@ttsc/playground 0.20.1 → 0.22.0

package/src/npm/installPlaygroundDependencies.ts

@@ -15,9 +15,13 @@ import {
   throwIfAborted,
   toTypesPackageName,
   unpackNpmTarball,
+  validateNpmByteLimit,
+  verifyTarball,
 } from "./internal/npmRegistry";
 
 const DEFAULT_MAX_PACKAGES = 48;
+const DEFAULT_MAX_TARBALL_BYTES = 16 * 1024 * 1024;
+const DEFAULT_MAX_UNPACKED_BYTES = 64 * 1024 * 1024;
 
 /**
  * Resolve, download, and unpack a set of npm packages directly inside the
@@ -72,6 +76,11 @@ export async function installPlaygroundDependencies(
     });
   }
   const maxPackages = options.maxPackages ?? DEFAULT_MAX_PACKAGES;
+  const maxTarballBytes = options.maxTarballBytes ?? DEFAULT_MAX_TARBALL_BYTES;
+  const maxUnpackedBytes =
+    options.maxUnpackedBytes ?? DEFAULT_MAX_UNPACKED_BYTES;
+  validateNpmByteLimit(maxTarballBytes, "compressed");
+  validateNpmByteLimit(maxUnpackedBytes, "expanded");
   const queue: IQueueItem[] = [];
   const queued = new Map<string, IQueueItem>();
   const done = new Map<string, string>();
@@ -190,12 +199,18 @@ export async function installPlaygroundDependencies(
     throwIfAborted(options.signal);
 
     report("resolve", item, `Resolving ${item.name}`);
-    const metadata = await fetchNpmMetadata(
-      fetchImpl,
-      item.registryName ?? item.name,
-      item.optional,
-      options.signal,
-    );
+    let metadata: Awaited<ReturnType<typeof fetchNpmMetadata>>;
+    try {
+      metadata = await fetchNpmMetadata(
+        fetchImpl,
+        item.registryName ?? item.name,
+        item.optional,
+        options.signal,
+      );
+    } catch (error) {
+      throwIfAborted(options.signal);
+      throw error;
+    }
     throwIfAborted(options.signal);
     if (!metadata) {
       const mounted = installedDependencies.get(item.name);
@@ -250,19 +265,30 @@ export async function installPlaygroundDependencies(
     const versionMetadata = metadata.versions[version];
     const tarball = versionMetadata?.dist?.tarball;
     if (!versionMetadata || !tarball) {
-      if (item.optional) {
-        done.set(item.name, "");
-        report("skip", item, `Skipped optional ${item.name}`);
-        continue;
-      }
       throw new Error(`No tarball found for ${item.name}@${version}.`);
     }
 
-    report("download", item, `Downloading ${item.name}@${version}`, version);
-    const tgz = await downloadTarball(fetchImpl, tarball, options.signal);
-    throwIfAborted(options.signal);
-    report("extract", item, `Extracting ${item.name}@${version}`, version);
-    const unpacked = await unpackNpmTarball(tgz, options.signal);
+    let unpacked: Awaited<ReturnType<typeof unpackNpmTarball>>;
+    try {
+      report("download", item, `Downloading ${item.name}@${version}`, version);
+      const tgz = await downloadTarball(
+        fetchImpl,
+        tarball,
+        options.signal,
+        maxTarballBytes,
+      );
+      throwIfAborted(options.signal);
+      await verifyTarball(tgz, versionMetadata.dist ?? {}, options.signal);
+      throwIfAborted(options.signal);
+      report("extract", item, `Extracting ${item.name}@${version}`, version);
+      unpacked = await unpackNpmTarball(tgz, options.signal, maxUnpackedBytes);
+    } catch (error) {
+      throwIfAborted(options.signal);
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`Failed to install ${item.name}@${version}: ${message}`, {
+        cause: error,
+      });
+    }
     throwIfAborted(options.signal);
     const packageJson = {
       ...versionMetadata,

package/src/npm/internal/npmRegistry.ts

@@ -22,6 +22,8 @@ export interface INpmVersionMetadata {
   peerDependencies?: Record<string, string>;
   peerDependenciesMeta?: Record<string, { optional?: boolean }>;
   dist?: {
+    integrity?: string;
+    shasum?: string;
     tarball?: string;
   };
 }
@@ -57,6 +59,11 @@ export type FetchLike = (
   init?: RequestInit,
 ) => Promise<Response>;
 
