renderer reaches the same as on Node 22 (ADR 0176).
+ *
+ * @returns {string[]}
+ */
+export function networkFlags() {
+  // Node calls --allow-net experimental, and says so once per renderer.
+  return process.allowedNodeEnvironmentFlags.has('--allow-net')
+    ? ['--allow-net', '--disable-warning=ExperimentalWarning']
+    : [];
+}
+
 /**
  * The app's build directory is granted whole, so it must be a build
  * directory. Derived from the entry as its grandparent (dist/rsc/index.js
@@ -646,7 +665,9 @@ export const OPENS_NOTHING = Object.freeze({
 /**
  * Closes outbound networking from inside the sandboxed child.
  *
- * Node 22's permission model has no network flag, so a dependency could
+ * Node 22's permission model has no network flag, and from Node 25 the
+ * renderer is granted --allow-net to serve its socket (networkFlags()), so
+ * on either a dependency could
  * open a socket to the database, or to anywhere, and send what it read. This
  * replaces every function node:net, node:dgram and node:dns export but the
  * few that open nothing (OPENS_NOTHING) -- TCP and Unix-socket connects
@@ -671,6 +692,15 @@ export const OPENS_NOTHING = Object.freeze({
  *        may listen on; without one it may listen on nothing
  */
 export function lockNetwork({ net, dgram, dns, listenOn }) {
+  // Taken now, before any code the renderer loads runs: every original is
+  // called through these, never through a method looked up when it is
+  // called. A Function.prototype.call or apply swapped in later would be
+  // handed the original, and a WeakSet.prototype.has swapped in could
+  // answer yes for any handle (ADR 0176).
+  const apply = Reflect.apply;
+  const { has: weakHas, add: weakAdd } = WeakSet.prototype;
+  const isIn = (set, value) => apply(weakHas, set, [value]);
+  const putIn = (set, value) => apply(weakAdd, set, [value]);
   const refuse = (what) =>
     function refused() {
       const error = new Error(
@@ -703,8 +733,48 @@ export function lockNetwork({ net, dgram, dns, listenOn }) {
   // as the address for a socket file and null for a handle or descriptor.
   const listen = net.Server.prototype._listen2;
   const refuseListen = refuse('Listening anywhere but the renderer socket');
+
+  // The handle classes under net -- the Unix-socket one above all -- are
+  // reachable without a binding, as the constructor of a handle the
+  // process already holds: its standard input is a socket pair (the
+  // tether), and its own server's handle is one too. Their prototypes
+  // carry bind(), listen(), connect() and open(), which reach the network
+  // past everything above. So each one is held where it opens something:
+  // no connect and no open; a bind to the renderer's socket alone; and a
+  // listen only on the handle that bound it (ADR 0176).
+  const held = new WeakSet();
+  const bound = new WeakSet();
+  const hold = (Handle) => {
+    if (typeof Handle !== 'function' || isIn(held, Handle)) return;
+    putIn(held, Handle);
+    const proto = Handle.prototype;
+    for (const name of ['connect', 'connect6', 'open'])
+      if (typeof proto[name] === 'function') pin(proto, name, refuse(`A handle's ${name}()`));
+    for (const name of ['bind', 'bind6']) {
+      const original = proto[name];
+      if (typeof original !== 'function') continue;
+      pin(proto, name, function bindOwnSocket(address, ...rest) {
+        if (typeof listenOn !== 'string' || address !== listenOn) refuseListen();
+        const result = apply(original, this, [address, ...rest]);
+        putIn(bound, this);
+        return result;
+      });
+    }
+    const originalListen = proto.listen;
+    if (typeof originalListen === 'function')
+      pin(proto, 'listen', function listenOnBound(...args) {
+        if (!isIn(bound, this)) refuseListen();
+        return apply(originalListen, this, args);
+      });
+  };
+  // Made now, before their classes are held: Node makes each standard
+  // stream's handle on first use, with the open() held above.
+  for (const stream of [process.stdin, process.stdout, process.stderr]) hold(stream?._handle?.constructor);
+
   pin(net.Server.prototype, '_listen2', function listenOnOwnSocket(address, port, ...rest) {
     if (typeof listenOn !== 'string' || address !== listenOn || port !== -1) refuseListen();
-    return listen.call(this, address, port, ...rest);
+    const result = apply(listen, this, [address, port, ...rest]);
+    hold(this._handle?.constructor);
+    return result;
   });
 }