roxxie-proxy-u-prod 0.1.0

package/source/packages/scramjet/packages/core/src/client/shared/err.ts

@@ -0,0 +1,55 @@
+import { flagEnabled } from "@/shared";
+import { ScramjetClient } from "@client/index";
+import { Reflect_apply } from "@/shared/snapshot";
+
+export const enabled = (client: ScramjetClient) =>
+	client.flagEnabled("captureErrors");
+export function argdbg(arg, recurse = []) {
+	switch (typeof arg) {
+		case "string":
+			break;
+		case "object":
+			if (
+				arg &&
+				arg[Symbol.iterator] &&
+				typeof arg[Symbol.iterator] === "function"
+			)
+				for (const prop in arg) {
+					// make sure it's not a getter
+					const desc = Object.getOwnPropertyDescriptor(arg, prop);
+					if (desc && desc.get) continue;
+
+					const ar = arg[prop];
+					if (recurse.includes(ar)) continue;
+					recurse.push(ar);
+					argdbg(ar, recurse);
+				}
+			break;
+	}
+}
+
+export default function (client: ScramjetClient, self: GlobalThis) {
+	const warn = console.warn;
+	self.$scramerr = function scramerr(e) {
+		warn("CAUGHT ERROR", e);
+	};
+
+	self.$scramdbg = function scramdbg(args, t) {
+		if (args && typeof args === "object" && args.length > 0) argdbg(args);
+		argdbg(t);
+
+		return t;
+	};
+
+	client.Proxy("Promise.prototype.catch", {
+		apply(ctx) {
+			if (ctx.args[0])
+				ctx.args[0] = new Proxy(ctx.args[0], {
+					apply(target, that, args) {
+						// console.warn("CAUGHT PROMISE REJECTION", args);
+						return Reflect_apply(target, that, args);
+					},
+				});
+		},
+	});
+}

package/source/packages/scramjet/packages/core/src/client/shared/error.ts

@@ -0,0 +1,42 @@
+import { unrewriteUrl } from "@rewriters/url";
+import { ScramjetClient } from "@client/index";
+
+export const enabled = (client: ScramjetClient) =>
+	client.flagEnabled("cleanErrors");
+
+export default function (client: ScramjetClient, _self: Self) {
+	// v8 only. all we need to do is clean the scramjet urls from stack traces
+	const closure = (error, stack) => {
+		let newstack = error.stack;
+
+		for (let i = 0; i < stack.length; i++) {
+			const url = stack[i].getFileName();
+
+			try {
+				if (client.config.maskedfiles.some((f) => url.endsWith(f))) {
+					// strip stack frames including scramjet handlers from the trace
+					const lines = newstack.split("\n");
+					const line = lines.find((l) => l.includes(url));
+					lines.splice(line, 1);
+					newstack = lines.join("\n");
+					continue;
+				}
+			} catch {}
+
+			try {
+				newstack = newstack.replaceAll(url, unrewriteUrl(url, client.context));
+			} catch {}
+		}
+
+		return newstack;
+	};
+	client.Trap("Error.prepareStackTrace", {
+		get(_ctx) {
+			// this is a funny js quirk. the getter is ran every time you type something in console
+			return closure;
+		},
+		set(_value) {
+			// just ignore it if a site tries setting their own. not much we can really do
+		},
+	});
+}

package/source/packages/scramjet/packages/core/src/client/shared/eval.ts

@@ -0,0 +1,40 @@
+import { rewriteJs } from "@rewriters/js";
+import { ScramjetClient } from "@client/index";
+import { Object_defineProperty, String } from "@/shared/snapshot";
+
+export default function (client: ScramjetClient, self: Self) {
+	// used for proxying *direct eval*
+	// eval("...") -> eval($scramjet$rewrite("..."))
+	Object_defineProperty(self, client.config.globals.rewritefn, {
+		value: function (js: any) {
+			// if eval is called on anything other than a string, we should just return it unchanged
+			// the one exception is TrustedScript, which can just be stringified and rewritten
+			if (client.box.instanceof(js, "TrustedScript")) js = String(js);
+			if (typeof js !== "string") return js;
+
+			const rewritten = rewriteJs(
+				js,
+				"(direct eval proxy)",
+				client.context,
+				client.meta
+			);
+
+			return rewritten;
+		},
+		writable: false,
+		configurable: false,
+	});
+}
+
+export function indirectEval(this: ScramjetClient, strict: boolean, js: any) {
+	// > If the argument of eval() is not a string, eval() returns the argument unchanged
+	// the one exception is TrustedScript, which can just be stringified and rewritten
+	if (this.box.instanceof(js, "TrustedScript")) js = String(js);
+	if (typeof js !== "string") return js;
+
+	const indirection: typeof eval = this.global.eval;
+
+	return indirection(
+		rewriteJs(js, "(indirect eval proxy)", this.context, this.meta) as string
+	);
+}

