quickjs-emscripten-sync 1.0.0 → 1.3.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021 rot1024
+Copyright (c) 2022 rot1024
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+SOFTWARE.

package/README.md

@@ -0,0 +1,303 @@
+# quickjs-emscripten-sync
+
+[![CI](https://github.com/reearth/quickjs-emscripten-sync/actions/workflows/ci.yml/badge.svg)](https://github.com/reearth/quickjs-emscripten-sync/actions/workflows/main.yml) [![codecov](https://codecov.io/gh/reearth/quickjs-emscripten-sync/branch/main/graph/badge.svg)](https://codecov.io/gh/reearth/quickjs-emscripten-sync)
+
+Build a secure plugin system in web browsers
+
+This library wraps [quickjs-emscripten](https://github.com/justjake/quickjs-emscripten) and provides a way to sync object state between the browser and sandboxed QuickJS.
+
+- Exchange and sync values between the browser (host) and QuickJS seamlessly
+  - Primitives (number, boolean, string, symbol)
+  - Arrays
+  - Functions
+  - Classes and instances
+  - Objects with prototypes and any property descriptors
+- Expose objects as a global object in QuickJS
+- Marshaling limitation for specific objects
+- Register a pair of objects that will be considered the same between the browser and QuickJS
+
+```
+npm install quickjs-emscripten quickjs-emscripten-sync
+```
+
+```js
+import { getQuickJS } from "quickjs-emscripten";
+import { Arena } from "quickjs-emscripten-sync";
+
+class Cls {
+  field = 0;
+
+  method() {
+    return ++this.field;
+  }
+}
+
+const vm = (await getQuickJS()).createVm();
+const arena = new Arena(vm, { isMarshalable: true });
+
+// We can pass objects to the VM and run code safely
+const exposed = {
+  Cls,
+  cls: new Cls(),
+  syncedCls: arena.sync(new Cls()),
+};
+arena.expose(exposed);
+
+arena.evalCode(`cls instanceof Cls`); // returns true
+arena.evalCode(`cls.field`);          // returns 0
+arena.evalCode(`cls.method()`);       // returns 1
+arena.evalCode(`cls.field`);          // returns 1
+
+arena.evalCode(`syncedCls.field`);     // returns 0
+exposed.syncedCls.method();            // returns 1
+arena.evalCode(`syncedCls.field`);     // returns 1
+
+arena.dispose();
+vm.dispose();
+```
+
+[Example code](src/index.test.ts) is available as the unit test code.
+
+## Operating Environment
+
+- Web browsers that support WebAssembly
+- Node.js
+
+If you want to run quickjs-emscripten and quickjs-emscripten-sync in a web browser, they have to be bundled with a bundler tool such as webpack, because quickjs-emscripten is now written in CommonJS format and web browsers cannot load it directly.
+
+## Usage
+
+```js
+import { getQuickJS } from "quickjs-emscripten";
+import { Arena } from "quickjs-emscripten-sync";
+
+(async function() {
+  const quickjs = await getQuickJS();
+  const vm = quickjs.createVm();
+
+  // init Arena
+  // ⚠️ Marshaling is opt-in for security reasons.
+  // ⚠️ Be careful when activating marshalling.
+  const arena = new Arena(vm, { isMarshalable: true });
+
+  // expose objects as global objects in QuickJS VM
+  arena.expose({
+    console: {
+      log: console.log
+    }
+  });
+  arena.evalCode(`console.log("hello, world");`); // run console.log
+  arena.evalCode(`1 + 1`); // 2
+
+  // expose objects but also enable sync
+  const data = arena.sync({ hoge: "foo" });
+  arena.expose({ data });
+
+  arena.evalCode(`data.hoge = "bar"`);
+  // eval code and operations to exposed objects are automatically synced
+  console.log(data.hoge); // "bar"
+  data.hoge = "changed!";
+  console.log(arena.evalCode(`data.hoge`)); // "changed!"
+
+  // Don't forget calling arena.dispose() before disposing QuickJS VM!
+  arena.dispose();
+  vm.dispose();
+})();
+```
+
+## Marshaling Limitations
+
+Objects are automatically converted when they cross between the host and the QuickJS VM. The conversion of a host's object to a VM handle is called marshaling, and the conversion of a VM handle to a host's object is called unmarshaling.
+
+And for marshalling, it is possible to control whether the conversion is performed or not.
+
+For example, exposing the host's global object to QuickJS is very heavy and dangerous. This exposure can be limited and controlled with the `isMarshalable` option. If `false` is returned, just `undefined` is passed to QuickJS.