+declare const VALIDATED_NPM_BYTE_LIMIT: unique symbol;
+type ValidatedNpmByteLimit = number & {
+  readonly [VALIDATED_NPM_BYTE_LIMIT]: true;
+};
+
 const TEXT_FILE_REGEXP =
   /(^package\.json$|\.([cm]?js|jsx|[cm]?ts|tsx|json)$|\.d\.[cm]?ts$)/i;
 export const DECLARATION_FILE_REGEXP = /\.d\.[cm]?ts$/i;
@@ -74,22 +81,38 @@ export async function fetchNpmMetadata(
   optional: boolean,
   signal: AbortSignal | undefined,
 ): Promise<INpmMetadata | null> {
-  const response = await fetchImpl(
-    `https://registry.npmjs.org/${encodeURIComponent(packageName)}`,
-    {
-      headers: {
-        Accept: "application/vnd.npm.install-v1+json, application/json",
-      },
-      signal,
-    },
+  throwIfAborted(signal);
+  const response = await fetchWithAbort(
+    () =>
+      fetchImpl(
+        `https://registry.npmjs.org/${encodeURIComponent(packageName)}`,
+        {
+          headers: {
+            Accept: "application/vnd.npm.install-v1+json, application/json",
+          },
+          signal,
+        },
+      ),
+    signal,
   );
-  if (response.status === 404 && optional) return null;
+  throwIfResponseAborted(response, signal);
+  if (response.status === 404 && optional) {
+    cancelResponseBody(response);
+    return null;
+  }
   if (!response.ok) {
+    cancelResponseBody(response);
     throw new Error(
       `npm registry returned ${response.status} while resolving ${packageName}.`,
     );
   }
-  return (await response.json()) as INpmMetadata;
+  throwIfAborted(signal);
+  const metadata = (await abortable(
+    () => response.json() as Promise<INpmMetadata>,
+    signal,
+  )) as INpmMetadata;
+  throwIfAborted(signal);
+  return metadata;
 }
 
 export function selectVersion(
@@ -135,20 +158,87 @@ export async function downloadTarball(
   fetchImpl: FetchLike,
   tarball: string,
   signal: AbortSignal | undefined,
+  maxBytes = 16 * 1024 * 1024,
 ): Promise<ArrayBuffer> {
-  const response = await fetchImpl(tarball, { signal });
+  throwIfAborted(signal);
+  const byteLimit = validateNpmByteLimit(maxBytes, "compressed");
+  const response = await fetchWithAbort(
+    () => fetchImpl(tarball, { signal }),
+    signal,
+  );
+  throwIfResponseAborted(response, signal);
   if (!response.ok) {
+    cancelResponseBody(response);
     throw new Error(`tarball download failed with HTTP ${response.status}.`);
   }
-  return response.arrayBuffer();
+  const declaredLength = response.headers.get("content-length");
+  if (declaredLength !== null) {
+    const parsed = Number(declaredLength);
+    if (Number.isFinite(parsed) && parsed >= 0 && parsed > byteLimit) {
+      cancelResponseBody(response);
+      throw new Error(
+        `tarball exceeds the ${formatByteLimit(byteLimit)} compressed byte limit.`,
+      );
+    }
+  }
+  return collectBoundedStream(
+    response.body,
+    byteLimit,
+    "compressed",
+    signal,
+    () => response.arrayBuffer(),
+  );
+}
+
+/** Verify registry authentication metadata against the compressed bytes. */
+export async function verifyTarball(
+  tgz: ArrayBuffer,
+  dist: { integrity?: string; shasum?: string },
+  signal: AbortSignal | undefined,
+): Promise<void> {
+  throwIfAborted(signal);
+  if (dist.integrity !== undefined) {
+    const candidates = parseIntegrity(dist.integrity);
+    const strength = Math.max(...candidates.map(({ rank }) => rank));
+    const strongest = candidates.filter(
+      (candidate) => candidate.rank === strength,
+    );
+    const actual = new Uint8Array(
+      await abortable(
+        () => crypto.subtle.digest(strongest[0]!.webAlgorithm, tgz),
+        signal,
+      ),
+    );
+    throwIfAborted(signal);
+    if (!strongest.some(({ digest }) => equalBytes(actual, digest))) {
+      throw new Error(
+        `tarball integrity mismatch (${strongest[0]!.algorithm}).`,
+      );
+    }
+    return;
+  }
+  if (dist.shasum !== undefined) {
+    if (!/^[a-fA-F0-9]{40}$/.test(dist.shasum)) {
+      throw new Error("tarball shasum is not a valid SHA-1 digest.");
+    }
+    const actual = new Uint8Array(
+      await abortable(() => crypto.subtle.digest("SHA-1", tgz), signal),
+    );
+    throwIfAborted(signal);
+    if (!equalBytes(actual, decodeHex(dist.shasum))) {
+      throw new Error("tarball shasum mismatch (sha1).");
+    }
+  }
 }
 
