capnweb 0.9.1 → 0.10.0

package/dist/index-workers.d.cts

@@ -126,6 +126,13 @@ type Provider<T> = MaybeCallableProvider<T> & (T extends ReadonlyArray<unknown>
  * ```
  */
 type EncodingLevel = "string" | "jsonCompatible" | "jsonCompatibleWithBytes" | "structuredClonable";
+interface RpcLimits {
+  maxBigIntDigits: number;
+  maxDepth: number;
+  maxMessageSize: number;
+}
+declare const DEFAULT_MAX_DEPTH = 256;
+declare const DEFAULT_LIMITS: RpcLimits;
 /**
  * Serialize a value, using Cap'n Web's underlying serialization. This won't be able to serialize
  * RPC stubs, but it will support basic data types.
@@ -227,6 +234,16 @@ type RpcSessionOptions = {
    * to serialize the error with the stack omitted.
    */
   onSendError?: (error: Error) => Error | void;
+  /**
+   * Overrides for the resource limits enforced while deserializing messages from the peer. Any
+   * field left unset falls back to `DEFAULT_LIMITS`. These guard against resource-exhaustion
+   * attacks from untrusted peers; see `RpcLimits` for the meaning and defaults of each field.
+   *
+   * Limits are a purely local, receiver-side decision -- the protocol has no negotiation step, so
+   * the peer never learns these values. A message that exceeds a limit is rejected, aborting the
+   * session.
+   */
+  limits?: Partial<RpcLimits>;
 };
 //#endregion
 //#region src/websocket.d.ts
@@ -373,7 +390,7 @@ declare let newMessagePortRpcSession: <T extends RpcCompatible<T> = Empty>(port:
  * credentials as parameters and returns the authorized API), then cross-origin requests should
  * be safe.
  */
-declare function newWorkersRpcResponse(request: Request, localMain: any): Promise<Response>;
+declare function newWorkersRpcResponse(request: Request, localMain: any, options?: RpcSessionOptions): Promise<Response>;
 //#endregion
-export { type AnyRpcTransport, type EncodingLevel, type RpcCompatible, RpcPromise, RpcSession, type RpcSessionOptions, RpcStub, RpcTarget, type RpcTransport, type RpcTransportWithCustomEncoding, WebSocketTransport, deserialize, newHttpBatchRpcResponse, newHttpBatchRpcSession, newMessagePortRpcSession, newWebSocketRpcSession, newWorkersRpcResponse, newWorkersWebSocketRpcResponse, nodeHttpBatchRpcResponse, serialize };
+export { type AnyRpcTransport, DEFAULT_LIMITS, DEFAULT_MAX_DEPTH, type EncodingLevel, type RpcCompatible, type RpcLimits, RpcPromise, RpcSession, type RpcSessionOptions, RpcStub, RpcTarget, type RpcTransport, type RpcTransportWithCustomEncoding, WebSocketTransport, deserialize, newHttpBatchRpcResponse, newHttpBatchRpcSession, newMessagePortRpcSession, newWebSocketRpcSession, newWorkersRpcResponse, newWorkersWebSocketRpcResponse, nodeHttpBatchRpcResponse, serialize };
 //# sourceMappingURL=index-workers.d.cts.map

package/dist/index-workers.d.ts

@@ -126,6 +126,13 @@ type Provider<T> = MaybeCallableProvider<T> & (T extends ReadonlyArray<unknown>
  * ```
  */
 type EncodingLevel = "string" | "jsonCompatible" | "jsonCompatibleWithBytes" | "structuredClonable";
+interface RpcLimits {
+  maxBigIntDigits: number;
+  maxDepth: number;
+  maxMessageSize: number;
+}
+declare const DEFAULT_MAX_DEPTH = 256;
+declare const DEFAULT_LIMITS: RpcLimits;
 /**
  * Serialize a value, using Cap'n Web's underlying serialization. This won't be able to serialize
  * RPC stubs, but it will support basic data types.
