roxxie-proxy-u-prod 0.1.0

package/source/packages/scramjet/packages/core/src/client/dom/fontface.ts

@@ -0,0 +1,11 @@
+import { rewriteCss } from "@rewriters/css";
+import { ScramjetClient } from "@client/index";
+
+export default function (client: ScramjetClient, _self: Self) {
+	client.Proxy("FontFace", {
+		construct(ctx) {
+			if (typeof ctx.args[1] !== "string") return;
+			ctx.args[1] = rewriteCss(ctx.args[1], client.context, client.meta);
+		},
+	});
+}

package/source/packages/scramjet/packages/core/src/client/dom/fragments.ts

@@ -0,0 +1,32 @@
+import { rewriteHtml } from "@rewriters/html";
+import { ScramjetClient } from "@client/index";
+import { ForeignContext } from "@/shared/rewriters/html";
+import { String } from "@/shared/snapshot";
+
+// TODO: this function is untested / llm slop
+function foreignContextForRange(
+	client: ScramjetClient,
+	range: Range
+): ForeignContext {
+	const node = range.startContainer;
+	const element = node.nodeType === 1 ? node : node.parentElement;
+	if (!element) return "html";
+	if (client.box.instanceof(element, "SVGElement")) return "svg";
+	if (client.box.instanceof(element, "MathMLElement")) return "math";
+	return "html";
+}
+
+export default function (client: ScramjetClient, _self: Self) {
+	client.Proxy("Range.prototype.createContextualFragment", {
+		apply(ctx) {
+			const html = String(ctx.args[0]);
+			ctx.args[0] = rewriteHtml(html, client.context, client.meta, {
+				loadScripts: false,
+				inline: true,
+				source: client.url.href,
+				apisource: "Range.prototype.createContextualFragment",
+				foreignContext: foreignContextForRange(client, ctx.this),
+			});
+		},
+	});
+}

package/source/packages/scramjet/packages/core/src/client/dom/history.ts

@@ -0,0 +1,35 @@
+import { ScramjetClient } from "@client/index";
+import { Tap } from "@/Tap";
+import { String, _URL } from "@/shared/snapshot";
+
+export default function (client: ScramjetClient, _self: Self) {
+	client.Proxy(
+		["History.prototype.pushState", "History.prototype.replaceState"],
+		{
+			apply(ctx) {
+				const relevantclient = client.box.histories.get(ctx.this);
+				const url = ctx.args[2] ? String(ctx.args[2]) : undefined;
+
+				if (_URL.canParse(url)) {
+					const parsedUrl = new _URL(url);
+					if (parsedUrl.origin !== relevantclient.url.origin) {
+						// TODO: we want to emulate the proper security error here. right now this will leak the origin in the error message
+						return ctx.return(undefined);
+					}
+				}
+
+				if (url || url === "") ctx.args[2] = relevantclient.rewriteUrl(url);
+				ctx.call();
+				Tap.dispatch(
+					relevantclient.hooks.lifecycle.navigate,
+					{
+						type: "history",
+					},
+					{
+						url: relevantclient.url.href,
+					}
+				);
+			},
+		}
+	);
+}

package/source/packages/scramjet/packages/core/src/client/dom/open.ts

@@ -0,0 +1,59 @@
+import { ScramjetClient } from "@client/index";
+import { SCRAMJETCLIENT } from "@/symbols";
+import { String } from "@/shared/snapshot";
+
+export default function (client: ScramjetClient) {
+	client.Proxy("window.open", {
+		apply(ctx) {
+			// undefined opens an about:blank window, pass through
+			if (typeof ctx.args[0] !== "undefined") {
+				const url = String(ctx.args[0]);
+				// blank also opens an about:blank window
+				if (url !== "") {
+					// note that null or anything else will *not* open an about:blank window
+					ctx.args[0] = client.rewriteUrl(url);
+				}
+			}
+
+			if (typeof ctx.args[1] !== "undefined" && ctx.args[1] !== null) {
+				let target = String(ctx.args[1]);
+
+				if (target === "_top" || target === "_unfencedTop") {
+					target = client.meta.topFrameName;
+				}
+				if (target === "_parent") {
+					target = client.meta.parentFrameName;
+				}
+
+				ctx.args[1] = target;
+			}
+
+			const realwin = ctx.call();
+
+			if (!realwin) return ctx.return(realwin);
+
+			if (!(SCRAMJETCLIENT in realwin)) {
+				// i don't believe it's possible for a just-opened window to already have scramjet loaded but just in case
+				client.init.hookSubcontext(realwin);
+			}
+
+			return realwin;
+		},
+	});
+
+	client.Trap("window.frameElement", {
+		get(ctx) {
+			const f = ctx.get() as HTMLIFrameElement | null;
+			if (!f) return f;
+
+			const win = f.ownerDocument.defaultView;
+			if (win[SCRAMJETCLIENT]) {
+				// then this is a subframe in a scramjet context, and it's safe to pass back the real iframe
+				return f;
+			} else {
+				// no, the top frame is outside the sandbox
+				return null;
+			}
+		},
+	});
+}

