sandboxedjs 0.1.32 → 0.1.33

package/dist/index.js

@@ -17907,20 +17907,570 @@ def _install():
 
 _install()
 `;
+var PROCESS_PY = `
+import io, os, shlex, subprocess, sys
+import _sbx_host as _host
+from pyodide.ffi import can_run_sync, run_sync
+
+_PIPE = subprocess.PIPE
+_DEVNULL = subprocess.DEVNULL
+_STDOUT = subprocess.STDOUT
+
+
+def _argv_for(args, shell):
+    if shell:
+        line = args if isinstance(args, str) else " ".join(str(a) for a in args)
+        return ["sh", "-c", line]
+    if isinstance(args, (str, bytes)):
+        return shlex.split(args if isinstance(args, str) else args.decode())
+    return [str(a) for a in args]
+
+
+def _require_blocking(what):
+    if not can_run_sync():
+        raise OSError(
+            "cannot " + what + " on this host: WebAssembly stack switching "
+            "(JSPI) is unavailable."
+        )
+
+
+def _to_bytes_result(value):
+    if value is None:
+        return b""
+    to_bytes = getattr(value, "to_bytes", None)
+    return to_bytes() if to_bytes is not None else bytes(value.to_py())
+
+
+class _ChildReader(io.RawIOBase):
+    """One of a running child's output streams.
+
+    Reads suspend only for as long as the child takes to produce the next
+    bytes, so \`for line in p.stdout\` follows a child that is still running
+    instead of waiting for it to exit.
+    """
+
+    def __init__(self, child_id, which):
+        self._id = child_id
+        self._which = which
+
+    def readable(self):
+        return True
+
+    def readinto(self, target):
+        want = len(target)
+        if want == 0:
+            return 0
+        _require_blocking("read from a child process")
+        data = _to_bytes_result(run_sync(_host.proc_read(self._id, self._which, want)))
+        target[: len(data)] = data
+        return len(data)
+
+
+class _ChildWriter(io.RawIOBase):
+    """A running child's standard input."""
+
+    def __init__(self, child_id):
+        self._id = child_id
+
+    def writable(self):
+        return True
+
+    def write(self, data):
+        if isinstance(data, str):
+            text = data
+        else:
+            text = bytes(data).decode("utf-8", "replace")
+        _host.proc_write(self._id, text)
+        return len(data)
+
+    def close(self):
+        if not self.closed:
+            _host.proc_close_stdin(self._id)
+        super().close()
+
+
+class SbxPopen:
+    """A child process, run through the container's kernel.
+
+    The child is a real, live process: it starts when \`Popen\` is constructed
+    and runs on the host's event loop while Python carries on. The parent only
+    suspends when it actually reads, waits, or communicates \u2014 which is what
+    makes streaming from a long-running child work rather than deadlocking on
+    a single interpreter stack.
+    """
+
+    def __init__(self, args, bufsize=-1, executable=None, stdin=None, stdout=None,
+                 stderr=None, preexec_fn=None, close_fds=True, shell=False, cwd=None,
+                 env=None, universal_newlines=None, startupinfo=None, creationflags=0,
+                 restore_signals=True, start_new_session=False, pass_fds=(), *,
+                 text=None, encoding=None, errors=None, **kwargs):
+        self.args = args
+        self.returncode = None
+        self._text = bool(text or encoding or errors or universal_newlines)
+        self._encoding = encoding or "utf-8"
+        self._errors = errors or "replace"
+        self._merge_err = stderr == _STDOUT
+        self._closed = False
+
+        argv = _argv_for(args, shell)
+        env_map = None if env is None else {str(k): str(v) for k, v in dict(env).items()}
+        self._id = _host.proc_start(
+            argv, None if cwd is None else str(cwd), env_map, self._merge_err
+        )
+        self.pid = int(_host.proc_pid(self._id))
+
+        self.stdin = self._wrap_writer() if stdin == _PIPE else None
+        self.stdout = self._wrap_reader(1) if stdout == _PIPE else None
+        # When merged there is only one stream, and it is stream 1.
+        self.stderr = self._wrap_reader(2) if stderr == _PIPE and not self._merge_err else None
+
+        # Output nobody captured belongs on the parent's own streams, or a
+        # program's diagnostics would vanish rather than being seen.
