wasm-idle 0.7.2 → 1.0.0

package/dist/playground/worker/assets.js

@@ -1,10 +1,54 @@
 const decoder = new TextDecoder();
+const DEFAULT_MAX_ASSET_BYTES = 128 * 1024 * 1024;
+const DEFAULT_STREAM_BUFFER_BYTES = 64 * 1024;
+const MAX_DIRECT_ASSET_ALLOWLIST_ENTRIES = 4096;
+const MAX_DIRECT_RUNTIME_ASSET_ALLOWLIST_ENTRIES = 64;
+const MAX_DIRECT_ASSET_NAME_LENGTH = 1024;
+const directAssetNamePattern = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/u;
 const originalFetch = globalThis.fetch.bind(globalThis);
 const NativeXMLHttpRequest = globalThis.XMLHttpRequest;
 let activeConfig = null;
+let activeDirectAssetBaseUrl = null;
+let activeDirectAssetUrls = new Map();
 let interceptorsInstalled = false;
 let nextAssetRequestId = 0;
 const pendingAssetRequests = new Map();
+const cancelResponseBody = (response, reason) => {
+    try {
+        void Promise.resolve(response.body?.cancel(reason)).catch(() => undefined);
+    }
+    catch {
+        // Preserve the validation or HTTP failure that caused cancellation.
+    }
+};
+const configuredBaseUrl = () => {
+    if (!activeConfig)
+        return null;
+    const locationOrigin = globalThis.location?.origin;
+    const locationHref = globalThis.location?.href;
+    const fallbackBaseUrl = locationOrigin && locationOrigin !== 'null'
+        ? `${locationOrigin}/`
+        : locationHref?.startsWith('blob:')
+            ? locationHref.slice('blob:'.length)
+            : locationHref || 'http://localhost/';
+    let baseUrl;
+    try {
+        baseUrl = new URL(activeConfig.baseUrl, fallbackBaseUrl);
+    }
+    catch {
+        throw new Error(`Runtime asset base URL is invalid: ${activeConfig.baseUrl}`);
+    }
+    if (baseUrl.protocol !== 'http:' && baseUrl.protocol !== 'https:') {
+        throw new Error(`Runtime asset base URL must use HTTP(S): ${activeConfig.baseUrl}`);
+    }
+    if (baseUrl.username || baseUrl.password || baseUrl.hash || baseUrl.search) {
+        throw new Error(`Runtime asset base URL must not include credentials, a query, or a fragment: ${activeConfig.baseUrl}`);
+    }
+    if (!baseUrl.pathname.endsWith('/')) {
+        baseUrl.pathname += '/';
+    }
+    return baseUrl;
+};
 const responseBuffer = (bytes) => {
     const buffer = bytes.buffer;
     return bytes.byteOffset === 0 && bytes.byteLength === buffer.byteLength
@@ -12,18 +56,60 @@ const responseBuffer = (bytes) => {
         : buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
 };
 const trackedAssetUrl = (input) => {
-    if (!activeConfig)
+    const baseUrl = configuredBaseUrl();
+    if (!baseUrl)
         return null;
-    if (typeof input === 'string')
-        return new URL(input, activeConfig.baseUrl).href;
-    if (input instanceof URL)
-        return input.href;
-    return input.url;
+    try {
+        if (typeof input === 'string')
+            return new URL(input, baseUrl).href;
+        if (input instanceof URL)
+            return input.href;
+        return input.url;
+    }
+    catch {
+        return null;
+    }
+};
+const isDirectAssetScopeUrl = (url) => {
+    if (!activeDirectAssetBaseUrl)
+        return false;
+    let assetUrl;
+    try {
+        assetUrl = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return (assetUrl.protocol === activeDirectAssetBaseUrl.protocol &&
+        assetUrl.origin === activeDirectAssetBaseUrl.origin &&
+        assetUrl.pathname.startsWith(activeDirectAssetBaseUrl.pathname));
 };
 const trackedAssetName = (url) => {
-    if (!activeConfig || !url.startsWith(activeConfig.baseUrl))
+    const baseUrl = configuredBaseUrl();
+    if (!baseUrl)
         return null;
-    return url.slice(activeConfig.baseUrl.length);
+    let assetUrl;
+    try {
+        assetUrl = new URL(url, baseUrl);
+    }
+    catch {
+        return null;
+    }
+    if (assetUrl.protocol !== 'http:' && assetUrl.protocol !== 'https:')
+        return null;
+    if (assetUrl.username || assetUrl.password || assetUrl.hash)
+        return null;