package/source/packages/scramjet/packages/core/src/client/shared/event.ts

@@ -0,0 +1,215 @@
+import { iswindow } from "@client/entry";
+import { ScramjetClient } from "@client/index";
+import { getOwnPropertyDescriptorHandler } from "@client/helpers";
+import {
+	Object_defineProperty,
+	Reflect_apply,
+	Reflect_get,
+	Reflect_ownKeys,
+	Symbol_for,
+} from "@/shared/snapshot";
+
+const realOnEvent = Symbol_for("scramjet original onevent function");
+
+export default function (client: ScramjetClient, self: Self) {
+	const handlers = {
+		message: {
+			_init() {
+				if (client.init.shouldBlockMessageEvent?.(this)) {
+					return false;
+				}
+
+				return true;
+			},
+			ports() {
+				// don't know why i have to do this?
+				return this.ports;
+			},
+			source() {
+				if (this.source === null) return null;
+
+				// const scram: ScramjetClient = this.source[SCRAMJETCLIENT];
+
+				// if (scram) return scram.globalProxy;
+
+				return this.source;
+			},
+			origin() {
+				if (!iswindow) return "";
+				if (typeof this.data === "object" && "$scramjet$origin" in this.data)
+					return this.data.$scramjet$origin;
+
+				return client.url.origin;
+			},
+			data() {
+				if (typeof this.data === "object" && "$scramjet$data" in this.data)
+					return this.data.$scramjet$data;
+
+				return this.data;
+			},
+		},
+		hashchange: {
+			oldURL() {
+				return client.unrewriteUrl(this.oldURL);
+			},
+			newURL() {
+				return client.unrewriteUrl(this.newURL);
+			},
+		},
+		storage: {
+			_init() {
+				return this.key.startsWith(client.url.host + "@");
+			},
+			key() {
+				return this.key.substring(this.key.indexOf("@") + 1);
+			},
+			url() {
+				return client.unrewriteUrl(this.url);
+			},
+		},
+	};
+
+	function wraplistener(listener: (...args: any) => any) {
+		return new Proxy(listener, {
+			apply(target, that, args) {
+				const realEvent: Event = args[0];
+
+				// we only need to handle events dispatched from the browser
+				if (realEvent.isTrusted) {
+					const type = realEvent.type;
+
+					if (type in handlers) {
+						const handler = handlers[type];
+
+						if (handler._init) {
+							// if _init returns false, we skip the event, and it never dispatches to listeners
+							if (handler._init.call(realEvent) === false) return;
+						}
+
+						args[0] = new Proxy(realEvent, {
+							get(target, prop, reciever) {
+								const value = Reflect_get(target, prop);
+								if (prop in handler) {
+									return handler[prop].call(target);
+								}
+
+								if (typeof value === "function") {
+									return new Proxy(value, {
+										apply(target, that, args) {
+											if (that === reciever) {
+												return Reflect_apply(target, realEvent, args);
+											}
+
+											return Reflect_apply(target, that, args);
+										},
+									});
+								}
+
+								return value;
+							},
+							getOwnPropertyDescriptor: getOwnPropertyDescriptorHandler,
+						});
+					}
+				}
+
+				if (!self.event) {
+					Object_defineProperty(self, "event", {
+						get() {
+							return args[0];
+						},
+						configurable: true,
+					});
+				}
+
+				const rv = Reflect_apply(target, that, args);
+
+				return rv;
+			},
+			getOwnPropertyDescriptor: getOwnPropertyDescriptorHandler,
+		});
+	}
+
+	client.Proxy("EventTarget.prototype.addEventListener", {
+		apply(ctx) {
+			if (typeof ctx.args[1] !== "function") return;
+
+			const origlistener = ctx.args[1];
+			const proxylistener = wraplistener(origlistener);
+
+			ctx.args[1] = proxylistener;
+
+			let arr = client.eventcallbacks.get(ctx.this);
+			arr ||= [] as any;
+			arr.push({
+				event: ctx.args[0] as string,
+				originalCallback: origlistener,
+				proxiedCallback: proxylistener,
+			});
+			client.eventcallbacks.set(ctx.this, arr);
+		},
+	});
+
+	client.Proxy("EventTarget.prototype.removeEventListener", {
+		apply(ctx) {
+			if (typeof ctx.args[1] !== "function") return;
+
+			const arr = client.eventcallbacks.get(ctx.this);
+			if (!arr) return;
+
+			const i = arr.findIndex(
+				(e) => e.event === ctx.args[0] && e.originalCallback === ctx.args[1]
+			);
+			if (i === -1) return;
+
+			const r = arr.splice(i, 1);
+			client.eventcallbacks.set(ctx.this, arr);
+
+			ctx.args[1] = r[0].proxiedCallback;
+		},
+	});
+
+	const targets = [
+		self.self,
+		self.MessagePort.prototype,
+		self.BroadcastChannel.prototype,
+	] as Array<any>;
+	if (iswindow) targets.push(self.HTMLElement.prototype);
+	if (self.Worker) targets.push(self.Worker.prototype);
+
+	for (const target of targets) {
+		const keys = Reflect_ownKeys(target);
+
+		for (const key of keys) {
+			if (
+				typeof key === "string" &&
+				key.startsWith("on") &&
+				handlers[key.slice(2)]
+			) {
+				const descriptor = client.natives.call(
+					"Object.getOwnPropertyDescriptor",
+					null,
+					target,
+					key
+				);
+				if (!descriptor.get || !descriptor.set || !descriptor.configurable)
+					continue;
+
+				// these are the `onmessage`, `onclick`, etc. properties
+				client.RawTrap(target, key, {
+					get(ctx) {
+						if (this[realOnEvent]) return this[realOnEvent];
+
+						return ctx.get();
+					},
+					set(ctx, value: any) {
+						this[realOnEvent] = value;
+
+						if (typeof value !== "function") return ctx.set(value);
+
+						ctx.set(wraplistener(value));
+					},
+				});
+			}
+		}
+	}
+}