+        self._drain_out = stdout is None
+        self._drain_err = stderr is None and not self._merge_err
+
+    def _wrap_reader(self, which):
+        raw = io.BufferedReader(_ChildReader(self._id, which))
+        if self._text:
+            return io.TextIOWrapper(raw, encoding=self._encoding, errors=self._errors)
+        return raw
+
+    def _wrap_writer(self):
+        raw = io.BufferedWriter(_ChildWriter(self._id))
+        if self._text:
+            return io.TextIOWrapper(raw, encoding=self._encoding, errors=self._errors)
+        return raw
+
+    def _read_all(self, which):
+        _require_blocking("read from a child process")
+        parts = []
+        while True:
+            chunk = _to_bytes_result(run_sync(_host.proc_read(self._id, which, 65536)))
+            if not chunk:
+                break
+            parts.append(chunk)
+        return b"".join(parts)
+
+    def _decode(self, raw):
+        return raw.decode(self._encoding, self._errors) if self._text else raw
+
+    def communicate(self, input=None, timeout=None):
+        if input is not None and self.stdin is not None:
+            if isinstance(input, bytes):
+                input = input.decode(self._encoding, "replace")
+            self.stdin.write(input)
+        if self.stdin is not None:
+            try:
+                self.stdin.close()
+            except Exception:
+                pass
+
+        out = self.stdout.read() if self.stdout is not None else None
+        err = self.stderr.read() if self.stderr is not None else None
+        self.wait()
+        self._flush_uncaptured()
+        return out, err
+
+    def _flush_uncaptured(self):
+        if self._drain_out:
+            text = self._decode_raw(self._read_all(1))
+            if text:
+                sys.stdout.write(text)
+        if self._drain_err:
+            text = self._decode_raw(self._read_all(2))
+            if text:
+                sys.stderr.write(text)
+        self._drain_out = False
+        self._drain_err = False
+
+    def _decode_raw(self, raw):
+        return raw.decode(self._encoding, "replace")
+
+    def poll(self):
+        code = _host.proc_poll(self._id)
+        if code is not None:
+            self.returncode = int(code)
+        return self.returncode
+
+    def wait(self, timeout=None):
+        _require_blocking("wait for a child process")
+        self.returncode = int(run_sync(_host.proc_wait(self._id)))
+        return self.returncode
+
+    def kill(self):
+        self.send_signal("SIGKILL")
+
+    def terminate(self):
+        self.send_signal("SIGTERM")
+
+    def send_signal(self, sig):
+        _host.proc_kill(self._id, sig if isinstance(sig, str) else "SIGTERM")
+
+    def __del__(self):
+        try:
+            _host.proc_release(self._id)
+        except Exception:
+            pass
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        if self.stdin is not None:
+            try:
+                self.stdin.close()
+            except Exception:
+                pass
+        self.wait()
+        self._flush_uncaptured()
+        for stream in (self.stdout, self.stderr):
+            if stream is not None:
+                try:
+                    stream.close()
+                except Exception:
+                    pass
+        # The host holds the process and its pipes until it is told the child
+        # is finished with; a loop spawning children would otherwise keep every
+        # one of them alive. Safe here only because the child has been waited
+        # for and everything anyone wanted has been read.
+        _host.proc_release(self._id)
+        return False
+
+
+def _system(command):
+    with SbxPopen(command, shell=True) as child:
+        pass
+    # os.system returns a wait status, not an exit code.
+    return (child.returncode or 0) << 8
+
+
+def _popen(command, mode="r", buffering=-1):
+    if "w" in mode:
+        raise OSError("os.popen with mode 'w' is not supported in this container")
+    child = SbxPopen(command, shell=True, stdout=_PIPE, text=True)
+    stream = child.stdout
+    inner = stream.close
+
+    def close():
+        inner()
+        code = child.wait()
+        return None if code == 0 else code << 8
+
+    stream.close = close
+    return stream
+
+
+def _install_processes():
+    subprocess.Popen = SbxPopen
+    os.system = _system
+    os.popen = _popen
+
+
+_install_processes()
+`;
+var NETWORK_PY = `
+import builtins, email.message, io, sys, urllib.error, urllib.request, urllib.response
+import _sbx_host as _host
+from pyodide.ffi import can_run_sync, run_sync
+
+
+def _fetch(request):
+    if not can_run_sync():
+        raise urllib.error.URLError(
+            "cannot make a request on this host: WebAssembly stack switching "
+            "(JSPI) is unavailable."
