@withbuddi/buddi 0.1.0-pre.36 → 0.1.0-pre.37

package/node_modules/@buddi/gateway/dist/web/zip-read.js

@@ -0,0 +1,125 @@
+/**
+ * Reading a `.zip` the owner uploaded, without trusting it.
+ *
+ * Written here rather than with fflate's `unzipSync` because the checks a
+ * skill bundle needs live in the central directory, which that API does not
+ * show: the Unix mode (a symbolic link, an executable bit), the encryption
+ * flag, the declared sizes. Inflating goes through fflate's streaming
+ * `Inflate`, counted as it goes, so a member that inflates past what it
+ * declared — a zip bomb — stops at the first byte over.
+ */
+import { Inflate } from 'fflate';
+export class ZipFormatError extends Error {
+    name = 'ZipFormatError';
+}
+export class ZipLimitError extends Error {
+    name = 'ZipLimitError';
+}
+const EOCD = 0x06054b50;
+const CENTRAL = 0x02014b50;
+const LOCAL = 0x04034b50;
+/** The central directory, entry by entry. Throws `ZipFormatError` on anything that is not a plain zip. */
+export function readZipEntries(zip) {
+    const view = new DataView(zip.buffer, zip.byteOffset, zip.byteLength);
+    let end = -1;
+    for (let i = zip.length - 22; i >= Math.max(0, zip.length - 22 - 0xffff); i -= 1) {
+        if (view.getUint32(i, true) === EOCD) {
+            end = i;
+            break;
+        }
+    }
+    if (end < 0)
+        throw new ZipFormatError('It is not a zip file (no central directory).');
+    const count = view.getUint16(end + 10, true);
+    const cdSize = view.getUint32(end + 12, true);
+    const cdOffset = view.getUint32(end + 16, true);
+    if (count === 0xffff || cdOffset === 0xffffffff)
+        throw new ZipFormatError('It is a zip64 archive, which a skill bundle never needs.');
+    if (cdOffset + cdSize > zip.length)
+        throw new ZipFormatError('Its central directory runs past the end of the file.');
+    const entries = [];
+    const decoder = new TextDecoder('utf-8', { fatal: false });
+    let at = cdOffset;
+    for (let n = 0; n < count; n += 1) {
+        if (at + 46 > zip.length || view.getUint32(at, true) !== CENTRAL)
+            throw new ZipFormatError('Its central directory is damaged.');
+        const madeBy = view.getUint16(at + 4, true);
+        const flags = view.getUint16(at + 8, true);
+        const method = view.getUint16(at + 10, true);
+        const compressedSize = view.getUint32(at + 20, true);
+        const size = view.getUint32(at + 24, true);
+        const nameLength = view.getUint16(at + 28, true);
+        const extraLength = view.getUint16(at + 30, true);
+        const commentLength = view.getUint16(at + 32, true);
+        const external = view.getUint32(at + 38, true);
+        const offset = view.getUint32(at + 42, true);
+        if (at + 46 + nameLength > zip.length)
+            throw new ZipFormatError('Its central directory is damaged.');
+        const name = decoder.decode(zip.subarray(at + 46, at + 46 + nameLength));
+        const unix = madeBy >> 8 === 3 || madeBy >> 8 === 19;
+        const mode = unix ? (external >>> 16) & 0xffff : null;
+        entries.push({ name, directory: name.endsWith('/'), method, encrypted: (flags & 1) === 1, compressedSize, size, mode: mode === 0 ? null : mode, offset });
+        at += 46 + nameLength + extraLength + commentLength;
+    }
+    return entries;
+}
+/** The mode's file type is a symbolic link. */
+export function isSymlink(entry) {
+    return entry.mode !== null && (entry.mode & 0o170000) === 0o120000;
+}
+/** The mode has an executable bit, on a file. */
+export function isExecutableMode(entry) {
+    return !entry.directory && entry.mode !== null && (entry.mode & 0o170000) !== 0o040000 && (entry.mode & 0o111) !== 0;
+}
+/**
+ * One member's bytes. `limit` caps what it may inflate to (its declared size,
+ * and what is left of the bundle's allowance); one byte more is a `ZipLimitError`.
+ */
+export function readZipMember(zip, entry, limit) {
+    const view = new DataView(zip.buffer, zip.byteOffset, zip.byteLength);
+    if (entry.offset + 30 > zip.length || view.getUint32(entry.offset, true) !== LOCAL)
+        throw new ZipFormatError(`"${entry.name}" is damaged.`);
+    const nameLength = view.getUint16(entry.offset + 26, true);
+    const extraLength = view.getUint16(entry.offset + 28, true);
+    const start = entry.offset + 30 + nameLength + extraLength;
+    const data = zip.subarray(start, start + entry.compressedSize);
+    if (data.length !== entry.compressedSize)
+        throw new ZipFormatError(`"${entry.name}" runs past the end of the file.`);
+    const cap = Math.min(limit, entry.size);
+    if (entry.method === 0) {
+        if (data.length > cap)
+            throw new ZipLimitError(`"${entry.name}" is larger than it says.`);
+        return data.slice();
+    }
+    if (entry.method !== 8)
+        throw new ZipFormatError(`"${entry.name}" uses a compression buddi does not read (method ${entry.method}).`);
+    const chunks = [];
+    let total = 0;
+    let over = false;
+    const inflate = new Inflate((chunk) => {
+        total += chunk.length;
+        if (total > cap)
+            over = true;
+        else
+            chunks.push(chunk);
+    });
+    // Fed in slices, so a bomb is noticed after one slice's output, not after all of it.
+    const SLICE = 16 * 1024;
+    try {
+        for (let i = 0; i < data.length && !over; i += SLICE)
+            inflate.push(data.subarray(i, i + SLICE), i + SLICE >= data.length);
+    }
+    catch (err) {
+        throw new ZipFormatError(`"${entry.name}" could not be inflated: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (over)
+        throw new ZipLimitError(`"${entry.name}" inflates to more than it says (${entry.size} bytes).`);
+    const out = new Uint8Array(total);
+    let at = 0;
+    for (const c of chunks) {
+        out.set(c, at);
+        at += c.length;
+    }
+    return out;
+}
+//# sourceMappingURL=zip-read.js.map