@@ -227,6 +234,16 @@ type RpcSessionOptions = {
    * to serialize the error with the stack omitted.
    */
   onSendError?: (error: Error) => Error | void;
+  /**
+   * Overrides for the resource limits enforced while deserializing messages from the peer. Any
+   * field left unset falls back to `DEFAULT_LIMITS`. These guard against resource-exhaustion
+   * attacks from untrusted peers; see `RpcLimits` for the meaning and defaults of each field.
+   *
+   * Limits are a purely local, receiver-side decision -- the protocol has no negotiation step, so
+   * the peer never learns these values. A message that exceeds a limit is rejected, aborting the
+   * session.
+   */
+  limits?: Partial<RpcLimits>;
 };
 //#endregion
 //#region src/websocket.d.ts
@@ -373,7 +390,7 @@ declare let newMessagePortRpcSession: <T extends RpcCompatible<T> = Empty>(port:
  * credentials as parameters and returns the authorized API), then cross-origin requests should
  * be safe.
  */
-declare function newWorkersRpcResponse(request: Request, localMain: any): Promise<Response>;
+declare function newWorkersRpcResponse(request: Request, localMain: any, options?: RpcSessionOptions): Promise<Response>;
 //#endregion
-export { type AnyRpcTransport, type EncodingLevel, type RpcCompatible, RpcPromise, RpcSession, type RpcSessionOptions, RpcStub, RpcTarget, type RpcTransport, type RpcTransportWithCustomEncoding, WebSocketTransport, deserialize, newHttpBatchRpcResponse, newHttpBatchRpcSession, newMessagePortRpcSession, newWebSocketRpcSession, newWorkersRpcResponse, newWorkersWebSocketRpcResponse, nodeHttpBatchRpcResponse, serialize };
+export { type AnyRpcTransport, DEFAULT_LIMITS, DEFAULT_MAX_DEPTH, type EncodingLevel, type RpcCompatible, type RpcLimits, RpcPromise, RpcSession, type RpcSessionOptions, RpcStub, RpcTarget, type RpcTransport, type RpcTransportWithCustomEncoding, WebSocketTransport, deserialize, newHttpBatchRpcResponse, newHttpBatchRpcSession, newMessagePortRpcSession, newWebSocketRpcSession, newWorkersRpcResponse, newWorkersWebSocketRpcResponse, nodeHttpBatchRpcResponse, serialize };
 //# sourceMappingURL=index-workers.d.ts.map

package/dist/index-workers.js

@@ -935,6 +935,12 @@ var PromiseStubHook = class PromiseStubHook extends StubHook {
 
 //#endregion
 //#region src/serialize.ts
+const DEFAULT_MAX_DEPTH = 256;
+const DEFAULT_LIMITS = {
+	maxBigIntDigits: 16384,
+	maxDepth: 256,
+	maxMessageSize: 32 * 1024 * 1024
+};
 var NullExporter = class {
 	exportStub(stub) {
 		throw new Error("Cannot serialize RPC stubs without an RPC session.");
@@ -954,7 +960,7 @@ async function streamToBlob(stream, type) {
 	let b = await new Response(stream).blob();
 	return b.type === type ? b : b.slice(0, b.size, type);
 }
-const ERROR_TYPES = {
+const ERROR_TYPES = Object.assign(Object.create(null), {
 	Error,
 	EvalError,
 	RangeError,
@@ -963,7 +969,7 @@ const ERROR_TYPES = {
 	TypeError,
 	URIError,
 	AggregateError
-};
+});
 var Devaluator = class Devaluator {
 	exporter;
 	source;
@@ -986,7 +992,7 @@ var Devaluator = class Devaluator {
 	}
 	exports;
 	devaluateImpl(value, parent, depth) {
-		if (depth >= 64) throw new Error("Serialization exceeded maximum allowed depth. (Does the message contain cycles?)");
+		if (depth >= 256) throw new Error("Serialization exceeded maximum allowed depth. (Does the message contain cycles?)");
 		switch (typeForRpc(value)) {
