just-bash 2.12.2 → 2.12.4

package/dist/bin/chunks/worker.js

@@ -10,6 +10,19 @@ import { createRequire } from "node:module";
 import { dirname } from "node:path";
 import { parentPort, workerData } from "node:worker_threads";
 
+// src/fs/sanitize-error.ts
+function sanitizeErrorMessage(message) {
+  if (!message) return message;
+  let sanitized = message.replace(/\n\s+at\s.*/g, "");
+  sanitized = sanitized.replace(
+    /(?:\/(?:Users|home|private|var|opt|Library|System|usr|etc|tmp|nix|snap))\b[^\s'",)}\]:]*/g,
+    "<path>"
+  );
+  sanitized = sanitized.replace(/node:internal\/[^\s'",)}\]:]+/g, "<internal>");
+  sanitized = sanitized.replace(/[A-Z]:\\[^\s'",)}\]:]+/g, "<path>");
+  return sanitized;
+}
+
 // src/security/blocked-globals.ts
 function getBlockedGlobals() {
   const globals = [
@@ -1253,9 +1266,27 @@ var WorkerDefenseInDepth = class {
   }
 };
 
+// src/security/wasm-callback.ts
+function sanitizeUnknownError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return sanitizeErrorMessage(message);
+}
+function wrapWasmCallback(component, phase, callback) {
+  return (...args) => {
+    try {
+      return callback(...args);
+    } catch (error) {
+      const message = sanitizeUnknownError(error);
+      throw new Error(`${component} ${phase} callback failed: ${message}`);
+    }
+  };
+}
+
 // src/timers.ts
-var _setTimeout = globalThis.setTimeout;
-var _clearTimeout = globalThis.clearTimeout;
+var nativeSetTimeout = globalThis.setTimeout.bind(globalThis);
+var nativeClearTimeout = globalThis.clearTimeout.bind(globalThis);
+var nativeSetInterval = globalThis.setInterval.bind(globalThis);
+var nativeClearInterval = globalThis.clearInterval.bind(globalThis);
 var _SharedArrayBuffer = globalThis.SharedArrayBuffer;
 var _Atomics = globalThis.Atomics;
 var _performanceNow = performance.now.bind(performance);
@@ -2413,9 +2444,8 @@ function createHTTPFS(backend, FS) {
             });
             lastResponse = encoder.encode(JSON.stringify(result));
           } catch (e) {
-            lastResponse = encoder.encode(
-              JSON.stringify({ error: e.message })
-            );
+            const message = sanitizeErrorMessage(e.message);
+            lastResponse = encoder.encode(JSON.stringify({ error: message }));
           }
         }
         delete stream.hostContent;
@@ -2543,6 +2573,16 @@ sys.modules['jb_http'] = jb_http
 `;
 }
 var cachedStdlibZip = new Uint8Array(readFileSync(stdlibZipPath));
+function postWorkerMessage(message) {
+  try {
+    parentPort?.postMessage(message);
+  } catch (error) {
+    console.debug(
+      "[python3-worker] failed to post worker message:",
+      sanitizeUnknownError(error)
+    );
+  }
+}
 async function runPython(input) {
   const backend = new SyncFsBackend(input.sharedBuffer);
   const createPythonModule = require2(`${cpythonDir}/python.cjs`);
@@ -2551,17 +2591,20 @@ async function runPython(input) {
   const pendingStderr = [];
   let Module;
   try {
-    Module = await createPythonModule({
-      noInitialRun: true,
-      preRun: [
-        (mod) => {
-          mod.FS.mkdirTree("/lib");
-          mod.FS.writeFile("/lib/python313.zip", cachedStdlibZip);
-          mod.ENV.PYTHONHOME = "/";
-          mod.ENV.PYTHONPATH = "/lib/python313.zip";
-        }
-      ],
-      print: (text) => {
+    const onPreRun = wrapWasmCallback(
+      "python3-worker",
+      "preRun",
+      (mod) => {
+        mod.FS.mkdirTree("/lib");
+        mod.FS.writeFile("/lib/python313.zip", cachedStdlibZip);
+        mod.ENV.PYTHONHOME = "/";
+        mod.ENV.PYTHONPATH = "/lib/python313.zip";
+      }
+    );
+    const onPrint = wrapWasmCallback(
+      "python3-worker",
+      "print",
+      (text) => {
         if (moduleReady) {
           backend.writeStdout(`${text}
 `);
@@ -2569,8 +2612,12 @@ async function runPython(input) {
           pendingStdout.push(`${text}
 `);
         }
-      },
-      printErr: (text) => {
+      }
+    );