 export async function unpackNpmTarball(
   tgz: ArrayBuffer,
   signal: AbortSignal | undefined,
+  maxBytes = 64 * 1024 * 1024,
 ): Promise<IUnpackedPackage> {
   throwIfAborted(signal);
-  const tar = await gunzip(tgz);
+  const byteLimit = validateNpmByteLimit(maxBytes, "expanded");
+  const tar = await gunzip(tgz, byteLimit, signal);
   throwIfAborted(signal);
   const decoder = new TextDecoder();
   const files: Record<string, string> = {};
@@ -156,24 +246,47 @@ export async function unpackNpmTarball(
   let offset = 0;
   let longPath: string | null = null;
   let paxPath: string | null = null;
+  let terminated = false;
+  let archiveRoot: string | null = null;
+
+  const confine = (rawPath: string): string => {
+    const confined = confineTarPath(rawPath, archiveRoot);
+    archiveRoot = confined.root;
+    return confined.relative;
+  };
 
-  while (offset + 512 <= tar.length) {
+  while (offset < tar.length) {
     throwIfAborted(signal);
+    if (offset + 512 > tar.length) {
+      throw new Error("Truncated tar header.");
+    }
     const header = tar.subarray(offset, offset + 512);
     offset += 512;
-    if (header.every((value) => value === 0)) break;
+    if (header.every((value) => value === 0)) {
+      terminated = true;
+      break;
+    }
 
     const type = String.fromCharCode(header[156] ?? 0);
     const size = parseOctal(header.subarray(124, 136));
+    if (size > tar.length - offset) {
+      throw new Error("Tar entry body extends beyond the archive.");
+    }
     const body = tar.subarray(offset, offset + size);
-    offset += Math.ceil(size / 512) * 512;
+    const paddedSize = Math.ceil(size / 512) * 512;
+    if (!Number.isSafeInteger(paddedSize) || paddedSize > tar.length - offset) {
+      throw new Error("Tar entry padding extends beyond the archive.");
+    }
+    offset += paddedSize;
 
     if (type === "L") {
       longPath = trimNull(decoder.decode(body));
+      confine(longPath);
       continue;
     }
     if (type === "x") {
       paxPath = parsePaxPath(body);
+      if (paxPath !== null) confine(paxPath);
       continue;
     }
     if (type !== "0" && type !== "\0") {
@@ -182,12 +295,11 @@ export async function unpackNpmTarball(
       continue;
     }
 