+
+```js
+import { Arena, complexity } from "quickjs-emscripten-sync";
+
+const arena = new Arena(vm, {
+  isMarshalable: (target: any) => {
+    // prevent passing globalThis to QuickJS
+    if (target === window) return false;
+    // complexity is a helper function to detect whether the object is heavy
+    if (complexity(target, 30) >= 30) return false;
+    return true; // other objects are OK
+  }
+});
+
+arena.evalCode(`a => a === undefined`)({});       // false
+arena.evalCode(`a => a === undefined`)(window); // true
+arena.evalCode(`a => a === undefined`)(document); // true
+```
+
+The `complexity` function is useful to detect whether the object is too heavy to be passed to QuickJS.
+
+## Security Warning
+
+QuickJS has an environment isolated from the browser, so any code can be executed safely, but there are edge cases where some exposed objects by quickjs-emscripten-sync may break security.
+
+quickjs-emscripten-sync cannot prevent such dangerous case, so **PLEASE be very careful and deliberate about what you expose to QuickJS!**
+
+### Case 1: Prototype pollution
+
+```js
+import { set } from "lodash-es";
+
+arena.expose({
+  danger: (keys, value) => {
+    // This function may cause prototype pollution in the browser by QuickJS
+    set({}, keys, value)
+  }
+});
+
+arena.evalCode(`danger("__proto__.a", () => { /* injected */ })`);
+```
+
+### Case 2: Unintended HTTP request
+
+It is very dangerous to expose or use directly or indirectly the `window` object, `localStorage`, `fetch`, `XMLHttpRequest` ...
+
+This is because it enables the execution of unintended code such as XSS attacks, such as reading local storage, sending unintended HTTP requests, and manipulating DOM objects.
+
+```js
+arena.expose({
+  // This function may cause unintended HTTP requests
+  danger: (url, body) => {
+    fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+  }
+});
+
+arena.evalCode(`danger("/api", { dangerous: true })`);
+```
+
+By default, quickjs-emscripten-sync doesn't prevent any marshaling, even in such cases. And there are many built-in objects in the host, so please note that it's hard to prevent all dangerous cases with the `isMarshalable` option alone.
+
+## API
+
+### `Arena`
+
+The Arena class manages all generated handles at once by quickjs-emscripten and automatically converts objects between the host and the QuickJS VM.
+
+#### `new Arena(vm: QuickJSVm, options?: Options)`
+
+Constructs a new Arena instance. It requires a quickjs-emscripten VM initialized with `quickjs.createVM()`.
+
+Options accepted:
+
+```ts
+type Options = {
+  isMarshalable?: boolean | "json" | ((target: any) => boolean | "json");
+  registeredObjects?: Iterable<[any, QuickJSHandle | string]>;
+}
+```
+
+- **`isMarshalable`**: Determines how marshalling will be done when sending objects from the host to the VM. **Make sure to set the marshalling to be the minimum necessary as it may reduce the security of your application.** [Please read the section on security above.](#security-warning)
+   - `"json"` (**default**, safety): Target object will be serialized as JSON in host and then parsed in VM. Functions and classes will be lost in the process.
+   - `false` (safety): Target object will not be always marshalled as `undefined`.
+   - `(target: any) => boolean | "json"` (recoomended): You can control marshalling mode for each objects. If you want to do marshalling, usually use this method. Allow partial marshalling by returning `true` only for some objects.
+   - `true` (**risky and not recommended**): Target object will be always marshaled. This setting may reduce security.
+- **`registeredObjects`**: You can pre-register a pair of objects that will be considered the same between the host and the QuickJS VM. This will be used automatically during the conversion. By default, it will be registered automatically with [`defaultRegisteredObjects`](src/default.ts). If you want to add a new pair to this, please do the following:
+
+```js
+import { defaultRegisteredObjects } from "quickjs-emscripten-sync";
+
+const arena = new Arena(vm, {
+  registeredObjects: [
+    ...defaultRegisteredObjects,
+    [Math, "Math"]
+  ]
+});
+```
+
+Instead of a string, you can also pass a QuickJSHandle directly. In that case, however, you have to dispose of them manually when destroying the VM.
+
+#### `dispose()`
+
+Dispose of the arena and managed handles. This method won't dispose the VM itself, so the VM has to be disposed of manually.
+
+#### `evalCode<T = any>(code: string): T | undefined`
+
+Evaluate JS code in the VM and get the result as an object on the host side. It also converts and re-throws error objects when an error is thrown during evaluation.
+
+#### `executePendingJobs(): number`
+
+Almost same as `vm.executePendingJobs()`, but it converts and re-throws error objects when an error is thrown during evaluation.
