hbengine 0.2.3

package/engine-conformance/picture.mjs

@@ -0,0 +1,55 @@
+// What a screenshot shows: whether the frame is one flat colour. A game that
+// draws on a canvas the run's browser could not draw (WebGL without a GPU), or
+// that never drew, passes the size-based `draws` check and still shows the
+// reviewer and the player a black frame (Pump Junkie v1, 26 Oct).
+import { inflateSync } from 'node:zlib';
+
+/** Decodes an 8-bit, non-interlaced PNG (what Chrome's screenshots are) into { width, height, channels, pixels }. */
+export function decodePNG(buf) {
+    if (buf.readUInt32BE(0) !== 0x89504e47) throw new Error('not a PNG');
+    let off = 8, width = 0, height = 0, depth = 0, type = 0, interlace = 0;
+    const idat = [];
+    while (off < buf.length) {
+        const len = buf.readUInt32BE(off), kind = buf.toString('latin1', off + 4, off + 8), data = buf.subarray(off + 8, off + 8 + len);
+        if (kind === 'IHDR') { width = data.readUInt32BE(0); height = data.readUInt32BE(4); depth = data[8]; type = data[9]; interlace = data[12]; }
+        else if (kind === 'IDAT') idat.push(data);
+        else if (kind === 'IEND') break;
+        off += 12 + len;
+    }
+    const channels = { 2: 3, 6: 4, 0: 1, 4: 2 }[type];
+    if (depth !== 8 || !channels || interlace) throw new Error(`unsupported PNG (depth ${depth}, type ${type}, interlace ${interlace})`);
+    const raw = inflateSync(Buffer.concat(idat)), stride = width * channels, pixels = Buffer.alloc(stride * height);
+    for (let y = 0; y < height; y++) {
+        const f = raw[y * (stride + 1)], src = raw.subarray(y * (stride + 1) + 1, (y + 1) * (stride + 1)), row = pixels.subarray(y * stride, (y + 1) * stride), up = y ? pixels.subarray((y - 1) * stride, y * stride) : null;
+        for (let x = 0; x < stride; x++) {
+            const a = x >= channels ? row[x - channels] : 0, b = up ? up[x] : 0, c = up && x >= channels ? up[x - channels] : 0;
+            let v = src[x];
+            if (f === 1) v += a;
+            else if (f === 2) v += b;
+            else if (f === 3) v += (a + b) >> 1;
+            else if (f === 4) { const p = a + b - c, pa = Math.abs(p - a), pb = Math.abs(p - b), pc = Math.abs(p - c); v += pa <= pb && pa <= pc ? a : pb <= pc ? b : c; }
+            row[x] = v & 255;
+        }
+    }
+    return { width, height, channels, pixels };
+}
+
+/**
+ * The share of the picture in its most common colour (sampled on a grid, colours
+ * within `tol` of each other counted as one): 1 is a flat frame.
+ */
+export function flatShare(png, { step = 8, tol = 6 } = {}) {
+    const { width, height, channels, pixels } = decodePNG(png);
+    const counts = new Map();
+    let n = 0;
+    for (let y = 0; y < height; y += step) {
+        for (let x = 0; x < width; x += step) {
+            const i = (y * width + x) * channels;
+            const g = channels >= 3 ? [pixels[i], pixels[i + 1], pixels[i + 2]] : [pixels[i], pixels[i], pixels[i]];
+            const key = g.map((v) => Math.round(v / tol)).join(',');
+            counts.set(key, (counts.get(key) || 0) + 1);
+            n++;
+        }
+    }
+    return n ? Math.max(...counts.values()) / n : 1;
+}

package/engine-conformance/report.go

@@ -0,0 +1,349 @@
+package conformance
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"mime"
+	"net"
+	"net/http"
+	"net/url"
+	"regexp"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+)
+
+// Reports is the endpoint a policy's report-uri and report-to name: browsers
+// POST what the policy refused in a player's page, and each violation becomes
+// one log line, msg "csp violation", which the alert on the service mails to
+// staff. Nothing is stored and nothing is answered but 204. A report is the
+// browser's word, sent after the fact, and a browser extension or a forged
+// POST can send one as well as a game can earn one: it is a reason for staff
+// to look at a game and kill it, never a kill by itself.