+    if (/%2f|%5c/iu.test(assetUrl.pathname))
+        return null;
+    const directAsset = activeDirectAssetUrls.get(assetUrl.href);
+    if (directAsset)
+        return directAsset;
+    if (isDirectAssetScopeUrl(assetUrl.href))
+        return null;
+    if (assetUrl.origin !== baseUrl.origin || !assetUrl.pathname.startsWith(baseUrl.pathname)) {
+        return null;
+    }
+    return `${assetUrl.pathname.slice(baseUrl.pathname.length)}${assetUrl.search}`;
 };
 const isTrackedAssetUrl = (url) => trackedAssetName(url) !== null;
 const loadAssetFromBridge = async (asset) => {
@@ -38,14 +124,61 @@ const loadAssetFromBridge = async (asset) => {
         });
     });
 };
-const loadAssetFromUrl = async (url, asset) => {
-    const response = await originalFetch(url);
-    if (!response.ok)
-        throw new Error(`Failed to load ${asset}: ${response.status}`);
-    const total = Number(response.headers.get('content-length') || 0) || undefined;
+const loadAssetFromUrl = async (url, asset, integrity) => {
+    const requestUrl = trackedAssetUrl(url);
+    if (!requestUrl || trackedAssetName(requestUrl) !== asset || !activeConfig) {
+        throw new Error('Untracked runtime asset request');
+    }
+    const maxAssetBytes = activeConfig.maxAssetBytes ?? DEFAULT_MAX_ASSET_BYTES;
+    const response = await originalFetch(requestUrl, {
+        credentials: 'omit',
+        redirect: 'error',
+        referrerPolicy: 'no-referrer',
+        ...(integrity ? { integrity } : {})
+    });
+    if (response.url) {
+        let responseUrl;
+        try {
+            responseUrl = new URL(response.url);
+        }
+        catch {
+            const error = new Error(`Runtime asset response URL is invalid: ${response.url}`);
+            cancelResponseBody(response, error);
+            throw error;
+        }
+        if (responseUrl.href !== requestUrl) {
+            const error = new Error(`Runtime asset response URL mismatch: expected ${requestUrl}, received ${responseUrl.href}`);
+            cancelResponseBody(response, error);
+            throw error;
+        }
+    }
+    if (!response.ok) {
+        const error = new Error(`Failed to load ${asset}: ${response.status}`);
+        cancelResponseBody(response, error);
+        throw error;
+    }
+    const rawContentLength = response.headers.get('content-length');
+    let total;
+    if (rawContentLength !== null) {
+        const parsedContentLength = Number(rawContentLength);
+        if (!/^\d+$/u.test(rawContentLength.trim()) || !Number.isSafeInteger(parsedContentLength)) {
+            const error = new Error(`Runtime asset ${asset} has an invalid Content-Length`);
+            cancelResponseBody(response, error);
+            throw error;
+        }
+        total = parsedContentLength || undefined;
+    }
+    if (total !== undefined && total > maxAssetBytes) {
+        const error = new Error(`Runtime asset ${asset} exceeds the ${maxAssetBytes} byte limit`);
+        cancelResponseBody(response, error);
+        throw error;
+    }
     const mimeType = response.headers.get('content-type') || undefined;
     if (!response.body) {
         const bytes = new Uint8Array(await response.arrayBuffer());
+        if (bytes.byteLength > maxAssetBytes) {
+            throw new Error(`Runtime asset ${asset} exceeds the ${maxAssetBytes} byte limit`);
+        }
         self.postMessage({
             assetProgress: {
                 asset,
@@ -56,31 +189,68 @@ const loadAssetFromUrl = async (url, asset) => {
         return { bytes, mimeType };
     }
     const reader = response.body.getReader();
+    let readerCancelled = false;
+    const cancelReader = (reason) => {
+        if (readerCancelled)
+            return;
+        readerCancelled = true;
+        try {
+            void Promise.resolve(reader.cancel(reason)).catch(() => undefined);
+        }
+        catch {
+            // Preserve the stream or size-limit failure that caused cancellation.