package/source/packages/scramjet/packages/core/src/client/dom/origin.ts

@@ -0,0 +1,13 @@
+import { ScramjetClient } from "@client/index";
+
+export default function (client: ScramjetClient, _self: Self) {
+	client.Trap("origin", {
+		get() {
+			// TODO: this isn't right!!
+			return client.url.origin;
+		},
+		set() {
+			return false;
+		},
+	});
+}

package/source/packages/scramjet/packages/core/src/client/dom/performance.ts

@@ -0,0 +1,50 @@
+import { ScramjetClient } from "@client/index";
+import { String } from "@/shared/snapshot";
+
+export default function (client: ScramjetClient, _self: Self) {
+	client.Trap("PerformanceEntry.prototype.name", {
+		get(ctx) {
+			// name is going to be a url typically
+			const name = String(ctx.get());
+
+			if (name && name.startsWith(client.context.prefix.href)) {
+				return client.unrewriteUrl(name);
+			}
+
+			return name;
+		},
+	});
+
+	const filterEntries = (entries: PerformanceEntry[]) => {
+		return entries.filter((entry) => {
+			for (const file of client.config.maskedfiles) {
+				const name = String(
+					client.descriptors.get("PerformanceEntry.prototype.name", entry)
+				);
+				if (name.endsWith(file)) {
+					return false;
+				}
+			}
+
+			return true;
+		});
+	};
+
+	client.Proxy(
+		[
+			"Performance.prototype.getEntries",
+			"Performance.prototype.getEntriesByType",
+			"Performance.prototype.getEntriesByName",
+			"PerformanceObserverEntryList.prototype.getEntries",
+			"PerformanceObserverEntryList.prototype.getEntriesByType",
+			"PerformanceObserverEntryList.prototype.getEntriesByName",
+		],
+		{
+			apply(ctx) {
+				const entries = ctx.call() as PerformanceEntry[];
+
+				return ctx.return(filterEntries(entries));
+			},
+		}
+	);
+}

package/source/packages/scramjet/packages/core/src/client/dom/protocol.ts

@@ -0,0 +1,17 @@
+import { ScramjetClient } from "@client/index";
+
+export default function (client: ScramjetClient) {
+	// protocol handlers will not work out of the box since there's no guarantee the service worker will be set up
+	// or any other expectations that the user agent might need
+	// sites can set this up themselves if they want to
+	client.Proxy("Navigator.prototype.registerProtocolHandler", {
+		apply(ctx) {
+			ctx.return();
+		},
+	});
+	client.Proxy("Navigator.prototype.unregisterProtocolHandler", {
+		apply(ctx) {
+			ctx.return(undefined);
+		},
+	});
+}