package/source/packages/scramjet/packages/core/src/client/shared/function.ts

@@ -0,0 +1,59 @@
+import { rewriteJs } from "@rewriters/js";
+import { ScramjetClient, ProxyCtx, Proxy } from "@client/index";
+
+function rewriteFunction<T extends string, U extends "construct" | "apply">(
+	ctx: ProxyCtx<T, U>,
+	client: ScramjetClient
+) {
+	const stringifiedFunction = ctx.call().toString();
+
+	// TODO: also check if the function comes from a weird realm. if so we need to completely block it or do something else weird
+	// not much point rewriting the javascript if it's executing in the top level
+
+	const content = rewriteJs(
+		`return ${stringifiedFunction}`,
+		"(function proxy)",
+		client.context,
+		client.meta
+	);
+	ctx.return(ctx.fn(content)());
+}
+
+export default function (client: ScramjetClient, _self: Self) {
+	const handler: Proxy = {
+		apply(ctx: ProxyCtx) {
+			rewriteFunction(ctx, client);
+		},
+		construct(ctx) {
+			rewriteFunction(ctx, client);
+		},
+	};
+
+	client.Proxy("Function", handler);
+
+	const RawFunction = client.natives.call(
+		"eval",
+		null,
+		"(function () {})"
+	).constructor;
+	const RawAsyncFunction = client.natives.call(
+		"eval",
+		null,
+		"(async function () {})"
+	).constructor;
+	const RawGeneratorFunction = client.natives.call(
+		"eval",
+		null,
+		"(function* () {})"
+	).constructor;
+	const RawAsyncGeneratorFunction = client.natives.call(
+		"eval",
+		null,
+		"(async function* () {})"
+	).constructor;
+
+	client.RawProxy(RawFunction.prototype, "constructor", handler);
+	client.RawProxy(RawAsyncFunction.prototype, "constructor", handler);
+	client.RawProxy(RawGeneratorFunction.prototype, "constructor", handler);
+	client.RawProxy(RawAsyncGeneratorFunction.prototype, "constructor", handler);
+}