-    const rawPath =
-      paxPath ?? longPath ?? readTarString(header.subarray(0, 100), decoder);
+    const rawPath = paxPath ?? longPath ?? readTarHeaderPath(header, decoder);
     longPath = null;
     paxPath = null;
-    const rel = stripTarRoot(rawPath);
-    if (!rel || !TEXT_FILE_REGEXP.test(rel)) continue;
+    const rel = confine(rawPath);
+    if (!TEXT_FILE_REGEXP.test(rel)) continue;
 
     const text = decoder.decode(body);
     files[rel] = text;
@@ -199,11 +311,16 @@ export async function unpackNpmTarball(
       }
     }
   }
+  if (!terminated) throw new Error("Tar archive has no end marker.");
 
   return { files, packageJson };
 }
 
-async function gunzip(input: ArrayBuffer): Promise<Uint8Array> {
+async function gunzip(
+  input: ArrayBuffer,
+  maxBytes: ValidatedNpmByteLimit,
+  signal: AbortSignal | undefined,
+): Promise<Uint8Array> {
   if (!("DecompressionStream" in globalThis)) {
     throw new Error(
       "This browser cannot unpack npm tgz files because DecompressionStream is unavailable.",
@@ -212,7 +329,11 @@ async function gunzip(input: ArrayBuffer): Promise<Uint8Array> {
   const stream = new Blob([input])
     .stream()
     .pipeThrough(new DecompressionStream("gzip"));
-  return new Uint8Array(await new Response(stream).arrayBuffer());
+  return new Uint8Array(
+    await collectBoundedStream(stream, maxBytes, "expanded", signal, async () =>
+      new Response(stream).arrayBuffer(),
+    ),
+  );
 }
 
 export interface IMountedFiles {
@@ -307,12 +428,18 @@ function readTarString(bytes: Uint8Array, decoder: TextDecoder): string {
 
 function trimNull(text: string): string {
   const index = text.indexOf("\0");
-  return (index < 0 ? text : text.slice(0, index)).trim();
+  return index < 0 ? text : text.slice(0, index);
 }
 
 function parseOctal(bytes: Uint8Array): number {
   const text = trimNull(new TextDecoder().decode(bytes)).trim();
-  return text ? Number.parseInt(text, 8) : 0;
+  if (text.length === 0) return 0;
+  if (!/^[0-7]+$/.test(text)) throw new Error("Invalid tar entry size.");
+  const value = Number.parseInt(text, 8);
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error("Tar entry size is outside the safe integer range.");
+  }
+  return value;
 }
 
 function parsePaxPath(bytes: Uint8Array): string | null {
@@ -343,11 +470,284 @@ function parsePaxPath(bytes: Uint8Array): string | null {
   return path;
 }
 