+//
+// What reaches the logs is bounded in content and in volume. In content: the
+// page the report names (the caller's Locate), the directive, the blocked
+// URI's scheme and host, and a count; never any other text from the report.
+// In volume: lines, not requests, are what the allowances count, and only a
+// line that is logged spends one. A report that is dropped unheard costs its
+// sender nothing, so a game posting junk to its own report endpoint (its
+// origin, which connect-src allows) cannot spend its player's allowance and
+// silence the browser's own reports about it; and the allowance is one
+// address's about one page, so a flood about one page never starves another's.
+// When an allowance is spent, one line, "csp violation flood", names the page,
+// so the throttling is itself seen.
+type Reports struct {
+	// Locate names the page a report is about from its document URL, already
+	// known to be on the host the report reached: the attributes to log, or
+	// false for a page that is not ours, whose report is dropped unheard.
+	Locate func(doc *url.URL) ([]slog.Attr, bool)
+	// Hops: the X-Forwarded-For entry that many from the right names the client
+	// (1 on Cloud Run, 2 behind Google's load balancer, 3 with Cloudflare before
+	// it); 0 is the connection's own address, which behind a proxy throttles
+	// every player as one.
+	Hops int
+	Log  *slog.Logger     // slog.Default() when nil
+	Now  func() time.Time // time.Now when nil
+
+	mu      sync.Mutex
+	buckets map[string]*bucket // one address about one page
+	all     bucket
+}
+
+const (
+	maxReport = 8 << 10 // a report is a few hundred bytes; a batch a few of them
+	// Lines one address may add to the logs about one page: ten at once, then
+	// ten a minute, plus the one that says the rest were dropped. Lines the
+	// instance may add in all: three hundred at once, then three hundred a
+	// minute. A request that logs nothing spends nothing.
+	pairBurst, pairPerSecond = 10, 10.0 / 60
+	allBurst, allPerSecond   = 300, 300.0 / 60
+	maxPairs                 = 4096
+)
+
+type bucket struct {
+	tokens float64
+	at     time.Time // last touched
+	warned bool      // the flood line for this exhaustion has been logged
+}
+
+func (b *bucket) refill(now time.Time, burst, perSecond float64) {
+	if b.at.IsZero() {
+		b.tokens = burst
+	} else {
+		b.tokens = min(burst, b.tokens+now.Sub(b.at).Seconds()*perSecond)
+	}
+	b.at = now
+	// Quiet long enough to be whole again: the next flood is a new one.
+	if b.tokens >= burst {
+		b.warned = false
+	}
+}
+
+type verdict int
+
+const (
+	logged   verdict = iota // the line may be logged
+	flooded                 // the pair's allowance is spent: one line says so
+	silenced                // nothing: the pair has been told, or the instance is spent
+)
+
+func (rp *Reports) now() time.Time {
+	if rp.Now != nil {
+		return rp.Now()
+	}
+	return time.Now()
+}
+
+func (rp *Reports) log() *slog.Logger {
+	if rp.Log != nil {
+		return rp.Log
+	}
+	return slog.Default()
+}
+
+// allow spends one line of the pair's allowance (one address about one page)
+// and one of the instance's, for a line that is about to be logged. The pair
+// map never grows past maxPairs: a pair is remembered only when the instance
+// has a line to give, so at most 600 pairs are touched in any minute, and
+// when the map is full every pair idle long enough to be whole again is
+// forgotten, which always leaves room; should it not, the new pair is refused
+// rather than remembered.
