cli-jaw 2.2.8 → 2.2.10

package/dist/src/messaging/fold.js

@@ -0,0 +1,210 @@
+// ─── Canonical Folding ───────────────────────────────
+// Turns a string into the form its eventual reader would see — escapes
+// decoded, invisible characters removed, compatibility characters folded —
+// while remembering where every surviving character came from.
+//
+// The offset map is the point of this module. Finding a secret in the folded
+// copy and then deleting that literal from the original fails twice over: an
+// escape spliced INSIDE the secret means the literal is not there at all, and
+// a run that legitimately appears elsewhere gets destroyed with it. Ranges
+// carry a match back to exactly the bytes it came from.
+//
+// COORDINATE SYSTEM: UTF-16 code units, everywhere. Regex indices,
+// String.length and slice offsets all speak code units, so the map must too.
+// Walking a normalized character by code POINT desynchronized the map the
+// moment NFKC produced an astral pair.
+/**
+ * Unicode characters that render as nothing. Splicing one into a token hides
+ * it from a naive matcher while leaving the token usable — the character
+ * disappears on copy, or is stripped by the next parser in the chain.
+ *
+ * Cc/Cf covers the format controls (zero-width space and joiners, word joiner,
+ * soft hyphen, bidi marks, BOM) plus the C0/C1 control characters.
+ */
+// Cc/Cf covers the format controls (zero-width space and joiners, word joiner,
+// soft hyphen, bidi marks, BOM) and the C0/C1 controls. The explicit additions
+// are default-ignorable code points that fall outside those categories: the
+// combining grapheme joiner renders as nothing yet is Mn, Mongolian free
+// variation selectors are Cf but its vowel separator is Zs, and the Khmer
+// viramas behave the same way in practice.
+const INVISIBLE_CHARS = /[\p{Cc}\p{Cf}\u034F\u17B4\u17B5\u180B-\u180E\uFE00-\uFE0F]/gu;
+/**
+ * Fold a string to the form an attacker's target would see, so matching does
+ * not have to enumerate spellings.
+ *
+ * Chasing spellings one at a time does not converge: `%62ot`, then `%2562ot`,
+ * then U+2060 between the letters, then U+00AD, then `b`. Each round added
+ * an alternation and the next found another. Folding turns them into one shape.
+ *
+ * Decoding never throws: a malformed escape is left as written.
+ */
+export function canonicalize(input) {
+    let current = {
+        text: input,
+        origin: Array.from({ length: input.length }, (_, i) => i),
+        end: Array.from({ length: input.length }, (_, i) => i + 1),
+    };
+    current = stripInvisible(current);
+    // Fold to a FIXED POINT. Decoding strictly shrinks — an escape is always
+    // longer than the character it denotes — so this terminates on its own,
+    // and there is no round cap to nest past.
+    //
+    // The work budget bounds CPU instead, and reaching it is reported rather
+    // than swallowed: a caller that gets `exhausted` must not conclude the
+    // text was clean. A cap that silently gives up is how depth 513 leaked.
+    let budget = decodeBudgetFor(input);
+    for (;;) {
+        if (budget <= 0)
+            return { ...current, exhausted: true };
+        budget -= current.text.length;
+        const next = stripInvisible(decodeOnce(current));
+        if (next.text === current.text)
+            break;
+        current = next;
+    }
+    return current;
+}
+/**
+ * Total characters the fold may process, across all rounds.
+ *
+ * Bounding rounds does not bound cost: each round rescans the whole string, so
+ * a 43 KB input nested 512 deep burned three quarters of a second. Charging
+ * every round against one budget makes the ceiling proportional to the work
+ * actually done.
+ */
+function decodeBudgetFor(input) {
+    return Math.max(input.length * 8, 64 * 1024);
+}
+function stripInvisible(folded) {
+    const text = [];
+    const origin = [];
+    const end = [];
+    for (let i = 0; i < folded.text.length; i += 1) {
+        const char = folded.text[i];
+        INVISIBLE_CHARS.lastIndex = 0;
+        if (INVISIBLE_CHARS.test(char))
+            continue;
+        // NFKC per character, so the map stays aligned where it matters:
+        // fullwidth ｂｏｔ folds to bot, and a fullwidth colon to ':'.
+        //
+        // Iterate CODE UNITS, not code points. `for..of` yields whole code
+        // points, so a character whose NFKC expansion is astral (U+FA6C becomes
+        // U+242EE, two units) pushed one entry where the string contributes
+        // two. Every later offset then sat one short, which left the first
+        // character of a secret behind and ate the character after it —
+        // regex indices and String.length are code units throughout.
+        const normalized = char.normalize('NFKC');
+        for (let unit = 0; unit < normalized.length; unit += 1) {
+            text.push(normalized[unit]);
+            origin.push(folded.origin[i]);
+            end.push(folded.end[i]);
+        }
+    }
+    return { text: text.join(''), origin, end };
+}
+/** Replace a slice of the folded text, keeping the map consistent. */
+function spliceFolded(folded, from, to, replacement) {
+    const sourceStart = folded.origin[from];
+    const sourceEnd = folded.end[to - 1];
+    return {
+        text: [...replacement],
+        origin: replacement.split('').map(() => sourceStart),
+        end: replacement.split('').map(() => sourceEnd),
+    };
+}
+/**
+ * One round of the escape forms that reach these sinks: percent-encoding
+ * (including multi-byte UTF-8 sequences), JSON/JS `\uXXXX`, and HTML numeric
+ * entities. A log line is rendered by something downstream, and each of those
+ * renderers turns its own escape back into the character.
+ */
+function decodeOnce(folded) {
+    // All three escape families in one alternation, so a single left-to-right
+    // pass can rebuild the offset map. The HTML entity's semicolon is optional:
+    // browsers accept `&#98ot` and so must this.
+    // Named references are here for the same reason the numeric ones are: a
+    // renderer turns `&colon;` back into ':', which restores the separator the
+    // token matcher looks for.
+    const ESCAPE = /(?:%[0-9A-Fa-f]{2})+|\\u([0-9A-Fa-f]{4})|&#(x?)([0-9A-Fa-f]+);?|&([A-Za-z][A-Za-z0-9]{1,31});/gi;
+    const text = [];
+    const origin = [];
+    const end = [];
+    let cursor = 0;
+    const copyRange = (from, to) => {
+        for (let i = from; i < to; i += 1) {
+            text.push(folded.text[i]);
+            origin.push(folded.origin[i]);
+            end.push(folded.end[i]);
+        }
+    };
+    for (const match of folded.text.matchAll(ESCAPE)) {
+        const at = match.index ?? 0;
+        copyRange(cursor, at);
+        const decoded = decodeEscape(match);
+        // Push one element at a time. `push(...array)` passes every element as
+        // an argument, which overflows the stack once a hostile input produces
+        // enough of them.
+        const spliced = spliceFolded(folded, at, at + match[0].length, decoded);
+        for (let i = 0; i < spliced.text.length; i += 1) {
+            text.push(spliced.text[i]);
+            origin.push(spliced.origin[i]);
+            end.push(spliced.end[i]);
+        }
+        cursor = at + match[0].length;
+    }
+    copyRange(cursor, folded.text.length);
+    return { text: text.join(''), origin, end };
+}
+function decodeEscape(match) {
+    const whole = match[0];
+    if (whole.startsWith('%')) {
+        try {
+            // decodeURIComponent handles multi-byte UTF-8; a malformed run
+            // throws, and is then left exactly as written.
+            return decodeURIComponent(whole);
+        }
+        catch {
+            return whole;
+        }
+    }
+    if (match[1] !== undefined) {
+        const code = Number.parseInt(match[1], 16);
+        return Number.isFinite(code) ? String.fromCharCode(code) : whole;
+    }
+    const digits = match[3];
+    if (digits === undefined) {
+        const name = match[4];
+        if (name === undefined)
+            return whole;
+        return NAMED_ENTITIES[name.toLowerCase()] ?? whole;
+    }
+    const code = Number.parseInt(digits, match[2] ? 16 : 10);
+    return Number.isFinite(code) && code > 0 && code <= 0x10ffff
+        ? String.fromCodePoint(code)
+        : whole;
+}
+/**
+ * Named references that can rebuild a credential once a renderer expands them.
+ *
+ * Only the characters that matter to detection are listed — the separator, the
+ * escape introducers, and the delimiters a URL needs. A full HTML entity table
+ * would add hundreds of letters that change nothing here.
+ */
+const NAMED_ENTITIES = {
+    colon: ':',
+    amp: '&',
+    percnt: '%',
+    sol: '/',
+    bsol: '\\',
+    lowbar: '_',
+    hyphen: '-',
+    period: '.',
+    num: '#',
+    quest: '?',
+    equals: '=',
+    commat: '@',
+    nbsp: ' ',
+    zwnj: '\u200C',
+    zwj: '\u200D',
+};
+//# sourceMappingURL=fold.js.map