+        )
+    body = request.data
+    if isinstance(body, str):
+        body = body.encode()
+    try:
+        result = run_sync(
+            _host.http(
+                request.full_url,
+                request.get_method(),
+                [[k, v] for k, v in request.header_items()],
+                body,
+            )
+        )
+    except Exception as error:
+        raise urllib.error.URLError(str(error)) from None
+
+    headers = email.message.Message()
+    for pair in result.headers.to_py():
+        headers[str(pair[0])] = str(pair[1])
+    payload = result.body.to_bytes()
+    response = urllib.response.addinfourl(
+        io.BytesIO(payload), headers, str(result.url), int(result.status)
+    )
+    response.msg = str(result.statusText)
+    return response
+
+
+class _SbxHTTPHandler(urllib.request.HTTPHandler):
+    """Both schemes, from one handler.
+
+    Pyodide builds urllib without \`ssl\`, so \`HTTPSHandler\` does not exist to
+    subclass \u2014 and https is the scheme most callers actually want. Serving
+    both from a subclass of the one handler that does exist keeps
+    \`build_opener\` treating this as a replacement rather than stacking it
+    alongside the original.
+    """
+
+    def http_open(self, request):
+        return _fetch(request)
+
+    def https_open(self, request):
+        return _fetch(request)
+
+    https_request = urllib.request.HTTPHandler.do_request_
+
+
+def _raw_fetch(url, method, headers, body):
+    """One request, through the container's network path."""
+    if not can_run_sync():
+        raise urllib.error.URLError(
+            "cannot make a request on this host: WebAssembly stack switching "
+            "(JSPI) is unavailable."
+        )
+    if isinstance(body, str):
+        body = body.encode()
+    result = run_sync(
+        _host.http(url, method, [[str(k), str(v)] for k, v in dict(headers).items()], body)
+    )
+    return {
+        "status": int(result.status),
+        "reason": str(result.statusText),
+        "headers": [(str(p[0]), str(p[1])) for p in result.headers.to_py()],
+        "body": result.body.to_bytes(),
+        "url": str(result.url),
+    }
+
+
+# \u2500\u2500 Routing third-party HTTP stacks \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+#
+# A library that brings its own transport does not go through urllib, and in
+# Pyodide several of them reach JavaScript's fetch directly \u2014 which leaves the
+# container's network policy behind entirely. They cannot all be patched at
+# boot either, because pip installs them later.
+#
+# So: adapters are registered by module name and applied the moment that module
+# is first imported, whenever that happens. Supporting another stack is a small
+# function registered here, not a change to the machinery.
+
+_ADAPTERS = {}
+
+
+def _register_adapter(name):
+    def decorate(fn):
+        _ADAPTERS[name] = fn
+        return fn
+
+    return decorate
+
+
+def _apply_adapter(name):
+    fn = _ADAPTERS.pop(name, None)
+    if fn is None:
+        return
+    try:
+        fn()
+    except Exception:
+        # A stack we cannot adapt must not stop the import that triggered it.
+        pass
+
+
+def _install_import_hook():
+    real_import = builtins.__import__
+
+    def hooked(name, globals=None, locals=None, fromlist=(), level=0):
+        module = real_import(name, globals, locals, fromlist, level)
+        root = name.split(".")[0] if level == 0 else None
+        if root in _ADAPTERS:
+            _apply_adapter(root)
+        return module
+
+    builtins.__import__ = hooked
+
+
+@_register_adapter("requests")
+def _adapt_requests():
+    """Replace the transport, not the API.
+
+    \`HTTPAdapter.send\` is the single seam every requests call passes through,
+    below sessions, redirects, cookies and retries and above the urllib3
+    transport that would otherwise reach the network on its own. Replacing it
+    leaves everything callers actually use intact.
+    """
+    import requests
+    from requests.adapters import HTTPAdapter
+    from requests.structures import CaseInsensitiveDict
+
+    native_send = HTTPAdapter.send
+
+    def send(self, request, stream=False, timeout=None, verify=True, cert=None, proxies=None):
+        if not can_run_sync():
+            # Without stack switching this transport cannot run at all. Falling
+            # back to the library's own is better than breaking requests on
+            # such a host \u2014 but the container's network policy is not the part
+            # that degrades, so a forbidden host is still refused.