 			case "unsupported": {
 				let msg;
@@ -1220,6 +1226,9 @@ var NullImporter = class {
 	getPipeReadable(exportId) {
 		throw new Error("Cannot retrieve pipe readable without an RPC session.");
 	}
+	getLimits() {
+		return DEFAULT_LIMITS;
+	}
 };
 const NULL_IMPORTER = new NullImporter();
 function fixBrokenRequestBody(request, body) {
@@ -1237,16 +1246,21 @@ function streamToBlobPromise(stream, type) {
 var Evaluator = class Evaluator {
 	importer;
 	encodingLevel;
+	limits;
 	constructor(importer, encodingLevel = "string") {
 		this.importer = importer;
 		this.encodingLevel = encodingLevel;
+		this.limits = importer.getLimits();
 	}
 	hooks = [];
 	promises = [];
 	evaluate(value) {
+		return this.evaluateWithDepth(value, 0);
+	}
+	evaluateWithDepth(value, depth) {
 		let payload = RpcPayload.forEvaluate(this.hooks, this.promises);
 		try {
-			payload.value = this.evaluateImpl(value, payload, "value");
+			payload.value = this.evaluateImpl(value, payload, "value", depth);
 			return payload;
 		} catch (err) {
 			payload.dispose();
@@ -1256,18 +1270,25 @@ var Evaluator = class Evaluator {
 	evaluateCopy(value) {
 		return this.evaluate(structuredClone(value));
 	}
-	evaluateImpl(value, parent, property) {
+	evaluateImpl(value, parent, property, depth) {
+		let maxDepth = this.limits.maxDepth;
+		if (depth >= maxDepth) throw new TypeError(`Deserialization exceeded maximum allowed message depth of ${maxDepth}.`);
 		if (this.encodingLevel === "structuredClonable") {
 			if (value instanceof Date || typeof value === "bigint") return value;
 		}
 		if (value instanceof Array) {
 			if (value.length == 1 && value[0] instanceof Array) {
 				let result = value[0];
-				for (let i = 0; i < result.length; i++) result[i] = this.evaluateImpl(result[i], result, i);
+				for (let i = 0; i < result.length; i++) result[i] = this.evaluateImpl(result[i], result, i, depth + 1);
 				return result;
 			} else switch (value[0]) {
 				case "bigint":
-					if (typeof value[1] == "string") return BigInt(value[1]);
+					if (typeof value[1] == "string") {
+						let digits = value[1];
+						let maxBigIntDigits = this.limits.maxBigIntDigits;
+						if (digits.length > maxBigIntDigits) throw new TypeError(`Deserialized bigint exceeds maximum length of ${maxBigIntDigits} digits.`);
+						return BigInt(digits);
+					}
 					break;
 				case "date":
 					if (value[1] === null) return /* @__PURE__ */ new Date(NaN);
@@ -1297,7 +1318,11 @@ var Evaluator = class Evaluator {
 							let propsObj = props;
 							for (let key of Object.keys(propsObj)) {
 								if (key === "name" || key === "message" || key === "stack") continue;
-								anyResult[key] = this.evaluateImpl(propsObj[key], result, key);
+								if (key in Object.prototype || key === "toJSON") {
+									this.evaluateImpl(propsObj[key], result, key, depth + 1);
+									continue;
+								}
+								anyResult[key] = this.evaluateImpl(propsObj[key], result, key, depth + 1);
 							}
 						}
 						return result;
@@ -1318,11 +1343,11 @@ var Evaluator = class Evaluator {
 					let init = value[2];
 					if (typeof init !== "object" || init === null) break;
 					if (init.body) {
-						init.body = this.evaluateImpl(init.body, init, "body");
+						init.body = this.evaluateImpl(init.body, init, "body", depth + 1);
