capnweb 0.9.0 → 0.10.0

package/README.md

@@ -405,6 +405,8 @@ If anything happens to the stub that would cause all further method calls and pr
 
 * Cap'n Web's pipelining can make it easy for a malicious client to enqueue a large amount of work to occur on a server. To mitigate this, we recommend implementing rate limits on expensive operations. If using Cloudflare Workers, you may also consider configuring [per-request CPU limits](https://developers.cloudflare.com/workers/wrangler/configuration/#limits) to be lower than the default 30s. Note that in stateless Workers (i.e. not Durable Objects), the system considers an entire WebSocket session to be one "request" for CPU limits purposes.
 
+* Cap'n Web applies receiver-side resource limits before expensive message processing, including a maximum incoming message size before `JSON.parse`. If your app is exposed to untrusted peers, also configure native transport or socket payload limits where available, such as `ws`'s `maxPayload`, Bun's `maxPayloadLength`, or the runtime's built-in WebSocket cap. Cap'n Web's own check runs after `RpcTransport.receive()` has returned a complete message string, so transport-level limits are still the first line of defense against buffering very large frames.
+
 * Cap'n Web currently does not provide any runtime type checking. When using TypeScript, keep in mind that types are checked only at compile time. A malicious client can send types you did not expect, and this could cause you application to behave in unexpected ways. For example, MongoDB uses special property names to express queries; placing attacker-provided values directly into queries can result in query injection vulnerabilities (similar to SQL injection). Of course, JSON has always had the same problem, and there exists tooling to solve it. You might consider using a runtime type-checking framework like Zod to check your inputs. In the future, we hope to explore auto-generating type-checking code based on TypeScript types.
 
 ## Setting up a session

package/dist/index-bun.cjs

@@ -931,6 +931,12 @@ var PromiseStubHook = class PromiseStubHook extends StubHook {
 