+            if not _host.policy_allows(request.url):
+                raise requests.exceptions.ConnectionError(
+                    "outbound network access is disabled for this container "
+                    "(enable with network: { allowOutbound: true })"
+                )
+            return native_send(self, request, stream, timeout, verify, cert, proxies)
+        try:
+            result = _raw_fetch(request.url, request.method, request.headers, request.body)
+        except Exception as error:
+            raise requests.exceptions.ConnectionError(str(error)) from None
+        response = requests.Response()
+        response.status_code = result["status"]
+        response.reason = result["reason"]
+        response.headers = CaseInsensitiveDict(result["headers"])
+        response.url = result["url"]
+        response.request = request
+        response.raw = io.BytesIO(result["body"])
+        response.encoding = requests.utils.get_encoding_from_headers(response.headers)
+        return response
+
+    HTTPAdapter.send = send
+
+
+def _install_network():
+    urllib.request.HTTPHandler = _SbxHTTPHandler
+    urllib.request.HTTPSHandler = _SbxHTTPHandler
+    urllib.request.install_opener(urllib.request.build_opener(_SbxHTTPHandler))
+    _install_import_hook()
+    for already_imported in [n for n in _ADAPTERS if n in sys.modules]:
+        _apply_adapter(already_imported)
+
+
+_install_network()
+`;
+async function httpForPython(slot, url, method, headers, body) {
+  const current = slot.current;
+  if (!current) throw new Error("no program is bound");
+  const result = await performRequest(current.ctx, new URL(url), {
+    method,
+    headers: Object.fromEntries(headers),
+    ...body ? { body } : {}
+  });
+  return {
+    status: result.status,
+    statusText: result.statusText,
+    headers: Object.entries(result.headers),
+    body: result.body,
+    url: result.url
+  };
+}
+async function resuming(py, slot, work) {
+  const parent = slot.current;
+  try {
+    return await work();
+  } finally {
+    if (parent && slot.current !== parent) bindProgram(py, parent);
+  }
+}
 function installSyscallBridge(py) {
-  const slot = py.__sbxStdin ??= { active: null };
+  const slot = py.__sbxSlot ??= { current: null };
+  const children = /* @__PURE__ */ new Map();
+  let lastChildId = 0;
   py.registerJsModule("_sbx_host", {
     /* Not `?.` and `??`: `buffered` returns undefined to mean "you will have
      * to wait", and a nullish default would quietly turn that into end-of-file —
      * which is exactly the silent EOF this bridge exists to remove. */
-    buffered: (size) => slot.active ? slot.active.buffered(size) : EMPTY,
-    read: (size) => slot.active ? slot.active.read(size) : Promise.resolve(EMPTY),
-    isatty: () => slot.active?.isatty() ?? false
+    buffered: (size) => slot.current ? slot.current.stdin.buffered(size) : EMPTY,
+    read: (size) => slot.current ? slot.current.stdin.read(size) : Promise.resolve(EMPTY),
+    isatty: () => slot.current?.stdin.isatty() ?? false,
+    proc_start: (argv, cwd, env2, merge) => {
+      const current = slot.current;
+      if (!current) throw new Error("no program is bound");
+      const { ctx } = current;
+      const stdin = new Pipe();
+      stdin.interactive = true;
+      const stdout = new Pipe();
+      const stderr = merge ? stdout : new Pipe();
+      const proc = ctx.kernel.spawn(argv, {
+        cwd: cwd ?? ctx.cwd,
+        env: env2 ?? ctx.env,
+        cred: ctx.cred,
+        stdin,
+        stdout,
+        stderr
+      });
+      void proc.wait().then(() => {
+        stdout.end();
+        if (stderr !== stdout) stderr.end();
+      });
+      const id = ++lastChildId;
+      children.set(id, { proc, stdin, stdout, stderr });
+      return id;
+    },
+    proc_read: (id, which2, size) => {
+      const child = children.get(id);
+      if (!child) return Promise.resolve(EMPTY);
+      const pipe = which2 === 2 ? child.stderr : child.stdout;
+      return resuming(py, slot, async () => await pipe.read(size) ?? EMPTY);