 						if (init.body === null || typeof init.body === "string" || init.body instanceof Uint8Array || init.body instanceof ReadableStream) {} else throw new TypeError("Request body must be of type ReadableStream.");
 					}
 					if (init.signal) {
-						init.signal = this.evaluateImpl(init.signal, init, "signal");
+						init.signal = this.evaluateImpl(init.signal, init, "signal", depth + 1);
 						if (!(init.signal instanceof AbortSignal)) throw new TypeError("Request siganl must be of type AbortSignal.");
 					}
 					if (init.headers && !(init.headers instanceof Array)) throw new TypeError("Request headers must be serialized as an array of pairs.");
@@ -1339,7 +1364,7 @@ var Evaluator = class Evaluator {
 				}
 				case "response": {
 					if (value.length !== 3) break;
-					let body = this.evaluateImpl(value[1], parent, property);
+					let body = this.evaluateImpl(value[1], parent, property, depth + 1);
 					if (body === null || typeof body === "string" || body instanceof Uint8Array || body instanceof ReadableStream) {} else throw new TypeError("Response body must be of type ReadableStream.");
 					let init = value[2];
 					if (typeof init !== "object" || init === null) break;
@@ -1350,7 +1375,7 @@ var Evaluator = class Evaluator {
 				case "blob": {
 					if (value.length !== 3 || typeof value[1] !== "string") break;
 					let contentType = value[1];
-					let content = this.evaluateImpl(value[2], parent, property);
+					let content = this.evaluateImpl(value[2], parent, property, depth + 1);
 					if (!(content instanceof ReadableStream)) throw new TypeError("Blob content must be serialized as a ReadableStream.");
 					let promise = streamToBlobPromise(content, contentType);
 					this.promises.push({
@@ -1391,7 +1416,7 @@ var Evaluator = class Evaluator {
 					if (value.length == 3) return addStub(hook.get(path));
 					let args = value[3];
 					if (!(args instanceof Array)) break;
-					args = new Evaluator(this.importer).evaluate([args]);
+					args = new Evaluator(this.importer).evaluateWithDepth([args], depth);
 					return addStub(hook.call(path, args));
 				}
 				case "remap": {
@@ -1457,9 +1482,9 @@ var Evaluator = class Evaluator {
 		} else if (value instanceof Object) {
 			let result = value;
 			for (let key in result) if (key in Object.prototype || key === "toJSON") {
-				this.evaluateImpl(result[key], result, key);
+				this.evaluateImpl(result[key], result, key, depth + 1);
 				delete result[key];
-			} else result[key] = this.evaluateImpl(result[key], result, key);
+			} else result[key] = this.evaluateImpl(result[key], result, key, depth + 1);
 			return result;
 		} else return value;
 	}
@@ -1530,6 +1555,10 @@ var ImportTableEntry = class {
 	resolution;
 	onBrokenRegistrations;
 	resolve(resolution) {
+		if (this.resolution) {
+			resolution.dispose();
+			return;
+		}
 		if (this.localRefcount == 0) {
 			resolution.dispose();
 			return;
@@ -1682,6 +1711,7 @@ var RpcSessionImpl = class {
 	pullCount = 0;
 	onBrokenCallbacks = [];
 	encodingLevel;
+	limits;
 	constructor(transport, mainHook, options) {
 		this.transport = transport;
 		this.options = options;
@@ -1694,6 +1724,10 @@ var RpcSessionImpl = class {
 			}
 		}
 		this.encodingLevel = level;
+		this.limits = {
+			...DEFAULT_LIMITS,
+			...options.limits
+		};
 		this.exports.push({
 			hook: mainHook,
 			refcount: 1
@@ -1836,6 +1870,9 @@ var RpcSessionImpl = class {
 		entry.pipeReadable = void 0;