package/source/packages/scramjet/packages/core/src/client/dom/storage.ts

@@ -0,0 +1,107 @@
+import { ScramjetClient } from "@client/index";
+import { Object_keys, Reflect_get, Reflect_ownKeys } from "@/shared/snapshot";
+
+export default function (client: ScramjetClient, self: Self) {
+	const handler: ProxyHandler<Storage> = {
+		get(target, prop) {
+			switch (prop) {
+				case "getItem":
+					return (key: string) => {
+						return target.getItem(client.url.host + "@" + key);
+					};
+
+				case "setItem":
+					return (key: string, value: string) => {
+						return target.setItem(client.url.host + "@" + key, value);
+					};
+
+				case "removeItem":
+					return (key: string) => {
+						return target.removeItem(client.url.host + "@" + key);
+					};
+
+				case "clear":
+					return () => {
+						for (const key in Object_keys(target)) {
+							if (key.startsWith(client.url.host)) {
+								target.removeItem(key);
+							}
+						}
+					};
+
+				case "key":
+					return (index: number) => {
+						const keys = Object_keys(target).filter((key) =>
+							key.startsWith(client.url.host)
+						);
+
+						return target.getItem(keys[index]);
+					};
+
+				case "length":
+					return Object_keys(target).filter((key) =>
+						key.startsWith(client.url.host)
+					).length;
+
+				default:
+					if (prop in Object.prototype || typeof prop === "symbol") {
+						return Reflect_get(target, prop);
+					}
+
+					return target.getItem(client.url.host + "@" + (prop as string));
+			}
+		},
+
+		set(target, prop, value) {
+			target.setItem(client.url.host + "@" + (prop as string), value);
+
+			return true;
+		},
+
+		has(target, prop) {
+			return target.getItem(client.url.host + "@" + (prop as string)) !== null;
+		},
+
+		ownKeys(target) {
+			return Reflect_ownKeys(target)
+				.filter((f) => typeof f === "string" && f.startsWith(client.url.host))
+				.map((f) =>
+					typeof f === "string" ? f.substring(client.url.host.length + 1) : f
+				);
+		},
+
+		getOwnPropertyDescriptor(target, property) {
+			// TODO: probably not right
+			if (
+				target.getItem(client.url.host + "@" + (property as string)) === null
+			) {
+				return undefined;
+			}
+
+			return {
+				value: target.getItem(client.url.host + "@" + (property as string)),
+				enumerable: true,
+				configurable: true,
+				writable: true,
+			};
+		},
+
+		defineProperty(target, property, attributes) {
+			target.setItem(
+				client.url.host + "@" + (property as string),
+				attributes.value
+			);
+
+			return true;
+		},
+	};
+
+	const localStorageProxy = new Proxy(self.localStorage, handler);
+	const sessionStorageProxy = new Proxy(self.sessionStorage, handler);
+
+	delete self.localStorage;
+	delete self.sessionStorage;
+
+	self.localStorage = localStorageProxy;
+	self.sessionStorage = sessionStorageProxy;
+}

package/source/packages/scramjet/packages/core/src/client/entry.ts

@@ -0,0 +1,12 @@
+// entrypoint for scramjet.client.js
+
+import { ScramjetContext, ScramjetInterface } from "@/shared/index";
+import { SCRAMJETCLIENT } from "@/symbols";
+import { ScramjetClient } from "@client/index";
+import { ScramjetConfig } from "@/types";
+
+export const iswindow = "window" in globalThis && window instanceof Window;
+export const isworker = "WorkerGlobalScope" in globalThis;
+export const issw = "ServiceWorkerGlobalScope" in globalThis;
+export const isdedicated = "DedicatedWorkerGlobalScope" in globalThis;
+export const isshared = "SharedWorkerGlobalScope" in globalThis;

package/source/packages/scramjet/packages/core/src/client/events.ts

@@ -0,0 +1,10 @@
+export type LifecycleHooks = {
+	navigate: {
+		context: {
+			type: "location" | "history" | "hashchange";
+		};
+		props: {
+			url: string;
+		};
+	};
+};

package/source/packages/scramjet/packages/core/src/client/helpers.ts

@@ -0,0 +1,7 @@
+import { Object_getOwnPropertyDescriptor } from "@/shared/snapshot";
+
+export function getOwnPropertyDescriptorHandler(target, prop) {
+	const realDescriptor = Object_getOwnPropertyDescriptor(target, prop);
+
+	return realDescriptor;
+}

package/source/packages/scramjet/packages/core/src/client/index.ts

@@ -0,0 +1,7 @@
+export * from "./client";
+export * from "./entry";
+export * from "./events";
+export * from "./helpers";
+export * from "./location";
+export * from "./index";
+export * from "./location";