 //#endregion
 //#region src/serialize.ts
+const DEFAULT_MAX_DEPTH = 256;
+const DEFAULT_LIMITS = {
+	maxBigIntDigits: 16384,
+	maxDepth: 256,
+	maxMessageSize: 32 * 1024 * 1024
+};
 var NullExporter = class {
 	exportStub(stub) {
 		throw new Error("Cannot serialize RPC stubs without an RPC session.");
@@ -950,7 +956,7 @@ async function streamToBlob(stream, type) {
 	let b = await new Response(stream).blob();
 	return b.type === type ? b : b.slice(0, b.size, type);
 }
-const ERROR_TYPES = {
+const ERROR_TYPES = Object.assign(Object.create(null), {
 	Error,
 	EvalError,
 	RangeError,
@@ -959,7 +965,7 @@ const ERROR_TYPES = {
 	TypeError,
 	URIError,
 	AggregateError
-};
+});
 var Devaluator = class Devaluator {
 	exporter;
 	source;
@@ -982,7 +988,7 @@ var Devaluator = class Devaluator {
 	}
 	exports;
 	devaluateImpl(value, parent, depth) {
-		if (depth >= 64) throw new Error("Serialization exceeded maximum allowed depth. (Does the message contain cycles?)");
+		if (depth >= 256) throw new Error("Serialization exceeded maximum allowed depth. (Does the message contain cycles?)");
 		switch (typeForRpc(value)) {
 			case "unsupported": {
 				let msg;
@@ -1216,6 +1222,9 @@ var NullImporter = class {
 	getPipeReadable(exportId) {
 		throw new Error("Cannot retrieve pipe readable without an RPC session.");
 	}
+	getLimits() {
+		return DEFAULT_LIMITS;
+	}
 };
 const NULL_IMPORTER = new NullImporter();
 function fixBrokenRequestBody(request, body) {
@@ -1233,16 +1242,21 @@ function streamToBlobPromise(stream, type) {
 var Evaluator = class Evaluator {
 	importer;
 	encodingLevel;
+	limits;
 	constructor(importer, encodingLevel = "string") {
 		this.importer = importer;
 		this.encodingLevel = encodingLevel;
+		this.limits = importer.getLimits();
 	}
 	hooks = [];
 	promises = [];
 	evaluate(value) {
+		return this.evaluateWithDepth(value, 0);
+	}
+	evaluateWithDepth(value, depth) {
 		let payload = RpcPayload.forEvaluate(this.hooks, this.promises);
 		try {
-			payload.value = this.evaluateImpl(value, payload, "value");
+			payload.value = this.evaluateImpl(value, payload, "value", depth);
 			return payload;
 		} catch (err) {
 			payload.dispose();
@@ -1252,18 +1266,25 @@ var Evaluator = class Evaluator {
 	evaluateCopy(value) {
 		return this.evaluate(structuredClone(value));
 	}
-	evaluateImpl(value, parent, property) {
+	evaluateImpl(value, parent, property, depth) {
+		let maxDepth = this.limits.maxDepth;
+		if (depth >= maxDepth) throw new TypeError(`Deserialization exceeded maximum allowed message depth of ${maxDepth}.`);
 		if (this.encodingLevel === "structuredClonable") {
 			if (value instanceof Date || typeof value === "bigint") return value;
 		}
 		if (value instanceof Array) {
 			if (value.length == 1 && value[0] instanceof Array) {
 				let result = value[0];
-				for (let i = 0; i < result.length; i++) result[i] = this.evaluateImpl(result[i], result, i);
+				for (let i = 0; i < result.length; i++) result[i] = this.evaluateImpl(result[i], result, i, depth + 1);
 				return result;
 			} else switch (value[0]) {
 				case "bigint":
-					if (typeof value[1] == "string") return BigInt(value[1]);
+					if (typeof value[1] == "string") {
+						let digits = value[1];
+						let maxBigIntDigits = this.limits.maxBigIntDigits;
+						if (digits.length > maxBigIntDigits) throw new TypeError(`Deserialized bigint exceeds maximum length of ${maxBigIntDigits} digits.`);
+						return BigInt(digits);
+					}
 					break;
 				case "date":
 					if (value[1] === null) return /* @__PURE__ */ new Date(NaN);
@@ -1293,7 +1314,11 @@ var Evaluator = class Evaluator {
 							let propsObj = props;
 							for (let key of Object.keys(propsObj)) {
 								if (key === "name" || key === "message" || key === "stack") continue;
-								anyResult[key] = this.evaluateImpl(propsObj[key], result, key);
+								if (key in Object.prototype || key === "toJSON") {
+									this.evaluateImpl(propsObj[key], result, key, depth + 1);
+									continue;
+								}
+								anyResult[key] = this.evaluateImpl(propsObj[key], result, key, depth + 1);
 							}
 						}
 						return result;
@@ -1314,11 +1339,11 @@ var Evaluator = class Evaluator {
 					let init = value[2];
 					if (typeof init !== "object" || init === null) break;
 					if (init.body) {
-						init.body = this.evaluateImpl(init.body, init, "body");
+						init.body = this.evaluateImpl(init.body, init, "body", depth + 1);
 						if (init.body === null || typeof init.body === "string" || init.body instanceof Uint8Array || init.body instanceof ReadableStream) {} else throw new TypeError("Request body must be of type ReadableStream.");
 					}
 					if (init.signal) {
-						init.signal = this.evaluateImpl(init.signal, init, "signal");
+						init.signal = this.evaluateImpl(init.signal, init, "signal", depth + 1);
 						if (!(init.signal instanceof AbortSignal)) throw new TypeError("Request siganl must be of type AbortSignal.");
 					}
 					if (init.headers && !(init.headers instanceof Array)) throw new TypeError("Request headers must be serialized as an array of pairs.");
@@ -1335,7 +1360,7 @@ var Evaluator = class Evaluator {
 				}
 				case "response": {
 					if (value.length !== 3) break;
-					let body = this.evaluateImpl(value[1], parent, property);
+					let body = this.evaluateImpl(value[1], parent, property, depth + 1);
 					if (body === null || typeof body === "string" || body instanceof Uint8Array || body instanceof ReadableStream) {} else throw new TypeError("Response body must be of type ReadableStream.");
 					let init = value[2];
 					if (typeof init !== "object" || init === null) break;
@@ -1346,7 +1371,7 @@ var Evaluator = class Evaluator {
 				case "blob": {
 					if (value.length !== 3 || typeof value[1] !== "string") break;
 					let contentType = value[1];