+
+#### `expose(obj: { [k: string]: any })`
+
+Expose objects as global objects in the VM.
+
+By default, exposed objects are not synchronized between the host and the VM.
+If you want to sync an objects, first wrap the object with `sync` method, and then expose the wrapped object.
+
+#### `sync<T>(target: T): T`
+
+Enables sync for the object between the host and the VM and returns objects wrapped with proxies.
+
+The return value is necessary in order to reflect changes to the object from the host to the VM. Please note that setting a value in the field or deleting a field in the original object will not synchronize it.
+
+#### `register(target: any, code: string | QuickJSHandle)`
+
+Register a pair of objects that will be considered the same between the host and the QuickJS VM.
+
+#### `unregisterAll(targets: Iterable<[any, string | QuickJSHandle]>)`
+
+Execute `register` methods for each pair.
+
+#### `unregister(target: any)`
+
+Unregister a pair of objects that were registered with `registeredObjects` option and `register` method.
+
+#### `unregisterAll(targets: Iterable<any>)`
+
+Execute `unregister` methods for each target.
+
+### `defaultRegisteredObjects: [any, string][]`
+
+Default value of registeredObjects option of the Arena class constructor.
+
+### `complexity(target: any, max?: number): number`
+
+Measure the complexity of an object as you traverse the field and prototype chain. If max is specified, when the complexity reaches max, the traversal is terminated and it returns the max. In this function, one object and function are counted as a complexity of 1, and primitives are not counted as a complexity.
+
+## Advanced
+
+### How to work
+
+quickjs-emscripten can execute JS code safely, but it requires to deal with a lot of handles and lifetimes. Also, when destroying the VM, any un-destroyed handle will result in an error.
+
+quickjs-emscripten-sync will automatically manage all handles once generated by QuickJS VM in an Arena class.
+And it will automatically "marshal" objects as handles and "unmarshal" handles as objects to enable seamless data exchange between the browser and QuickJS. It recursively traverses the object properties and prototype chain to transform objects. A function is called after its arguments and this arg are automatically converted for the environment in which the function is defined. The return value will be automatically converted to match the environment of the caller.
+Most objects are wrapped by proxies during conversion, allowing "set" and "delete" operations on objects to be synchronized between the browser and QuickJS.
+
+### Limitations
+
+#### Class constructor
+
+When initializing a new instance, it is not possible to fully proxy this arg (a.k.a. `new.target`) inside the class constructor. Therefore, after the constructor call, the fields set for this are re-set to this on the VM side. Therefore, there may be some edge cases where the constructor may not work properly.
+
+```js
+class Cls {
+  constructor() {
+    this.hoge = "foo";
+  }
+}
+
+arena.expose({ Cls });
+arena.evalCode(`new Cls()`); // Cls { hoge: "foo" }
+```
+
+#### Operation synchronization
+
+For now, only the `set` and `deleteProperty` operations on objects are subject to synchronization. The result of `Object.defineProperty` on a proxied object will not be synchronized to the other side.
+
+## License
+
+[MIT License](LICENSE)

package/dist/index.d.ts

@@ -1,26 +1,13 @@
-import { QuickJSHandle, QuickJSVm } from "quickjs-emscripten";
-import { SuccessOrFail, VmCallResult } from "quickjs-emscripten/dist/vm-interface";
-import VMMap from "./vmmap";
-import marshal from "./marshal";
-import unmarshal from "./unmarshal";
-import { Wrapped } from "./wrapper";
-import { complexity, isES2015Class, isObject, walkObject } from "./util";
-import { call, eq, isHandleObject, send, consumeAll } from "./vmutil";
-import { defaultRegisteredObjects } from "./default";
-export { Arena, VMMap, defaultRegisteredObjects, marshal, unmarshal, complexity, isES2015Class, isObject, walkObject, call, eq, isHandleObject, send, consumeAll, };
-export declare type Options = {
-    /** A callback that returns a boolean value that determines whether an object is marshalled or not. If false, no marshaling will be done and undefined will be passed to the QuickJS VM, otherwise marshaling will be done. By default, all objects will be marshalled. */
-    isMarshalable?: (target: any) => boolean;
-    /** You can pre-register a pair of objects that will be considered the same between the browser and the QuickJS VM. This will be used automatically during the conversion. By default, it will be registered automatically with `defaultRegisteredObjects`.
-     *
-     * Instead of a string, you can also pass a QuickJSHandle directly. In that case, however, you have to dispose of them manually when destroying the VM.