-function stripTarRoot(path: string): string {
-  const normalized = path.replace(/\\/g, "/").replace(/^\/+/, "");
-  if (!normalized) return "";
-  if (normalized.startsWith("package/"))
-    return normalized.slice("package/".length);
-  const slash = normalized.indexOf("/");
-  return slash < 0 ? normalized : normalized.slice(slash + 1);
+function readTarHeaderPath(header: Uint8Array, decoder: TextDecoder): string {
+  const name = readTarString(header.subarray(0, 100), decoder);
+  const prefix = readTarString(header.subarray(345, 500), decoder);
+  return prefix ? `${prefix}/${name}` : name;
+}
+
+/**
+ * Require an npm archive path below one safe, consistent top-level root.
+ *
+ * Npm normally emits `package/`, while current DefinitelyTyped tarballs use
+ * roots such as `node/` and `react/`. The root spelling does not enter the
+ * mounted key; consistency and safe remaining segments provide confinement.
+ */
+function confineTarPath(
+  rawPath: string,
+  archiveRoot: string | null,
+): { relative: string; root: string } {
+  if (
+    rawPath.length === 0 ||
+    rawPath.includes("\\") ||
+    rawPath.startsWith("/") ||
+    /^[a-zA-Z]:/.test(rawPath)
+  ) {
+    throw new Error(`Invalid npm tar entry path ${JSON.stringify(rawPath)}.`);
+  }
+  const segments = rawPath.split("/");
+  if (
+    segments.length < 2 ||
+    segments.some(
+      (segment, index) =>
+        segment.length === 0 ||
+        segment === "." ||
+        segment === ".." ||
+        (index > 0 && /^[a-zA-Z]:/.test(segment)),
+    )
+  ) {
+    throw new Error(
+      `npm tar entry is outside a confined package root: ${JSON.stringify(rawPath)}.`,
+    );
+  }
+  const root = segments[0]!;
+  if (archiveRoot !== null && root !== archiveRoot) {
+    throw new Error(
+      `npm tar archive mixes package roots ${JSON.stringify(archiveRoot)} and ${JSON.stringify(root)}.`,
+    );
+  }
+  return { relative: segments.slice(1).join("/"), root };
+}
+
+interface IIntegrityCandidate {
+  algorithm: string;
+  digest: Uint8Array;
+  rank: number;
+  webAlgorithm: AlgorithmIdentifier;
+}
+
+function parseIntegrity(integrity: string): IIntegrityCandidate[] {
+  const tokens = integrity.trim().split(/\s+/).filter(Boolean);
+  if (tokens.length === 0) throw new Error("tarball integrity is empty.");
+  const candidates: IIntegrityCandidate[] = [];
+  for (const token of tokens) {
+    const match = /^([A-Za-z0-9]+)-([A-Za-z0-9+/]+={0,2})(?:\?[!-~]+)?$/i.exec(
+      token,
+    );
+    if (!match) {
+      throw new Error("tarball integrity contains malformed metadata.");
+    }
+    const algorithm = match[1]!.toLowerCase();
+    if (!["sha1", "sha256", "sha384", "sha512"].includes(algorithm)) {
+      decodeBase64(match[2]!);
+      continue;
+    }
+    const expectedLength =
+      algorithm === "sha512"
+        ? 64
+        : algorithm === "sha384"
+          ? 48
+          : algorithm === "sha256"
+            ? 32
+            : 20;
+    const digest = decodeBase64(match[2]!);
+    if (digest.length !== expectedLength) {
+      throw new Error("tarball integrity contains a malformed digest.");
+    }
+    candidates.push({
+      algorithm,
+      digest,
+      rank: expectedLength,
+      webAlgorithm: algorithm.replace("sha", "SHA-") as AlgorithmIdentifier,
+    });
+  }
+  if (candidates.length === 0) {
+    throw new Error("tarball integrity has no supported digest algorithm.");
+  }
+  return candidates;
+}
+
+function decodeBase64(value: string): Uint8Array {
+  try {
+    const decoded = atob(value);
+    return Uint8Array.from(decoded, (character) => character.charCodeAt(0));
+  } catch {
+    throw new Error("tarball integrity contains malformed base64.");
+  }
+}
+
+function decodeHex(value: string): Uint8Array {
+  return Uint8Array.from(value.match(/../g) ?? [], (byte) =>
+    Number.parseInt(byte, 16),
+  );
+}
+
+function equalBytes(left: Uint8Array, right: Uint8Array): boolean {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; ++index) {
+    difference |= left[index]! ^ right[index]!;
+  }
+  return difference === 0;
+}
+
+async function collectBoundedStream(
+  stream: ReadableStream<Uint8Array> | null,
+  maxBytes: ValidatedNpmByteLimit,
+  kind: "compressed" | "expanded",
+  signal: AbortSignal | undefined,
+  fallback: () => Promise<ArrayBuffer>,
+): Promise<ArrayBuffer> {
+  if (stream === null) {
+    throwIfAborted(signal);