-					let content = this.evaluateImpl(value[2], parent, property);
+					let content = this.evaluateImpl(value[2], parent, property, depth + 1);
 					if (!(content instanceof ReadableStream)) throw new TypeError("Blob content must be serialized as a ReadableStream.");
 					let promise = streamToBlobPromise(content, contentType);
 					this.promises.push({
@@ -1387,7 +1412,7 @@ var Evaluator = class Evaluator {
 					if (value.length == 3) return addStub(hook.get(path));
 					let args = value[3];
 					if (!(args instanceof Array)) break;
-					args = new Evaluator(this.importer).evaluate([args]);
+					args = new Evaluator(this.importer).evaluateWithDepth([args], depth);
 					return addStub(hook.call(path, args));
 				}
 				case "remap": {
@@ -1453,9 +1478,9 @@ var Evaluator = class Evaluator {
 		} else if (value instanceof Object) {
 			let result = value;
 			for (let key in result) if (key in Object.prototype || key === "toJSON") {
-				this.evaluateImpl(result[key], result, key);
+				this.evaluateImpl(result[key], result, key, depth + 1);
 				delete result[key];
-			} else result[key] = this.evaluateImpl(result[key], result, key);
+			} else result[key] = this.evaluateImpl(result[key], result, key, depth + 1);
 			return result;
 		} else return value;
 	}
@@ -1526,6 +1551,10 @@ var ImportTableEntry = class {
 	resolution;
 	onBrokenRegistrations;
 	resolve(resolution) {
+		if (this.resolution) {
+			resolution.dispose();
+			return;
+		}
 		if (this.localRefcount == 0) {
 			resolution.dispose();
 			return;
@@ -1678,6 +1707,7 @@ var RpcSessionImpl = class {
 	pullCount = 0;
 	onBrokenCallbacks = [];
 	encodingLevel;
+	limits;
 	constructor(transport, mainHook, options) {
 		this.transport = transport;
 		this.options = options;
@@ -1690,6 +1720,10 @@ var RpcSessionImpl = class {
 			}
 		}
 		this.encodingLevel = level;
+		this.limits = {
+			...DEFAULT_LIMITS,
+			...options.limits
+		};
 		this.exports.push({
 			hook: mainHook,
 			refcount: 1
@@ -1832,6 +1866,9 @@ var RpcSessionImpl = class {
 		entry.pipeReadable = void 0;
 		return readable;
 	}
+	getLimits() {
+		return this.limits;
+	}
 	createPipe(readable, readableHook) {
 		if (this.abortReason) throw this.abortReason;
 		this.send(["pipe"]);
@@ -1991,6 +2028,7 @@ var RpcSessionImpl = class {
 			} finally {
 				if (this.cancelReadLoop === readCanceled.reject) this.cancelReadLoop = void 0;
 			}
+			if (this.encodingLevel === "string" && raw.length > this.limits.maxMessageSize) throw new TypeError(`Incoming message exceeds maximum size of ${this.limits.maxMessageSize} UTF-16 code units.`);
 			if (this.abortReason) break;
 			let msg = this.encodingLevel === "string" ? JSON.parse(raw) : raw;
 			if (msg instanceof Array) switch (msg[0]) {
@@ -2065,7 +2103,7 @@ var RpcSessionImpl = class {
 				case "abort": {
 					let payload = new Evaluator(this, this.encodingLevel).evaluate(msg[1]);
 					payload.dispose();
-					this.abort(payload, false);
+					this.abort(payload.value, false);
 					break;
 				}
 			}
@@ -2191,6 +2229,8 @@ var WebSocketTransport = class {
 		let message;
 		if (reason instanceof Error) message = reason.message;
 		else message = `${reason}`;
+		let reasonBytes = new TextEncoder().encode(message);
+		if (reasonBytes.length > 123) message = new TextDecoder().decode(reasonBytes.subarray(0, 123), { stream: true });
 		this.#webSocket.close(3e3, message);
 		if (!this.#error) this.#error = reason;
 	}
@@ -2307,7 +2347,11 @@ async function newHttpBatchRpcResponse(request, localMain, options) {
 * @param options Optional RPC session options. You can also pass headers to set on the response.
 */
 async function nodeHttpBatchRpcResponse(request, response, localMain, options) {
-	if (request.method !== "POST") response.writeHead(405, "This endpoint only accepts POST requests.");
+	if (request.method !== "POST") {
+		response.writeHead(405, "This endpoint only accepts POST requests.", options?.headers);
+		response.end();
+		return;
+	}
 	let body = await new Promise((resolve, reject) => {
 		let chunks = [];
 		request.on("data", (chunk) => {
@@ -2572,6 +2616,9 @@ var MapApplicator = class {
 	getPipeReadable(exportId) {
 		throw new Error("A mapper function cannot use pipe readables.");
 	}
+	getLimits() {
+		return DEFAULT_LIMITS;
+	}
 };
 function applyMapToElement(input, parent, owner, captures, instructions) {
 	let mapper = new MapApplicator(captures, new PayloadStubHook(RpcPayload.deepCopyFrom(input, parent, owner)));
@@ -2910,12 +2957,12 @@ let newMessagePortRpcSession = newMessagePortRpcSession$1;
 * credentials as parameters and returns the authorized API), then cross-origin requests should
 * be safe.
 */
-async function newWorkersRpcResponse(request, localMain) {
+async function newWorkersRpcResponse(request, localMain, options) {
 	if (request.method === "POST") {
-		let response = await newHttpBatchRpcResponse(request, localMain);
+		let response = await newHttpBatchRpcResponse(request, localMain, options);
 		response.headers.set("Access-Control-Allow-Origin", "*");
 		return response;
-	} else if (request.headers.get("Upgrade")?.toLowerCase() === "websocket") return newWorkersWebSocketRpcResponse(request, localMain);
+	} else if (request.headers.get("Upgrade")?.toLowerCase() === "websocket") return newWorkersWebSocketRpcResponse(request, localMain, options);
 	else return new Response("This endpoint only accepts POST or WebSocket requests.", { status: 400 });
 }
 
@@ -3037,6 +3084,8 @@ let newBunWebSocketRpcSession = newBunWebSocketRpcSession$1;
 
 //#endregion
 exports.BunWebSocketTransport = BunWebSocketTransport;
+exports.DEFAULT_LIMITS = DEFAULT_LIMITS;
+exports.DEFAULT_MAX_DEPTH = DEFAULT_MAX_DEPTH;
 exports.RpcPromise = RpcPromise;
 exports.RpcSession = RpcSession;
 exports.RpcStub = RpcStub;