package/source/packages/scramjet/packages/core/src/client/location.ts

@@ -0,0 +1,139 @@
+import { ScramjetClient } from "@client/index";
+import { Tap } from "@/Tap";
+import { iswindow } from "@client/entry";
+import {
+	Reflect_apply,
+	Object_setPrototypeOf,
+	_URL,
+	Object_defineProperty,
+} from "@/shared/snapshot";
+
+export function createLocationProxy(client: ScramjetClient, self: GlobalThis) {
+	const Location = iswindow ? self.Location : self.WorkerLocation;
+	// location cannot be Proxy()d
+	const fakeLocation: any = {};
+	Object_setPrototypeOf(fakeLocation, Location.prototype);
+	fakeLocation.constructor = Location;
+
+	// for some reason it's on the object for Location and on the prototype for WorkerLocation??
+	const descriptorSource = iswindow ? self.location : Location.prototype;
+	const urlprops = [
+		"protocol",
+		"hash",
+		"host",
+		"hostname",
+		"href",
+		"origin",
+		"pathname",
+		"port",
+		"search",
+	];
+	for (const prop of urlprops) {
+		const native = client.natives.call(
+			"Object.getOwnPropertyDescriptor",
+			null,
+			descriptorSource,
+			prop
+		);
+		if (!native) continue;
+
+		const desc: Partial<PropertyDescriptor> = {
+			configurable: false,
+			enumerable: true,
+		};
+		if (native.get) {
+			desc.get = new Proxy(native.get, {
+				apply() {
+					return client.url[prop];
+				},
+			});
+		}
+		if (native.set) {
+			desc.set = new Proxy(native.set, {
+				apply(target, that, args) {
+					if (prop === "href") {
+						// special case
+						client.url = args[0];
+
+						return;
+					}
+					if (prop === "hash") {
+						self.location.hash = args[0];
+						Tap.dispatch(
+							client.hooks.lifecycle.navigate,
+							{
+								type: "hashchange",
+							},
+							{
+								url: client.url.href,
+							}
+						);
+
+						return;
+					}
+					const url = new _URL(client.url.href);
+					url[prop] = args[0];
+					client.url = url;
+				},
+			});
+		}
+		Object_defineProperty(fakeLocation, prop, desc);
+	}
+
+	// functions
+	fakeLocation.toString = new Proxy(self.location.toString, {
+		apply() {
+			return client.url.href;
+		},
+	});
+
+	if (self.location.valueOf)
+		fakeLocation.valueOf = new Proxy(self.location.valueOf, {
+			apply() {
+				return fakeLocation;
+			},
+		});
+	if (self.location.assign)
+		fakeLocation.assign = new Proxy(self.location.assign, {
+			apply(target, that, args) {
+				args[0] = client.rewriteUrl(args[0]);
+				Reflect_apply(target, self.location, args);
+				Tap.dispatch(
+					client.hooks.lifecycle.navigate,
+					{
+						type: "location",
+					},
+					{
+						url: client.url.href,
+					}
+				);
+			},
+		});
+	if (self.location.reload)
+		fakeLocation.reload = new Proxy(self.location.reload, {
+			apply(target, that, args) {
+				Reflect_apply(target, self.location, args);
+			},
+		});
+	if (self.location.replace)
+		fakeLocation.replace = new Proxy(self.location.replace, {
+			apply(target, that, args) {
+				args[0] = client.rewriteUrl(args[0]);
+				Reflect_apply(target, self.location, args);
+
+				Tap.dispatch(
+					client.hooks.lifecycle.navigate,
+					{
+						type: "location",
+					},
+					{
+						url: client.url.href,
+					}
+				);
+			},
+		});
+
+	// TODO: ancestorOrigins
+
+	return fakeLocation;
+}

package/source/packages/scramjet/packages/core/src/client/shared/antiantidebugger.ts

@@ -0,0 +1,20 @@
+import { ScramjetClient } from "@client/index";
+
+export default function (client: ScramjetClient) {
+	client.Proxy("console.clear", {
+		apply(ctx) {
+			// fuck you
+			ctx.return(undefined);
+		},
+	});
+
+	const log = console.log;
+	client.Trap("console.log", {
+		set(_ctx, _v) {
+			// is there a legitimate reason to let sites do this?
+		},
+		get(_ctx) {
+			return log;
+		},
+	});
+}

package/source/packages/scramjet/packages/core/src/client/shared/blob.ts

@@ -0,0 +1,35 @@
+import { rewriteBlob, unrewriteBlob } from "@rewriters/url";
+import { ScramjetClient } from "@client/index";
+import { String } from "@/shared/snapshot";
+
+export default function (client: ScramjetClient) {
+	// hide the origin from object urls from the page
+	client.Proxy("URL.createObjectURL", {
+		apply(ctx) {
+			const url = ctx.call();
+			if (url.startsWith("blob:")) {
+				ctx.return(rewriteBlob(url, client.context, client.meta));
+			} else {
+				ctx.return(url);
+			}
+		},
+	});
+
+	client.Proxy("URL.revokeObjectURL", {
+		apply(ctx) {
+			setTimeout(() => {
+				// scramjet rewrites blob urls to pass through the service worker first
+				// this is neccesary if rewrites need to be applied to the blob
+				// the issue is that if you call revokeObjectURL immediately after using the blob
+				// the service worker will not have had time to download the blob
+				// for some reason this is not an issue natively
+				// simple delay is enough
+				// TODO: find a way to make this not necessary
+				const url = String(ctx.args[0]);
+				ctx.args[0] = unrewriteBlob(url, client.context, client.meta);
+				ctx.call();
+			}, 1000);
+			ctx.return(undefined);
+		},
+	});
+}

