just-bash 2.12.5 → 2.12.7

package/dist/bundle/chunks/worker.js

@@ -169,6 +169,34 @@ function getBlockedGlobals() {
       strategy: "throw",
       reason: "process.setgid could escalate privileges"
     },
+    {
+      prop: "seteuid",
+      target: process,
+      violationType: "process_setuid",
+      strategy: "throw",
+      reason: "process.seteuid could escalate effective user privileges"
+    },
+    {
+      prop: "setegid",
+      target: process,
+      violationType: "process_setuid",
+      strategy: "throw",
+      reason: "process.setegid could escalate effective group privileges"
+    },
+    {
+      prop: "initgroups",
+      target: process,
+      violationType: "process_setuid",
+      strategy: "throw",
+      reason: "process.initgroups could modify supplementary group IDs"
+    },
+    {
+      prop: "setgroups",
+      target: process,
+      violationType: "process_setuid",
+      strategy: "throw",
+      reason: "process.setgroups could modify supplementary group IDs"
+    },
     // File permission manipulation
     {
       prop: "umask",
@@ -205,6 +233,30 @@ function getBlockedGlobals() {
       strategy: "throw",
       reason: "process.chdir could confuse the interpreter's CWD tracking"
     },
+    // Diagnostic report (leaks full environment, host paths, system info)
+    {
+      prop: "report",
+      target: process,
+      violationType: "process_report",
+      strategy: "throw",
+      reason: "process.report could disclose full environment, host paths, and system info"
+    },
+    // Environment file loading (Node 21.7+)
+    {
+      prop: "loadEnvFile",
+      target: process,
+      violationType: "process_env",
+      strategy: "throw",
+      reason: "process.loadEnvFile could load env files bypassing env proxy"
+    },
+    // Exception handler manipulation
+    {
+      prop: "setUncaughtExceptionCaptureCallback",
+      target: process,
+      violationType: "process_exception_handler",
+      strategy: "throw",
+      reason: "setUncaughtExceptionCaptureCallback could intercept security errors"
+    },
     // IPC communication vectors (may be undefined in non-IPC contexts)
     {
       prop: "send",
@@ -818,6 +870,42 @@ var WorkerDefenseInDepth = class {
     if (!excludeTypes.has("process_connected")) {
       this.protectProcessConnected();
     }
+    this.lockWellKnownSymbols();
+  }
+  /**
+   * Lock well-known Symbol properties on built-in constructors/prototypes.
+   */
+  lockWellKnownSymbols() {
+    const lock = (obj, sym) => {
+      try {
+        const desc = Object.getOwnPropertyDescriptor(obj, sym);
+        if (desc?.configurable) {
+          if ("value" in desc) {
+            Object.defineProperty(obj, sym, {
+              ...desc,
+              configurable: false,
+              writable: false
+            });
+            return;
+          }
+          Object.defineProperty(obj, sym, { ...desc, configurable: false });
+        }
+      } catch {
+      }
+    };
+    for (const ctor of [Array, Map, Set, RegExp, Promise]) {
+      lock(ctor, Symbol.species);
+    }
+    for (const proto of [
+      Array.prototype,
+      String.prototype,
+      Map.prototype,
+      Set.prototype
+    ]) {
+      lock(proto, Symbol.iterator);
+    }
+    lock(Symbol.prototype, Symbol.toPrimitive);
+    lock(Date.prototype, Symbol.toPrimitive);
   }
   /**
    * Protect against .constructor.constructor escape vector.
@@ -1814,6 +1902,26 @@ var SyncFsBackend = class {
 // src/commands/python3/worker.ts
 import { readFileSync } from "node:fs";
 var require2 = createRequire(import.meta.url);
+var CPYTHON_ENTRY_BASENAME = "/vendor/cpython-emscripten/python.cjs";
+var CPYTHON_STDLIB_BASENAME = "/vendor/cpython-emscripten/python313.zip";
+var moduleLoadGuardInstalled = false;
+function normalizePath(path) {
+  return path.replace(/\\/g, "/");
+}
+function isApprovedCpythonEntryPath(path) {
+  return normalizePath(path).endsWith(CPYTHON_ENTRY_BASENAME);
+}
+function isApprovedStdlibZipPath(path) {
+  return normalizePath(path).endsWith(CPYTHON_STDLIB_BASENAME);
+}
+function assertApprovedPath(path, kind) {
+  const ok = kind === "cpython-entry" ? isApprovedCpythonEntryPath(path) : isApprovedStdlibZipPath(path);
+  if (!ok) {
+    throw new Error(
+      `[Defense-in-depth] rejected ${kind} path outside approved vendor bundle: ${path}`
+    );
+  }
+}
 try {
   const NodeModule = require2("node:module");
   if (typeof NodeModule._load === "function") {
@@ -1854,18 +1962,22 @@ try {
       }
       return originalLoad.apply(this, [request, ...rest]);
     };
+    moduleLoadGuardInstalled = true;
   }
 } catch {
 }
-var cpythonDir;
+var cpythonEntryPath;
 try {
-  cpythonDir = dirname(
-    require2.resolve("../../../vendor/cpython-emscripten/python.cjs")
+  cpythonEntryPath = require2.resolve(
+    "../../../vendor/cpython-emscripten/python.cjs"
   );
 } catch (_e) {
-  cpythonDir = dirname(import.meta.url).replace("file://", "") + "/../../../vendor/cpython-emscripten";
+  cpythonEntryPath = dirname(import.meta.url).replace("file://", "") + "/../../../vendor/cpython-emscripten/python.cjs";
 }
+assertApprovedPath(cpythonEntryPath, "cpython-entry");
+var cpythonDir = dirname(cpythonEntryPath);
 var stdlibZipPath = `${cpythonDir}/python313.zip`;
+assertApprovedPath(stdlibZipPath, "cpython-stdlib");
 function createHOSTFS(backend, FS, PATH) {
   const ERRNO_CODES = {
     EPERM: 63,
@@ -2641,9 +2753,22 @@ sys.modules['jb_http'] = jb_http
 `;
 }
 var cachedStdlibZip = new Uint8Array(readFileSync(stdlibZipPath));
-function postWorkerMessage(message) {
+function wrapWorkerMessage(protocolToken, message) {
+  const wrapped = /* @__PURE__ */ Object.create(null);
+  if (!message || typeof message !== "object") {
+    wrapped.success = false;
+    wrapped.error = "Worker attempted to post non-object message";
+    wrapped.protocolToken = protocolToken;
+    return wrapped;
+  }
+  for (const [key, value] of Object.entries(message))
+    wrapped[key] = value;
+  wrapped.protocolToken = protocolToken;
+  return wrapped;
+}
+function postWorkerMessage(protocolToken, message) {
   try {
-    parentPort?.postMessage(message);
+    parentPort?.postMessage(wrapWorkerMessage(protocolToken, message));
   } catch (error) {
     console.debug(
       "[python3-worker] failed to post worker message:",
@@ -2652,8 +2777,15 @@ function postWorkerMessage(message) {
   }
 }
 async function runPython(input) {
+  if (!moduleLoadGuardInstalled) {
+    return {
+      success: false,
+      error: "Defense-in-depth module-loader guard failed to initialize; refusing to execute Python worker"
+    };
+  }
   const backend = new SyncFsBackend(input.sharedBuffer);
-  const createPythonModule = require2(`${cpythonDir}/python.cjs`);
+  assertApprovedPath(cpythonEntryPath, "cpython-entry");
+  const createPythonModule = require2(cpythonEntryPath);
   let moduleReady = false;
   const pendingStdout = [];
   const pendingStderr = [];
@@ -2711,7 +2843,7 @@ async function runPython(input) {
       error: `Failed to load CPython: ${message}`
     };
   }
-  activateDefense();
+  activateDefense(input.protocolToken);
   moduleReady = true;
   for (const text of pendingStdout) backend.writeStdout(text);
   for (const text of pendingStderr) backend.writeStderr(text);
@@ -2775,7 +2907,7 @@ sys.exit(_jb_exit_code)
   }
 }
 var defense = null;
-function activateDefense() {
+function activateDefense(protocolToken) {
   if (defense) return;
   const _DateNow = Date.now;
   const degraded = { now: () => _DateNow(), timeOrigin: _DateNow() };
@@ -2788,7 +2920,10 @@ function activateDefense() {
     "python3-worker",
     "onViolation",
     (v) => {
-      postWorkerMessage({ type: "security-violation", violation: v });
+      postWorkerMessage(protocolToken, {
+        type: "security-violation",
+        violation: v
+      });
     }
   );
   defense = new WorkerDefenseInDepth({
@@ -2805,20 +2940,26 @@ function activateDefense() {
   });
 }
 process.on("uncaughtException", (e) => {
+  if (!activeProtocolToken) {
+    return;
+  }
   const message = sanitizeErrorMessage(e.message);
-  postWorkerMessage({
+  postWorkerMessage(activeProtocolToken, {
     success: false,
     error: `Worker uncaught exception: ${message}`
   });
 });
+var activeProtocolToken = null;
 if (parentPort) {
   if (workerData) {
-    runPython(workerData).then((result) => {
+    const input = workerData;
+    activeProtocolToken = input.protocolToken;
+    runPython(input).then((result) => {
       result.defenseStats = defense?.getStats();
-      postWorkerMessage(result);
+      postWorkerMessage(input.protocolToken, result);
     }).catch((e) => {
       const message = sanitizeUnknownError(e);
-      postWorkerMessage({
+      postWorkerMessage(input.protocolToken, {
         success: false,
         error: message,
         defenseStats: defense?.getStats()