package/dist/src/messaging/fold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fold.js","sourceRoot":"","sources":["../../../src/messaging/fold.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,uEAAuE;AACvE,2EAA2E;AAC3E,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,6EAA6E;AAC7E,0EAA0E;AAC1E,uCAAuC;AAEvC;;;;;;;GAOG;AACH,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,2CAA2C;AAC3C,MAAM,eAAe,GAAG,8DAA8D,CAAC;AA0BvF;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACtC,IAAI,OAAO,GAAe;QACtB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzD,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;KAC7D,CAAC;IACF,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAClC,yEAAyE;IACzE,wEAAwE;IACxE,0CAA0C;IAC1C,EAAE;IACF,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,SAAS,CAAC;QACN,IAAI,MAAM,IAAI,CAAC;YAAE,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;YAAE,MAAM;QACtC,OAAO,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAa;IAClC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,MAAkB;IACtC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;QAC7B,eAAe,CAAC,SAAS,GAAG,CAAC,CAAC;QAC9B,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACzC,iEAAiE;QACjE,4DAA4D;QAC5D,EAAE;QACF,mEAAmE;QACnE,wEAAwE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,gEAAgE;QAChE,6DAA6D;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAE,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;QAC7B,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,sEAAsE;AACtE,SAAS,YAAY,CACjB,MAAkB,EAClB,IAAY,EACZ,EAAU,EACV,WAAmB;IAEnB,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAE,CAAC;IACtC,OAAO;QACH,IAAI,EAAE,CAAC,GAAG,WAAW,CAAC;QACtB,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC;QACpD,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;KAClD,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAkB;IAClC,0EAA0E;IAC1E,4EAA4E;IAC5E,6CAA6C;IAC7C,wEAAwE;IACxE,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,MAAM,GAAG,iGAAiG,CAAC;IACjH,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE;QAC3C,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;QAC7B,CAAC;IACL,CAAC,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAC5B,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,uEAAuE;QACvE,uEAAuE;QACvE,kBAAkB;QAClB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,KAAuB;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACD,+DAA+D;YAC/D,+CAA+C;YAC/C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,QAAQ;QACxD,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,KAAK,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,cAAc,GAA2B;IAC3C,KAAK,EAAE,GAAG;IACV,GAAG,EAAE,GAAG;IACR,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;IACR,KAAK,EAAE,GAAG;IACV,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,QAAQ;CAChB,CAAC"}