+        }
+    };
     let receivedLength = 0;
-    const chunks = [];
-    while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        if (!value)
-            continue;
-        const chunk = Uint8Array.from(value);
-        chunks.push(chunk);
-        receivedLength += chunk.byteLength;
-        self.postMessage({
-            assetProgress: {
-                asset,
-                loaded: receivedLength,
-                total
+    let bytes;
+    let releaseFailure;
+    try {
+        bytes = new Uint8Array(total || Math.min(DEFAULT_STREAM_BUFFER_BYTES, maxAssetBytes));
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            const nextLength = receivedLength + value.byteLength;
+            if (nextLength > maxAssetBytes) {
+                const error = new Error(`Runtime asset ${asset} exceeds the ${maxAssetBytes} byte limit`);
+                cancelReader(error);
+                throw error;
             }
-        });
+            if (nextLength > bytes.byteLength) {
+                const nextCapacity = Math.min(maxAssetBytes, Math.max(nextLength, bytes.byteLength * 2));
+                const grown = new Uint8Array(nextCapacity);
+                grown.set(bytes.subarray(0, receivedLength));
+                bytes = grown;
+            }
+            bytes.set(value, receivedLength);
+            receivedLength = nextLength;
+            self.postMessage({
+                assetProgress: {
+                    asset,
+                    loaded: receivedLength,
+                    total
+                }
+            });
+        }
+    }
+    catch (error) {
+        cancelReader(error);
+        throw error;
     }
-    const bytes = new Uint8Array(receivedLength);
-    let position = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, position);
-        position += chunk.byteLength;
+    finally {
+        try {
+            reader.releaseLock();
+        }
+        catch (error) {
+            releaseFailure = { error };
+        }
     }
+    if (releaseFailure)
+        throw releaseFailure.error;
+    if (receivedLength !== bytes.byteLength)
+        bytes = bytes.slice(0, receivedLength);
     self.postMessage({
         assetProgress: {
             asset,
@@ -90,13 +260,13 @@ const loadAssetFromUrl = async (url, asset) => {
     });
     return { bytes, mimeType };
 };
-async function loadTrackedAsset(url) {
+async function loadTrackedAsset(url, integrity) {
     const asset = trackedAssetName(url);
     if (!asset || !activeConfig)
         throw new Error('Untracked runtime asset request');
     return activeConfig.useAssetBridge
         ? await loadAssetFromBridge(asset)
-        : await loadAssetFromUrl(url, asset);
+        : await loadAssetFromUrl(url, asset, integrity);
 }
 function createTrackedResponse(asset) {
     return new Response(responseBuffer(asset.bytes), {
@@ -125,6 +295,9 @@ function installTrackedFetch() {
         open(method, url) {
             const resolvedUrl = trackedAssetUrl(url);
             if (!resolvedUrl || !isTrackedAssetUrl(resolvedUrl)) {
+                if (resolvedUrl && isDirectAssetScopeUrl(resolvedUrl)) {
+                    throw new Error('Untracked runtime asset request');
+                }
                 const nativeUrl = resolvedUrl || (url instanceof URL ? url.href : String(url));
                 this.native = new NativeXMLHttpRequest();
                 this.native.responseType = this.responseType;
@@ -222,16 +395,88 @@ function installRuntimeAssetInterceptors() {
     interceptorsInstalled = true;
     globalThis.fetch = (async (input, init) => {
         const resolvedUrl = trackedAssetUrl(input);
-        if (!resolvedUrl || !isTrackedAssetUrl(resolvedUrl))
+        if (!resolvedUrl || !isTrackedAssetUrl(resolvedUrl)) {
+            if (resolvedUrl && isDirectAssetScopeUrl(resolvedUrl)) {
+                throw new Error('Untracked runtime asset request');
+            }
             return originalFetch(input, init);
-        return createTrackedResponse(await loadTrackedAsset(resolvedUrl));
+        }
+        const requestIntegrity = init?.integrity ??