+    const onPrintErr = wrapWasmCallback(
+      "python3-worker",
+      "printErr",
+      (text) => {
         if (typeof text === "string" && (text.includes("Could not find platform") || text.includes("LLVM Profile Error"))) {
           return;
         }
@@ -2582,11 +2629,18 @@ async function runPython(input) {
 `);
         }
       }
+    );
+    Module = await createPythonModule({
+      noInitialRun: true,
+      preRun: [onPreRun],
+      print: onPrint,
+      printErr: onPrintErr
     });
   } catch (e) {
+    const message = sanitizeErrorMessage(e.message);
     return {
       success: false,
-      error: `Failed to load CPython: ${e.message}`
+      error: `Failed to load CPython: ${message}`
     };
   }
   activateDefense();
@@ -2598,9 +2652,10 @@ async function runPython(input) {
     Module.FS.mkdir("/host");
     Module.FS.mount(HOSTFS, { root: "/" }, "/host");
   } catch (e) {
+    const message = sanitizeErrorMessage(e.message);
     return {
       success: false,
-      error: `Failed to mount HOSTFS: ${e.message}`
+      error: `Failed to mount HOSTFS: ${message}`
     };
   }
   const HTTPFS = createHTTPFS(backend, Module.FS);
@@ -2608,9 +2663,10 @@ async function runPython(input) {
     Module.FS.mkdir("/_jb_http");
     Module.FS.mount(HTTPFS, { root: "/" }, "/_jb_http");
   } catch (e) {
+    const message = sanitizeErrorMessage(e.message);
     return {
       success: false,
-      error: `Failed to mount HTTPFS: ${e.message}`
+      error: `Failed to mount HTTPFS: ${message}`
     };
   }
   const setupCode = generateSetupCode(input);
@@ -2660,6 +2716,13 @@ function activateDefense() {
     writable: true,
     configurable: true
   });
+  const onViolation = wrapWasmCallback(
+    "python3-worker",
+    "onViolation",
+    (v) => {
+      postWorkerMessage({ type: "security-violation", violation: v });
+    }
+  );
   defense = new WorkerDefenseInDepth({
     excludeViolationTypes: [
       // SharedArrayBuffer/Atomics: Used by sync-fs-backend.ts for synchronous
@@ -2670,26 +2733,26 @@ function activateDefense() {
       // stub. Defense doesn't need to block it — it's already degraded.
       "performance_timing"
     ],
-    onViolation: (v) => {
-      parentPort?.postMessage({ type: "security-violation", violation: v });
-    }
+    onViolation
   });
 }
 process.on("uncaughtException", (e) => {
-  parentPort?.postMessage({
+  const message = sanitizeErrorMessage(e.message);
+  postWorkerMessage({
     success: false,
-    error: `Worker uncaught exception: ${e.message}`
+    error: `Worker uncaught exception: ${message}`
   });
 });
 if (parentPort) {
   if (workerData) {
     runPython(workerData).then((result) => {
       result.defenseStats = defense?.getStats();
-      parentPort?.postMessage(result);
+      postWorkerMessage(result);
     }).catch((e) => {
-      parentPort?.postMessage({
+      const message = sanitizeUnknownError(e);
+      postWorkerMessage({
         success: false,
-        error: e.message,
+        error: message,
         defenseStats: defense?.getStats()
       });
     });

package/dist/bin/chunks/xan-BJ66NSYT.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-Q4WHWGOT.js";import"./chunk-GZHFXDDO.js";import"./chunk-QSDVMMYI.js";import"./chunk-V7VIJQD6.js";import"./chunk-UYBH3FNE.js";import"./chunk-4PRVMER6.js";import"./chunk-WO4B7WUT.js";import"./chunk-EO5AH4U7.js";import"./chunk-SE4C7FJY.js";import"./chunk-5WFYIUU2.js";import"./chunk-6KZRLMG3.js";import"./chunk-OBH7XN5N.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as xanCommand};

package/dist/bin/chunks/yq-GPYVGU2N.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-Q3FNZYGG.js";import"./chunk-QSDVMMYI.js";import"./chunk-V7VIJQD6.js";import"./chunk-UYBH3FNE.js";import"./chunk-4PRVMER6.js";import"./chunk-WO4B7WUT.js";import"./chunk-EO5AH4U7.js";import"./chunk-SE4C7FJY.js";import"./chunk-SYG3IW7P.js";import"./chunk-6KZRLMG3.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as yqCommand};