 		return readable;
 	}
+	getLimits() {
+		return this.limits;
+	}
 	createPipe(readable, readableHook) {
 		if (this.abortReason) throw this.abortReason;
 		this.send(["pipe"]);
@@ -1995,6 +2032,7 @@ var RpcSessionImpl = class {
 			} finally {
 				if (this.cancelReadLoop === readCanceled.reject) this.cancelReadLoop = void 0;
 			}
+			if (this.encodingLevel === "string" && raw.length > this.limits.maxMessageSize) throw new TypeError(`Incoming message exceeds maximum size of ${this.limits.maxMessageSize} UTF-16 code units.`);
 			if (this.abortReason) break;
 			let msg = this.encodingLevel === "string" ? JSON.parse(raw) : raw;
 			if (msg instanceof Array) switch (msg[0]) {
@@ -2069,7 +2107,7 @@ var RpcSessionImpl = class {
 				case "abort": {
 					let payload = new Evaluator(this, this.encodingLevel).evaluate(msg[1]);
 					payload.dispose();
-					this.abort(payload, false);
+					this.abort(payload.value, false);
 					break;
 				}
 			}
@@ -2195,6 +2233,8 @@ var WebSocketTransport = class {
 		let message;
 		if (reason instanceof Error) message = reason.message;
 		else message = `${reason}`;
+		let reasonBytes = new TextEncoder().encode(message);
+		if (reasonBytes.length > 123) message = new TextDecoder().decode(reasonBytes.subarray(0, 123), { stream: true });
 		this.#webSocket.close(3e3, message);
 		if (!this.#error) this.#error = reason;
 	}
@@ -2580,6 +2620,9 @@ var MapApplicator = class {
 	getPipeReadable(exportId) {
 		throw new Error("A mapper function cannot use pipe readables.");
 	}
+	getLimits() {
+		return DEFAULT_LIMITS;
+	}
 };
 function applyMapToElement(input, parent, owner, captures, instructions) {
 	let mapper = new MapApplicator(captures, new PayloadStubHook(RpcPayload.deepCopyFrom(input, parent, owner)));
@@ -2918,15 +2961,15 @@ let newMessagePortRpcSession = newMessagePortRpcSession$1;
 * credentials as parameters and returns the authorized API), then cross-origin requests should
 * be safe.
 */
-async function newWorkersRpcResponse(request, localMain) {
+async function newWorkersRpcResponse(request, localMain, options) {
 	if (request.method === "POST") {
-		let response = await newHttpBatchRpcResponse(request, localMain);
+		let response = await newHttpBatchRpcResponse(request, localMain, options);
 		response.headers.set("Access-Control-Allow-Origin", "*");
 		return response;
-	} else if (request.headers.get("Upgrade")?.toLowerCase() === "websocket") return newWorkersWebSocketRpcResponse(request, localMain);
+	} else if (request.headers.get("Upgrade")?.toLowerCase() === "websocket") return newWorkersWebSocketRpcResponse(request, localMain, options);
 	else return new Response("This endpoint only accepts POST or WebSocket requests.", { status: 400 });
 }
 
 //#endregion
-export { RpcPromise, RpcSession, RpcStub, RpcTarget, WebSocketTransport, deserialize, newHttpBatchRpcResponse, newHttpBatchRpcSession, newMessagePortRpcSession, newWebSocketRpcSession, newWorkersRpcResponse, newWorkersWebSocketRpcResponse, nodeHttpBatchRpcResponse, serialize };
+export { DEFAULT_LIMITS, DEFAULT_MAX_DEPTH, RpcPromise, RpcSession, RpcStub, RpcTarget, WebSocketTransport, deserialize, newHttpBatchRpcResponse, newHttpBatchRpcSession, newMessagePortRpcSession, newWebSocketRpcSession, newWorkersRpcResponse, newWorkersWebSocketRpcResponse, nodeHttpBatchRpcResponse, serialize };
 //# sourceMappingURL=index-workers.js.map