package/source/packages/scramjet/packages/core/src/client/shared/import.ts

@@ -0,0 +1,46 @@
+import { ScramjetClient } from "@client/index";
+import { Object_defineProperty, _URL } from "@/shared/snapshot";
+
+export default function (client: ScramjetClient, self: Self) {
+	const boundimport = client.natives.call(
+		"Function",
+		null,
+		"url",
+		"return import(url)"
+	);
+
+	Object_defineProperty(self, client.config.globals.importfn, {
+		value: function (base: string, url: string) {
+			const resolved = new _URL(url, base).href;
+
+			if (
+				url.includes(":") ||
+				url.startsWith("/") ||
+				url.startsWith(".") ||
+				url.startsWith("..")
+			) {
+				// this is a url
+				return boundimport(client.rewriteUrl(resolved, { isModule: true }));
+			} else {
+				// this is a specifier handled by importmaps
+				return boundimport(url);
+			}
+		},
+		writable: false,
+		configurable: false,
+		enumerable: false,
+	});
+	Object_defineProperty(self, client.config.globals.metafn, {
+		value: function (metaobj: any, base: string) {
+			metaobj.url = base;
+			metaobj.resolve = function (url: string) {
+				return new _URL(url, base).href;
+			};
+
+			return metaobj;
+		},
+		writable: false,
+		configurable: false,
+		enumerable: false,
+	});
+}

package/source/packages/scramjet/packages/core/src/client/shared/indexeddb.ts

@@ -0,0 +1,18 @@
+import { ScramjetClient } from "@client/index";
+import { String } from "@/shared/snapshot";
+
+export default function (client: ScramjetClient) {
+	client.Proxy("IDBFactory.prototype.open", {
+		apply(ctx) {
+			ctx.args[0] = `${client.url.origin}@${ctx.args[0]}`;
+		},
+	});
+
+	client.Trap("IDBDatabase.prototype.name", {
+		get(ctx) {
+			const name = String(ctx.get());
+
+			return name.substring(name.indexOf("@") + 1);
+		},
+	});
+}

package/source/packages/scramjet/packages/core/src/client/shared/opfs.ts

@@ -0,0 +1,27 @@
+import { ScramjetClient } from "@client/index";
+import { Object_defineProperty } from "@/shared/snapshot";
+
+export default function (client: ScramjetClient) {
+	client.Proxy("StorageManager.prototype.getDirectory", {
+		apply(ctx) {
+			const rootPromise = ctx.call();
+			ctx.return(
+				(async () => {
+					const root = await rootPromise;
+					const directory = await root.getDirectoryHandle(
+						`${client.url.origin.replace(/\/|\s|\./g, "-")}`,
+						{
+							create: true,
+						}
+					);
+					Object_defineProperty(directory, "name", {
+						value: "",
+						writable: false,
+					});
+
+					return directory;
+				})()
+			);
+		},
+	});
+}