+    },
+    proc_write: (id, text2) => {
+      children.get(id)?.stdin.write(text2);
+    },
+    proc_close_stdin: (id) => {
+      children.get(id)?.stdin.end();
+    },
+    /* Non-blocking on purpose: `poll()` must be able to say "still running". */
+    proc_poll: (id) => children.get(id)?.proc.exitCode ?? void 0,
+    proc_pid: (id) => children.get(id)?.proc.pid ?? 0,
+    proc_wait: (id) => {
+      const child = children.get(id);
+      if (!child) return Promise.resolve(0);
+      return resuming(py, slot, () => child.proc.wait());
+    },
+    proc_kill: (id, signal) => {
+      const child = children.get(id);
+      if (!child) return;
+      const current = slot.current;
+      current?.ctx.kernel.procs.signal(child.proc.pid, signal);
+    },
+    proc_release: (id) => {
+      children.delete(id);
+    },
+    http: (url, method, headers, body) => resuming(py, slot, () => httpForPython(slot, url, method, headers, body)),
+    /* So Python can enforce the container's policy even on a host where it
+     * cannot route the request itself. */
+    policy_allows: (url) => {
+      const current = slot.current;
+      if (!current) return false;
+      const net = current.ctx.kernel.net;
+      try {
+        return net.isLocal(new URL(url).hostname) || net.outboundAllowed(url);
+      } catch {
+        return false;
+      }
+    }
   });
   py.runPython(BRIDGE_PY);
+  py.runPython(PROCESS_PY);
+  py.runPython(NETWORK_PY);
 }
-function bindStdin(py, host2) {
-  py.__sbxStdin.active = host2;
+function bindProgram(py, binding) {
+  py.__sbxSlot.current = binding;
+  const { ctx, stdin } = binding;
+  const decoder8 = new TextDecoder();
+  py.setStdout({
+    write: (buffer) => (ctx.write(decoder8.decode(buffer)), buffer.length)
+  });
+  py.setStderr({
+    write: (buffer) => (ctx.stderr.write(decoder8.decode(buffer)), buffer.length)
+  });
+  py.setStdin({
+    read: (buffer) => {
+      const ready = stdin.buffered(buffer.length);
+      if (!ready || ready.length === 0) return 0;
+      buffer.set(ready);
+      return ready.length;
+    }
+  });
 }
 
 // src/runtime/cpython.ts
@@ -18111,30 +18661,9 @@ async function runCPythonProgram(ctx, source, argv, scriptDir = null) {
     });
   } catch {
   }
-  const decoder8 = new TextDecoder();
-  py.setStdout({
-    write: (buffer) => {
-      ctx.write(decoder8.decode(buffer));
-      return buffer.length;
-    }
-  });
-  py.setStderr({
-    write: (buffer) => {
-      ctx.stderr.write(decoder8.decode(buffer));
-      return buffer.length;
-    }
-  });
   const stdinHost = createStdinHost(ctx);
   await stdinHost.prime();
-  bindStdin(py, stdinHost);
-  py.setStdin({
-    read: (buffer) => {
-      const ready = stdinHost.buffered(buffer.length);
-      if (!ready || ready.length === 0) return 0;
-      buffer.set(ready);
-      return ready.length;
-    }
-  });
+  bindProgram(py, { ctx, stdin: stdinHost });
   try {
     bootstrap(py, ctx, argv, scriptDir);
   } catch (error) {
@@ -18173,9 +18702,7 @@ async function runCPythonRepl(ctx) {
   }
   mountContainerDirs(py, ctx);
   bootstrap(py, ctx, [""], null);
-  const decoder8 = new TextDecoder();
-  py.setStdout({ write: (data) => (ctx.write(decoder8.decode(data)), data.length) });
-  py.setStderr({ write: (data) => (ctx.stderr.write(decoder8.decode(data)), data.length) });
+  bindProgram(py, { ctx, stdin: createStdinHost(ctx) });
   ctx.line(`Python ${String(py.runPython("import sys; sys.version.split()[0]"))} (Pyodide)`);
   ctx.line('Type "help()" for more information.');
   let source = "";
@@ -18235,6 +18762,13 @@ var micropip = defineCommand({
       ctx.stderr.write("pip: no packages specified\n");
       return 1;
     }
+    const index = "https://pypi.org";
+    if (!ctx.kernel.net.outboundAllowed(index)) {
+      ctx.stderr.write(
+        "pip: outbound network access is disabled for this container (enable with network: { allowOutbound: true })\n"
+      );
+      return 1;
+    }
     let py;
     try {
       py = await interpreterFor(ctx);