+    const bytes = await abortable(fallback, signal);
+    throwIfAborted(signal);
+    if (bytes.byteLength > maxBytes) {
+      throw new Error(
+        `tarball exceeds the ${formatByteLimit(maxBytes)} ${kind} byte limit.`,
+      );
+    }
+    return bytes;
+  }
+  const reader = stream.getReader();
+  const chunks: Uint8Array[] = [];
+  let length = 0;
+  let abort: (() => void) | undefined;
+  const aborted =
+    signal === undefined
+      ? undefined
+      : new Promise<never>((_resolve, reject) => {
+          abort = () => {
+            let error: unknown;
+            try {
+              throwIfAborted(signal);
+              return;
+            } catch (caught) {
+              error = caught;
+            }
+            void reader.cancel(error).catch(() => undefined);
+            reject(error);
+          };
+          signal.addEventListener("abort", abort, { once: true });
+        });
+  try {
+    for (;;) {
+      throwIfAborted(signal);
+      const read = reader.read();
+      const next = aborted ? await Promise.race([read, aborted]) : await read;
+      throwIfAborted(signal);
+      if (next.done) break;
+      if (next.value.byteLength > maxBytes - length) {
+        void reader.cancel().catch(() => undefined);
+        throw new Error(
+          `tarball exceeds the ${formatByteLimit(maxBytes)} ${kind} byte limit.`,
+        );
+      }
+      chunks.push(next.value);
+      length += next.value.byteLength;
+    }
+  } catch (error) {
+    void reader.cancel(error).catch(() => undefined);
+    throw error;
+  } finally {
+    if (abort !== undefined) signal?.removeEventListener("abort", abort);
+  }
+  const output = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    output.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return output.buffer;
+}
+
+function formatByteLimit(bytes: number): string {
+  return `${bytes.toLocaleString("en-US")}-byte`;
+}
+
+/** Validate one public npm archive byte budget before starting related work. */
+export function validateNpmByteLimit(
+  maxBytes: number,
+  kind: "compressed" | "expanded",
+): ValidatedNpmByteLimit {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new Error(`${kind} byte limit must be a positive safe integer.`);
+  }
+  return maxBytes as ValidatedNpmByteLimit;
+}
+
+/**
+ * Reject promptly on abort even when an underlying browser task is not
+ * cancellable.
+ */
+function abortable<T>(
+  start: () => Promise<T>,
+  signal: AbortSignal | undefined,
+  disposeLateValue?: (value: T) => void,
+): Promise<T> {
+  throwIfAborted(signal);
+  let task: Promise<T>;
+  try {
+    task = start();
+  } catch (error) {
+    throwIfAborted(signal);
+    throw error;
+  }
+  if (signal === undefined) return task;
+  return new Promise<T>((resolve, reject) => {
+    let aborted = false;
+    const abort = () => {
+      if (aborted) return;
+      aborted = true;
+      signal.removeEventListener("abort", abort);
+      try {
+        throwIfAborted(signal);
+      } catch (error) {
+        reject(error);
+      }
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    void task
+      .then((value) => {
+        if (signal.aborted) {
+          try {
+            disposeLateValue?.(value);
+          } catch {
+            // Disposal is best-effort and must not replace the abort reason.
+          }
+          abort();
+          return;
+        }
+        resolve(value);
+      }, reject)
+      .finally(() => {
+        signal.removeEventListener("abort", abort);
+      });
+    if (signal.aborted) abort();
+  });
+}
+
+/** Cancel an unused response body without obscuring the deciding outcome. */
+function cancelResponseBody(response: Response): void {
+  void response.body?.cancel().catch(() => undefined);
+}
+
+/** Preserve the abort reason across the response-to-caller handoff. */
+function throwIfResponseAborted(
+  response: Response,
+  signal: AbortSignal | undefined,
+): void {
+  if (!signal?.aborted) return;
+  cancelResponseBody(response);
+  throwIfAborted(signal);
+}
+
+/** Fetch one response and cancel any body that loses the abort race. */
+async function fetchWithAbort(
+  start: () => Promise<Response>,
+  signal: AbortSignal | undefined,
+): Promise<Response> {
+  const response = await abortable(start, signal, cancelResponseBody);
+  throwIfResponseAborted(response, signal);
+  return response;
 }