-     */
-    registeredObjects?: Iterable<[any, QuickJSHandle | string]>;
-};
+import type { QuickJSDeferredPromise } from 'quickjs-emscripten';
+import { QuickJSHandle } from 'quickjs-emscripten';
+import { QuickJSVm } from 'quickjs-emscripten';
+import type { SuccessOrFail } from 'quickjs-emscripten/dist/vm-interface';
+import type { VmCallResult } from 'quickjs-emscripten/dist/vm-interface';
+
 /**
- * The Arena class manages all generated handles at once by quickjs-emscripten and automatically converts objects between browser and QuickJS.
+ * The Arena class manages all generated handles at once by quickjs-emscripten and automatically converts objects between the host and the QuickJS VM.
  */
-export default class Arena {
+export declare class Arena {
     vm: QuickJSVm;
     _map: VMMap;
     _registeredMap: VMMap;
@@ -37,7 +24,7 @@ export default class Arena {
      */
     dispose(): void;
     /**
-     * Evaluate JS code in the VM and get the result as an object on the browser side. It also converts and re-throws error objects when an error is thrown during evaluation.
+     * Evaluate JS code in the VM and get the result as an object on the host side. It also converts and re-throws error objects when an error is thrown during evaluation.
      */
     evalCode<T = any>(code: string): T;
     /**
@@ -47,13 +34,20 @@ export default class Arena {
     /**
      * Expose objects as global objects in the VM.
      *
-     * If sync is true, this function returns objects wrapped with proxies. This is necessary in order to reflect changes to the object from the browser side to the VM side. Please note that setting a value in the field or deleting a field in the original object will not synchronize it.
+     * By default, exposed objects are not synchronized between the host and the VM.
+     * If you want to sync an objects, first wrap the object with sync method, and then expose the wrapped object.
      */
-    expose<T extends {
+    expose(obj: {
         [k: string]: any;
-    }>(obj: T, sync?: boolean): T;
+    }): void;
     /**
-     * Register a pair of objects that will be considered the same between the browser and the QuickJS VM.
+     * Enables sync for the object between the host and the VM and returns objects wrapped with proxies.
+     *
+     * The return value is necessary in order to reflect changes to the object from the host to the VM. Please note that setting a value in the field or deleting a field in the original object will not synchronize it.
+     */
+    sync<T>(target: T): T;
+    /**
+     * Register a pair of objects that will be considered the same between the host and the QuickJS VM.
      *
      * Instead of a string, you can also pass a QuickJSHandle directly. In that case, however, when  you have to dispose them manually when destroying the VM.
      */
@@ -74,12 +68,118 @@ export default class Arena {
     endSync(target: any): void;
     _unwrapResult<T>(result: SuccessOrFail<T, QuickJSHandle>): T;
     _unwrapResultAndUnmarshal(result: VmCallResult<QuickJSHandle> | undefined): any;
-    _marshal(target: any): QuickJSHandle;
-    _unmarshal(handle: QuickJSHandle): any;
+    _isMarshalable: (t: unknown) => boolean | "json";
+    _marshalFind: (t: unknown) => QuickJSHandle | undefined;
+    _marshalPre: (t: unknown, h: QuickJSHandle | QuickJSDeferredPromise, mode: true | "json" | undefined) => Wrapped<QuickJSHandle> | undefined;
+    _marshalPreApply: (target: Function, that: unknown, args: unknown[]) => void;
+    _marshal: (target: any) => [QuickJSHandle, boolean];
+    _preUnmarshal: (t: any, h: QuickJSHandle) => Wrapped<any>;
+    _unmarshalFind: (h: QuickJSHandle) => unknown;
+    _unmarshal: (handle: QuickJSHandle) => any;
     _register(t: any, h: QuickJSHandle, map?: VMMap, sync?: boolean): [Wrapped<any>, Wrapped<QuickJSHandle>] | undefined;
-    _syncMode(obj: any): "both" | undefined;
+    _syncMode: (obj: any) => "both" | undefined;
     _wrap<T>(target: T): Wrapped<T> | undefined;
     _unwrap<T>(target: T): T;
+    _unwrapIfNotSynced: <T>(target: T) => T;
     _wrapHandle(handle: QuickJSHandle): [Wrapped<QuickJSHandle> | undefined, boolean];
     _unwrapHandle(target: QuickJSHandle): [QuickJSHandle, boolean];
 }
+
+export declare function call(vm: QuickJSVm, code: string, thisArg?: QuickJSHandle, ...args: QuickJSHandle[]): QuickJSHandle;
+
+/**
+ * Measure the complexity of an object as you traverse the field and prototype chain. If max is specified, when the complexity reaches max, the traversal is terminated and it returns the max. In this function, one object and function are counted as a complexity of 1, and primitives are not counted as a complexity.