package/node_modules/@buddi/gateway/dist/web/zip-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip-read.js","sourceRoot":"","sources":["../../src/web/zip-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAgBjC,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAG,gBAAgB,CAAC;CAC3C;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;CAC1C;AAED,MAAM,IAAI,GAAG,UAAU,CAAC;AACxB,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,KAAK,GAAG,UAAU,CAAC;AAEzB,0GAA0G;AAC1G,MAAM,UAAU,cAAc,CAAC,GAAe;IAC5C,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACrC,GAAG,GAAG,CAAC,CAAC;YACR,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,8CAA8C,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,MAAM,IAAI,QAAQ,KAAK,UAAU;QAAE,MAAM,IAAI,cAAc,CAAC,0DAA0D,CAAC,CAAC;IACtI,IAAI,QAAQ,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,sDAAsD,CAAC,CAAC;IACrH,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAI,EAAE,GAAG,QAAQ,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,mCAAmC,CAAC,CAAC;QAChI,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,mCAAmC,CAAC,CAAC;QACrG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1J,EAAE,IAAI,EAAE,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,SAAS,CAAC,KAA6B;IACrD,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,QAAQ,CAAC;AACrE,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,gBAAgB,CAAC,KAA2C;IAC1E,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;AACvH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAe,EAAE,KAAe,EAAE,KAAa;IAC3E,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC;IAC5I,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,UAAU,GAAG,WAAW,CAAC;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;QAAE,MAAM,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,kCAAkC,CAAC,CAAC;IACrH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,2BAA2B,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,oDAAoD,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IACrI,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACpC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,GAAG;YAAE,IAAI,GAAG,IAAI,CAAC;;YACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,qFAAqF;IACrF,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5H,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,oCAAoC,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}