package/source/packages/scramjet/packages/core/src/client/shared/caches.ts

@@ -0,0 +1,31 @@
+import { ScramjetClient } from "@client/index";
+import { String } from "@/shared/snapshot";
+
+export default function (client: ScramjetClient, _self: Self) {
+	client.Proxy("CacheStorage.prototype.open", {
+		apply(ctx) {
+			ctx.args[0] = `${client.url.origin}@${ctx.args[0]}`;
+		},
+	});
+
+	client.Proxy("CacheStorage.prototype.has", {
+		apply(ctx) {
+			ctx.args[0] = `${client.url.origin}@${ctx.args[0]}`;
+		},
+	});
+
+	client.Proxy("CacheStorage.prototype.match", {
+		apply(ctx) {
+			const url = String(ctx.args[0]);
+			ctx.args[0] = client.rewriteUrl(url);
+		},
+	});
+
+	client.Proxy("CacheStorage.prototype.delete", {
+		apply(ctx) {
+			ctx.args[0] = `${client.url.origin}@${ctx.args[0]}`;
+		},
+	});
+
+	// TODO - check if this might leak things if Response from fetch is passed in and the url isn't properly being unrewritten
+}

package/source/packages/scramjet/packages/core/src/client/shared/chrome.ts

@@ -0,0 +1,90 @@
+// delete all chrome specific apis, or apis that are not supported by any browser other than chrome
+// these are not worth emulating and typically cause issues
+
+import { iswindow } from "@client/entry";
+import { ScramjetClient } from "@client/index";
+
+// type self as any here, most of these are not defined in the types
+export default function (client: ScramjetClient, self: any) {
+	const del = (name: string) => {
+		const split = name.split(".");
+		const prop = split.pop();
+		const target = split.reduce((a, b) => a?.[b], self);
+		if (!target) return;
+		if (prop && prop in target) {
+			delete target[prop];
+		} else {
+		}
+	};
+
+	// obviously
+	// del("chrome");
+
+	// ShapeDetector https://developer.chrome.com/docs/capabilities/shape-detection
+	del("BarcodeDetector");
+	del("FaceDetector");
+	del("TextDetector");
+
+	// background synchronization api
+	if (iswindow) {
+		del("ServiceWorkerRegistration.prototype.sync");
+	}
+
+	// whatever this is
+	del("Navigator.prototype.joinAdInterestGroup");
+
+	if (!iswindow) return;
+	// DOM specific ones below here
+
+	Reflect.deleteProperty(Navigator.prototype, "serviceWorker");
+	del("MediaDevices.prototype.setCaptureHandleConfig");
+
+	// web bluetooth api
+	del("Navigator.prototype.bluetooth");
+	del("Bluetooth");
+	del("BluetoothDevice");
+	del("BluetoothRemoteGATTServer");
+	del("BluetoothRemoteGATTCharacteristic");
+	del("BluetoothRemoteGATTDescriptor");
+	del("BluetoothUUID");
+
+	// contact picker api
+	del("Navigator.prototype.contacts");
+	del("ContactAddress");
+	del("ContactManager");
+
+	// Idle Detection API
+	del("IdleDetector");
+
+	// Presentation API
+	del("Navigator.prototype.presentation");
+	del("Presentation");
+	del("PresentationConnection");
+	del("PresentationReceiver");
+	del("PresentationRequest");
+	del("PresentationAvailability");
+	del("PresentationConnectionAvailableEvent");
+	del("PresentationConnectionCloseEvent");
+	del("PresentationConnectionList");
+
+	// Window Controls Overlay API
+	del("WindowControlsOverlay");
+	del("WindowControlsOverlayGeometryChangeEvent");
+	del("Navigator.prototype.windowControlsOverlay");
+
+	// WebHID API
+	del("Navigator.prototype.hid");
+	del("HID");
+	del("HIDDevice");
+	del("HIDConnectionEvent");
+	del("HIDInputReportEvent");
+
+	// Navigation API (not chrome only but it's really annoying to implement)
+	del("navigation");
+	del("NavigateEvent");
+	del("NavigationActivation");
+	del("NavigationCurrentEntryChangeEvent");
+	del("NavigationDestination");
+	del("NavigationHistoryEntry");
+	del("NavigationTransition");
+}