+ */
+export declare function complexity(value: any, max?: number): number;
+
+export declare function consumeAll<T extends QuickJSHandle[], K>(handles: T, cb: (handles: T) => K): K;
+
+/**
+ * Default value of registeredObjects option of the Arena class constructor.
+ */
+export declare const defaultRegisteredObjects: [any, string][];
+
+export declare function eq(vm: QuickJSVm, a: QuickJSHandle, b: QuickJSHandle): boolean;
+
+export declare function isES2015Class(cls: any): cls is new (...args: any[]) => any;
+
+export declare function isHandleObject(vm: QuickJSVm, a: QuickJSHandle): boolean;
+
+export declare function isObject(value: any): value is object | Function;
+
+export declare function json(vm: QuickJSVm, target: any): QuickJSHandle;
+
+export declare function marshal(target: unknown, options: Options_2): QuickJSHandle;
+
+export declare type Options = {
+    /** A callback that returns a boolean value that determines whether an object is marshalled or not. If false, no marshaling will be done and undefined will be passed to the QuickJS VM, otherwise marshaling will be done. By default, all objects will be marshalled. */
+    isMarshalable?: boolean | "json" | ((target: any) => boolean | "json");
+    /** You can pre-register a pair of objects that will be considered the same between the host and the QuickJS VM. This will be used automatically during the conversion. By default, it will be registered automatically with `defaultRegisteredObjects`.
+     *
+     * Instead of a string, you can also pass a QuickJSHandle directly. In that case, however, you have to dispose of them manually when destroying the VM.
+     */
+    registeredObjects?: Iterable<[any, QuickJSHandle | string]>;
+};
+
+declare type Options_2 = {
+    vm: QuickJSVm;
+    unmarshal: (handle: QuickJSHandle) => unknown;
+    isMarshalable?: (target: unknown) => boolean | "json";
+    find: (target: unknown) => QuickJSHandle | undefined;
+    pre: (target: unknown, handle: QuickJSHandle | QuickJSDeferredPromise, mode: true | "json" | undefined) => QuickJSHandle | undefined;
+    preApply?: (target: Function, thisArg: unknown, args: unknown[]) => any;
+};
+
+declare type Options_3 = {
+    vm: QuickJSVm;
+    /** marshal returns handle and boolean indicates that the handle should be disposed after use */
+    marshal: (target: unknown) => [QuickJSHandle, boolean];
+    find: (handle: QuickJSHandle) => unknown | undefined;
+    pre: <T = unknown>(target: T, handle: QuickJSHandle) => T | undefined;
+};
+
+export declare function unmarshal(handle: QuickJSHandle, options: Options_3): any;
+
+export declare class VMMap {
+    vm: QuickJSVm;
+    _map1: Map<any, number>;
+    _map2: Map<any, number>;
+    _map3: Map<number, QuickJSHandle>;
+    _map4: Map<number, QuickJSHandle>;
+    _counterMap: Map<number, any>;
+    _disposables: Set<QuickJSHandle>;
+    _mapGet: QuickJSHandle;
+    _mapSet: QuickJSHandle;
+    _mapDelete: QuickJSHandle;
+    _mapClear: QuickJSHandle;
+    _counter: number;
+    constructor(vm: QuickJSVm);
+    set(key: any, handle: QuickJSHandle, key2?: any, handle2?: QuickJSHandle): boolean;
+    merge(iteratable: Iterable<[any, QuickJSHandle | undefined] | [any, QuickJSHandle | undefined, any, QuickJSHandle | undefined]> | undefined): void;
+    get(key: any): QuickJSHandle | undefined;
+    getByHandle(handle: QuickJSHandle): any;
+    has(key: any): boolean;
+    hasHandle(handle: QuickJSHandle): boolean;
+    keys(): IterableIterator<any>;
+    delete(key: any, dispose?: boolean): void;
+    deleteByHandle(handle: QuickJSHandle, dispose?: boolean): void;
+    clear(): void;
+    dispose(): void;
+    get size(): number;
+    [Symbol.iterator](): Iterator<[
+    any,
+    QuickJSHandle,
+    any,
+    QuickJSHandle | undefined
+    ]>;
+    _get2(num: number): any;
+    _call(fn: QuickJSHandle, thisArg: QuickJSHandle | undefined, ...args: QuickJSHandle[]): QuickJSHandle;
+}
+
+export declare function walkObject(value: any, callback?: (target: any, set: Set<any>) => boolean | void): Set<any>;
+
+declare type Wrapped<T> = T & {
+    __qes_wrapped: never;
+};
+
+export { }