+func (rp *Reports) allow(pair string, now time.Time) verdict {
+	rp.mu.Lock()
+	defer rp.mu.Unlock()
+	rp.all.refill(now, allBurst, allPerSecond)
+	if rp.all.tokens < 1 {
+		return silenced
+	}
+	b := rp.buckets[pair]
+	if b == nil {
+		if rp.buckets == nil {
+			rp.buckets = map[string]*bucket{}
+		}
+		if len(rp.buckets) >= maxPairs {
+			for k, v := range rp.buckets {
+				if now.Sub(v.at).Seconds()*pairPerSecond >= pairBurst {
+					delete(rp.buckets, k)
+				}
+			}
+			if len(rp.buckets) >= maxPairs {
+				return silenced
+			}
+		}
+		b = &bucket{}
+		rp.buckets[pair] = b
+	}
+	b.refill(now, pairBurst, pairPerSecond)
+	if b.tokens >= 1 {
+		b.tokens--
+		rp.all.tokens--
+		return logged
+	}
+	if b.warned {
+		return silenced
+	}
+	b.warned = true
+	rp.all.tokens--
+	return flooded
+}
+
+func (rp *Reports) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	h := w.Header()
+	h.Set("X-Content-Type-Options", "nosniff")
+	h.Set("Cache-Control", "no-store")
+	if r.Method != http.MethodPost {
+		h.Set("Allow", "POST")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	ct, _, _ := mime.ParseMediaType(r.Header.Get("Content-Type"))
+	if ct != "application/csp-report" && ct != "application/reports+json" {
+		http.Error(w, "a report is application/csp-report or application/reports+json", http.StatusUnsupportedMediaType)
+		return
+	}
+	if r.ContentLength > maxReport {
+		http.Error(w, "report too large", http.StatusRequestEntityTooLarge)
+		return
+	}
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, maxReport))
+	var tooLarge *http.MaxBytesError
+	if errors.As(err, &tooLarge) {
+		http.Error(w, "report too large", http.StatusRequestEntityTooLarge)
+		return
+	}
+	if err != nil {
+		http.Error(w, "unreadable report", http.StatusBadRequest)
+		return
+	}
+	// Read and located first, charged only for what is logged: a report that
+	// is nobody's costs nobody's allowance.
+	from, now := rp.client(r), rp.now()
+	kept, refused := 0, 0
+	for _, l := range rp.lines(r.Host, parse(ct, body)) {
+		switch rp.allow(from+" "+l.pageKey, now) {
+		case logged:
+			rp.log().LogAttrs(r.Context(), slog.LevelWarn, "csp violation", l.attrs()...)
+			kept++
+		case flooded:
+			rp.log().LogAttrs(r.Context(), slog.LevelWarn, "csp violation flood", l.page...)
+			refused++
+		default:
+			refused++
+		}
+	}
+	if kept == 0 && refused > 0 {
+		http.Error(w, "too many reports", http.StatusTooManyRequests)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (rp *Reports) client(r *http.Request) string { return ClientAddress(r, rp.Hops) }
+
+// ClientAddress is the client's address, as the studio reads it: the
+// connection's, or behind hops trusted proxies the X-Forwarded-For entry that
+// many from the right, never one the client wrote. The sandbox shell's proxy
+// names the player to its round server with it (shell.Sandbox).
+func ClientAddress(r *http.Request, hops int) string {
+	if f := strings.Split(strings.Join(r.Header.Values("X-Forwarded-For"), ","), ","); hops > 0 && len(f) >= hops && f[0] != "" {
+		if ip := net.ParseIP(strings.TrimSpace(f[len(f)-hops])); ip != nil {
+			return ip.String()
+		}
+	}
+	if h, _, err := net.SplitHostPort(r.RemoteAddr); err == nil {
+		return h
+	}
+	return r.RemoteAddr
+}
+
+type violation struct{ document, directive, blocked string }
+
+// parse reads a report-uri report ({"csp-report": {...}}) or a Reporting API
+// batch ([{type, body}, ...], csp-violation entries only). What does not parse
+// is nothing.