+            (typeof Request !== 'undefined' && input instanceof Request
+                ? input.integrity
+                : undefined);
+        return createTrackedResponse(await loadTrackedAsset(resolvedUrl, typeof requestIntegrity === 'string' ? requestIntegrity : undefined));
     });
     installTrackedFetch();
 }
 export function configureWorkerRuntimeAssets(config) {
+    if (config?.maxAssetBytes !== undefined &&
+        (!Number.isSafeInteger(config.maxAssetBytes) || config.maxAssetBytes <= 0)) {
+        throw new TypeError('Runtime asset maxAssetBytes must be a positive safe integer');
+    }
+    activeDirectAssetBaseUrl = null;
+    activeDirectAssetUrls = new Map();
     activeConfig = config;
     installRuntimeAssetInterceptors();
 }
+export function configureWorkerRuntimeAssetAllowlist(allowlist) {
+    if (!activeConfig)
+        throw new Error('Runtime asset config unavailable');
+    if (activeConfig.useAssetBridge) {
+        throw new Error('Direct runtime asset allowlists require direct asset loading');
+    }
+    if (allowlist === null) {
+        activeDirectAssetBaseUrl = null;
+        activeDirectAssetUrls = new Map();
+        return;
+    }
+    if (!Array.isArray(allowlist.assets)) {
+        throw new TypeError('Direct runtime asset allowlist must be an array');
+    }
+    if (allowlist.assets.length > MAX_DIRECT_ASSET_ALLOWLIST_ENTRIES) {
+        throw new Error('Direct runtime asset allowlist has too many entries');
+    }
+    const runtimeAssets = allowlist.runtimeAssets ?? [];
+    if (!Array.isArray(runtimeAssets)) {
+        throw new TypeError('Direct core runtime asset allowlist must be an array');
+    }
+    if (runtimeAssets.length > MAX_DIRECT_RUNTIME_ASSET_ALLOWLIST_ENTRIES) {
+        throw new Error('Direct core runtime asset allowlist has too many entries');
+    }
+    let baseUrl;
+    try {
+        baseUrl = new URL(allowlist.baseUrl);
+    }
+    catch {
+        throw new Error(`Direct runtime asset base URL is invalid: ${allowlist.baseUrl}`);
+    }
+    if (baseUrl.protocol !== 'http:' && baseUrl.protocol !== 'https:') {
+        throw new Error(`Direct runtime asset base URL must use HTTP(S): ${allowlist.baseUrl}`);
+    }
+    if (baseUrl.username || baseUrl.password || baseUrl.hash || baseUrl.search) {
+        throw new Error(`Direct runtime asset base URL must not include credentials, a query, or a fragment: ${allowlist.baseUrl}`);
+    }
+    if (!baseUrl.pathname.endsWith('/'))
+        baseUrl.pathname += '/';
+    const addAssets = (urls, assets, rootUrl) => {
+        for (const asset of assets) {
+            if (typeof asset !== 'string' ||
+                asset.length > MAX_DIRECT_ASSET_NAME_LENGTH ||
+                !directAssetNamePattern.test(asset)) {
+                throw new Error(`Direct runtime asset name is unsafe: ${String(asset)}`);
+            }
+            urls.set(new URL(asset, rootUrl).href, asset);
+        }
+    };
+    const urls = new Map();
+    addAssets(urls, allowlist.assets, baseUrl);
+    const runtimeBaseUrl = configuredBaseUrl();
+    if (!runtimeBaseUrl)
+        throw new Error('Runtime asset config unavailable');
+    addAssets(urls, runtimeAssets, runtimeBaseUrl);
+    activeDirectAssetBaseUrl = baseUrl;
+    activeDirectAssetUrls = urls;
+}
 export function handleWorkerAssetMessage(data) {
     const response = data?.assetResponse;
     if (!response)
@@ -253,5 +498,9 @@ export function handleWorkerAssetMessage(data) {
 export async function loadWorkerRuntimeAsset(asset) {
     if (!activeConfig)
         throw new Error('Runtime asset config unavailable');
-    return await loadTrackedAsset(new URL(asset, activeConfig.baseUrl).href);
+    const assetUrl = trackedAssetUrl(asset);
+    if (!assetUrl || !isTrackedAssetUrl(assetUrl)) {
+        throw new Error('Untracked runtime asset request');
+    }
+    return await loadTrackedAsset(assetUrl);
 }