package/dist/bundle/chunks/xan-KSDYKKEK.js

@@ -0,0 +1 @@
+import{a,b}from"./chunk-4YPFHVJJ.js";import"./chunk-F55TLFGB.js";import"./chunk-SYMJJMQ4.js";import"./chunk-KZ7BI7TV.js";import"./chunk-DZZS6SJP.js";import"./chunk-OJDRYQWQ.js";import"./chunk-X36DXRVC.js";import"./chunk-72EQZSVH.js";import"./chunk-YNYSPYQ5.js";import"./chunk-7L36YK2X.js";import"./chunk-GFQRA5P5.js";import"./chunk-NUFRM6SI.js";import"./chunk-74CEPOFO.js";import"./chunk-DXB73IDG.js";export{b as flagsForFuzzing,a as xanCommand};

package/dist/bundle/chunks/yq-HIQ4WMDY.js

@@ -0,0 +1 @@
+import{a,b}from"./chunk-C7ZTXK5C.js";import"./chunk-SYMJJMQ4.js";import"./chunk-KZ7BI7TV.js";import"./chunk-DZZS6SJP.js";import"./chunk-OJDRYQWQ.js";import"./chunk-X36DXRVC.js";import"./chunk-72EQZSVH.js";import"./chunk-YNYSPYQ5.js";import"./chunk-GFQRA5P5.js";import"./chunk-CCNMISUL.js";import"./chunk-74CEPOFO.js";import"./chunk-DXB73IDG.js";export{b as flagsForFuzzing,a as yqCommand};