+func parse(ct string, body []byte) []violation {
+	if ct == "application/csp-report" {
+		var legacy struct {
+			Report struct {
+				Document  string `json:"document-uri"`
+				Effective string `json:"effective-directive"`
+				Violated  string `json:"violated-directive"`
+				Blocked   string `json:"blocked-uri"`
+			} `json:"csp-report"`
+		}
+		if json.Unmarshal(body, &legacy) != nil {
+			return nil
+		}
+		d := legacy.Report.Effective
+		if d == "" {
+			d = legacy.Report.Violated
+		}
+		return []violation{{legacy.Report.Document, d, legacy.Report.Blocked}}
+	}
+	var batch []struct {
+		Type string `json:"type"`
+		Body struct {
+			Document  string `json:"documentURL"`
+			Effective string `json:"effectiveDirective"`
+			Blocked   string `json:"blockedURL"`
+		} `json:"body"`
+	}
+	if json.Unmarshal(body, &batch) != nil {
+		return nil
+	}
+	var out []violation
+	for _, rep := range batch {
+		if rep.Type == "csp-violation" {
+			out = append(out, violation{rep.Body.Document, rep.Body.Effective, rep.Body.Blocked})
+		}
+	}
+	return out
+}
+
+// A line to log: the page (Locate's attributes, and their text as the key an
+// allowance is kept under), what was refused, and how often the batch held it.
+type line struct {
+	page               []slog.Attr
+	pageKey            string
+	directive, blocked string
+	count              int
+}
+
+func (l *line) attrs() []slog.Attr {
+	return slices.Concat(l.page, []slog.Attr{slog.String("directive", l.directive), slog.String("blocked", l.blocked), slog.Int("count", l.count)})
+}
+
+// lines keeps the violations of pages on host that Locate knows, one line per
+// distinct (page, directive, blocked) with how many times the batch held it.
+func (rp *Reports) lines(host string, vs []violation) []*line {
+	var out []*line
+	seen := map[string]*line{}
+	for _, v := range vs {
+		doc, err := url.Parse(v.document)
+		if err != nil || !strings.EqualFold(doc.Host, host) {
+			continue
+		}
+		page, ok := rp.Locate(doc)
+		if !ok {
+			continue
+		}
+		l := &line{page: page, pageKey: fmt.Sprint(page), directive: directive(v.directive), blocked: blocked(v.blocked), count: 1}
+		key := l.pageKey + " " + l.directive + " " + l.blocked
+		if same := seen[key]; same != nil {
+			same.count++
+			continue
+		}
+		seen[key] = l
+		out = append(out, l)
+	}
+	return out
+}
+
+var (
+	directiveRE = regexp.MustCompile(`^[a-z][a-z-]{0,31}$`)
+	schemeRE    = regexp.MustCompile(`^[a-z][a-z0-9+.-]{0,15}$`)
+	// A host name or a bracketed IPv6 address, with a port or not. Go's URL
+	// parser lets much more through as a host (quotes, brackets, semicolons:
+	// text), and none of that is a host a browser fetched from.
+	hostRE = regexp.MustCompile(`^([a-z0-9.-]+|\[[0-9a-f:.]+\])(:[0-9]{1,5})?$`)
+)
+
+// A directive name; an old browser's violated-directive carries the whole
+// directive, whose first word is the name. Anything else is "other".
+func directive(s string) string {
+	s, _, _ = strings.Cut(s, " ")
+	if directiveRE.MatchString(s) {
+		return s
+	}
+	return "other"
+}
+
+// The blocked URI's scheme and host, or one of the browsers' own words for
+// what has no host (inline, eval, data...): never a path, a query, or any text
+// a forged report could put in a log line.
+func blocked(s string) string {
+	switch s {
+	case "":
+		return "none"
+	case "inline", "eval", "wasm-eval", "self", "data", "blob", "about", "filesystem":
+		return s
+	}
+	u, err := url.Parse(s)
+	if err != nil || !schemeRE.MatchString(u.Scheme) {
+		return "other"
+	}
+	host := strings.ToLower(u.Host)
+	if !hostRE.MatchString(host) {
+		return "other"
+	}
+	host = u.Scheme + "://" + host
+	if len(host) > 120 {
+		host = host[:120]
+	}
+	return host
+}