package/source/packages/scramjet/packages/core/src/client/shared/postmessage.ts

@@ -0,0 +1,113 @@
+import { iswindow } from "@client/entry";
+import { SCRAMJETCLIENT } from "@/symbols";
+import { ScramjetClient } from "@client/index";
+import { Object_defineProperty } from "@/shared/snapshot";
+import { POLLUTANT } from "./realm";
+
+export default function (client: ScramjetClient, self: Self) {
+	if (iswindow)
+		client.Proxy("window.postMessage", {
+			apply(ctx) {
+				// so we need to send the real origin here, since the recieving window can't possibly know.
+				// except, remember that this code is being ran in a different realm than the invoker, so if we ask our `client` it may give us the wrong origin
+				// if we were given any object that came from the real realm we can use that to get the real origin
+				// and this works in every case EXCEPT for the fact that all three arguments can be strings which are copied instead of cloned
+				// so we have to use `$setrealm` which will pollute this with an object from the real realm
+
+				let pollutant;
+
+				if (typeof ctx.args[0] === "object" && ctx.args[0] !== null) {
+					pollutant = ctx.args[0]; // try to use the first object we can find because it's more reliable
+				} else if (typeof ctx.args[2] === "object" && ctx.args[2] !== null) {
+					pollutant = ctx.args[2]; // next try to use transfer
+				} else if (
+					ctx.this &&
+					POLLUTANT in ctx.this &&
+					typeof ctx.this[POLLUTANT] === "object" &&
+					ctx.this[POLLUTANT] !== null
+				) {
+					pollutant = ctx.this[POLLUTANT]; // lastly try to use the object from $setrealm
+				} else {
+					pollutant = {}; // give up
+				}
+
+				// and now we can steal Function from the caller's realm
+				const {
+					constructor: { constructor: Function },
+				} = pollutant;
+
+				// invoking stolen function will give us the caller's globalThis, remember scramjet has already proxied it!!!
+				const callerGlobalThisProxied: Self = Function("return globalThis")();
+				const callerClient = callerGlobalThisProxied[SCRAMJETCLIENT];
+
+				// this WOULD be enough but the source argument of MessageEvent has to return the caller's window
+				// and if we just call it normally it would be coming from here, which WILL NOT BE THE CALLER'S because the accessor is from the parent
+				// so with the stolen function we wrap postmessage so the source will truly be the caller's window (remember that function is scramjet's!!!)
+				const wrappedPostMessage = Function("...args", "this(...args)");
+
+				// console.log(
+				// 	callerClient,
+				// 	client,
+				// 	callerGlobalThisProxied.document,
+				// 	self.document,
+				// 	callerClient === client
+				// );
+				const inherit =
+					callerClient.url.href === "about:srcdoc" ||
+					callerClient.url.href === "about:blank";
+				ctx.args[0] = {
+					$scramjet$messagetype: "window",
+					$scramjet$origin: inherit
+						? callerClient.global.parent[SCRAMJETCLIENT].url.origin
+						: callerClient.url.origin,
+					$scramjet$data: ctx.args[0],
+				};
+				// console.error("?", ctx.args);
+				// eval("debugger");
+
+				// * origin because obviously
+				if (typeof ctx.args[1] === "string") ctx.args[1] = "*";
+				if (typeof ctx.args[1] === "object") ctx.args[1].targetOrigin = "*";
+
+				ctx.return(wrappedPostMessage.call(ctx.fn, ...ctx.args));
+			},
+		});
+
+	client.Proxy("BroadcastChannel.prototype.postMessage", {
+		apply(ctx) {
+			ctx.args[0] = {
+				$scramjet$messagetype: "window",
+				// TODO: need to actually look up the broadcastchannel itself in box i think
+				$scramjet$origin: client.url.origin,
+				$scramjet$data: ctx.args[0],
+			};
+		},
+	});
+
+	const toproxy = ["MessagePort.prototype.postMessage"];
+
+	if (self.Worker) toproxy.push("Worker.prototype.postMessage");
+	if (!iswindow) toproxy.push("self.postMessage"); // only do the generic version if we're in a worker
+
+	client.Proxy(toproxy, {
+		apply(ctx) {
+			// origin/source doesn't need to be preserved - it's null in the message event
+
+			ctx.args[0] = {
+				$scramjet$messagetype: "worker",
+				$scramjet$data: ctx.args[0],
+			};
+		},
+	});
+	Object_defineProperty(self, client.config.globals.wrappostmessagefn, {
+		value: function (obj: any) {
+			if (!obj || typeof obj.postMessage !== "function") return obj;
+			return {
+				postMessage: obj.postMessage.bind(obj),
+			};
+		},
+		configurable: false,
+		writable: false,
+		enumerable: false,
+	});
+}

package/source/packages/scramjet/packages/core/src/client/shared/realm.ts

@@ -0,0 +1,26 @@
+import { ScramjetClient } from "@client/index";
+import { Object_defineProperty, Symbol_for } from "@/shared/snapshot";
+
+export const POLLUTANT = Symbol_for("scramjet realm pollutant");
+
+export default function (client: ScramjetClient, self: GlobalThis) {
+	// object.$setrealm({}).postMessage(...)
+	// the empty object is the "pollutant" which can reconstruct the real realm
+	// i explain more in postmessage.ts
+	Object_defineProperty(self.Object.prototype, "$scramjet$setrealmfn", {
+		value(pollution: object) {
+			// this is bad!! sites could detect this
+			Object_defineProperty(this, POLLUTANT, {
+				value: pollution,
+				writable: false,
+				configurable: true,
+				enumerable: false,
+			});
+
+			return this;
+		},
+		writable: true,
+		configurable: true,
+		enumerable: false,
+	});
+}

package/source/packages/scramjet/packages/core/src/client/shared/requests/eventsource.ts

@@ -0,0 +1,17 @@
+import { ScramjetClient } from "@client/index";
+import { String } from "@/shared/snapshot";
+
+export default function (client: ScramjetClient) {
+	client.Proxy("EventSource", {
+		construct(ctx) {
+			const url = String(ctx.args[0]);
+			ctx.args[0] = client.rewriteUrl(url);
+		},
+	});
+
+	client.Trap("EventSource.prototype.url", {
+		get(ctx) {
+			return client.unrewriteUrl(ctx.get());
+		},
+	});
+}