wasm-idle 1.0.12 → 1.1.2

package/dist/playground/assetBridge.js

@@ -201,20 +201,22 @@ const expectedAssetsForRuntime = (runtime, languageSysroots = false) => {
     }
     return assets;
 };
-const integrityKey = (config) => JSON.stringify(Object.entries(config.integrity || {})
-    .sort(([left], [right]) => left.localeCompare(right))
-    .map(([asset, entry]) => [
-    asset,
-    typeof entry === 'string'
-        ? entry
-        : {
-            sha256: entry.sha256,
-            bytes: entry.bytes,
-            mediaType: entry.mediaType,
-            uncompressedSha256: entry.uncompressedSha256,
-            uncompressedBytes: entry.uncompressedBytes
-        }
-]));
+// Read the contract fields directly: valid receipts can use inherited or hidden getters.
+const snapshotIntegrityEntry = (receipt) => typeof receipt === 'string'
+    ? receipt
+    : Object.freeze({
+        sha256: receipt.sha256,
+        bytes: receipt.bytes,
+        mediaType: receipt.mediaType,
+        uncompressedSha256: receipt.uncompressedSha256,
+        uncompressedBytes: receipt.uncompressedBytes
+    });
+const integrityKey = (config) => {
+    const integrity = config.integrity || {};
+    return JSON.stringify(Object.getOwnPropertyNames(integrity)
+        .sort((left, right) => left.localeCompare(right))
+        .map((asset) => [asset, snapshotIntegrityEntry(integrity[asset])]));
+};
 const allowedBaseUrlsKey = (config) => JSON.stringify([...(config.allowedBaseUrls || [])].sort());
 class RuntimeLoadProgress {
     samples = new Map();
@@ -550,7 +552,6 @@ export class WorkerAssetBridge {
         const generation = this.generation;
         const controller = new AbortController();
         const progress = this.progress;
-        const context = this.captureLoadContext();
         const receiveProgress = (event) => {
             if (controller.signal.aborted || generation !== this.generation)
                 return;
@@ -561,15 +562,33 @@ export class WorkerAssetBridge {
                 progress.activity(event.phase, event.asset);
             }
         };
-        const loadContext = (report) => ({
-            ...context,
-            progress: {
-                update: (asset, loaded, total) => report({ kind: 'download', asset, loaded, total }, `download:${asset}`),
-                activity: (phase, asset) => report({ kind: 'activity', asset, phase }, `activity:${asset}`)
+        // A rebind to the same worker aborts this load, but that worker still awaits a reply.
+        const replySuperseded = () => {
+            if (this.state !== 'active' || this.worker !== worker)
+                return;
+            try {
+                worker.postMessage({
+                    assetResponse: {
+                        id: request.id,
+                        ok: false,
+                        error: `Runtime asset ${request.asset} request was superseded by a rebind`
+                    }
+                });
             }
-        });
+            catch {
+                // The worker may already be terminated.
+            }
+        };
         this.activeLoads.add(controller);
         try {
+            const context = this.captureLoadContext();
+            const loadContext = (report) => ({
+                ...context,
+                progress: {
+                    update: (asset, loaded, total) => report({ kind: 'download', asset, loaded, total }, `download:${asset}`),
+                    activity: (phase, asset) => report({ kind: 'activity', asset, phase }, `activity:${asset}`)
+                }
+            });
             this.validateAssetRequest(loadContext(receiveProgress), request.asset);
             const identity = [
                 this.runtime,
@@ -650,7 +669,7 @@ export class WorkerAssetBridge {
                     });
                 }
                 if (controller.signal.aborted || generation !== this.generation)
-                    return;
+                    return replySuperseded();
                 worker.postMessage({ assetResponse: { id: request.id, ok: true, module } });
                 return;
             }
@@ -659,7 +678,7 @@ export class WorkerAssetBridge {
                 this.pythonPackageAssets = readPythonPackageAssets(loaded.bytes);
             }
             if (controller.signal.aborted || generation !== this.generation)
-                return;
+                return replySuperseded();
             const buffer = transferBuffer(loaded.bytes, this.cache ? false : loaded.transferOwnership);
             worker.postMessage({
                 assetResponse: {
@@ -672,7 +691,7 @@ export class WorkerAssetBridge {
         }
         catch (error) {
             if (controller.signal.aborted || generation !== this.generation)
-                return;
+                return replySuperseded();
             try {
                 worker.postMessage({
                     assetResponse: {
@@ -691,8 +710,24 @@ export class WorkerAssetBridge {
         }
     }
     captureLoadContext() {
+        const config = { ...this.config };
+        const integrity = config.integrity;
+        // Cache identity and verification must observe the same receipt, even if a caller
+        // updates its configuration while an asynchronous asset load is in progress.
+        // The built-in Clang map and its receipts are frozen; its identity also selects
+        // verified streaming, so only caller-owned maps need a new snapshot.
+        if (integrity && integrity !== BUNDLED_CLANG_ASSET_INTEGRITY) {
+            config.integrity = Object.freeze(Object.fromEntries(
+            // Authorization accepts own map entries regardless of enumerability.
+            Object.getOwnPropertyNames(integrity).map((asset) => [
+                asset,
+                snapshotIntegrityEntry(integrity[asset])
+            ])));
+        }
+        if (config.allowedBaseUrls)
+            config.allowedBaseUrls = [...config.allowedBaseUrls];
         return {
-            config: { ...this.config },
+            config,
             maxAssetBytes: this.maxAssetBytes,
             expectedAssets: new Set(this.expectedAssets),
             pythonPackageAssets: new Set(this.pythonPackageAssets),
@@ -743,6 +778,7 @@ export class WorkerAssetBridge {
             throw runtimeAssetAbortReason(signal);
         if (this.runtime === 'python' && asset === 'pyodide-lock.json')
             readPythonPackageAssets(runtimeBytes);
+        await loaded.persist?.();
         return {
             bytes: runtimeBytes,
             mimeType: loaded.mimeType,
@@ -768,8 +804,10 @@ export class WorkerAssetBridge {
             if (!signal.aborted)
                 context.progress.update(asset, loaded, total);
         };
-        if (context.config.loader) {
-            const pendingResult = Promise.resolve(context.config.loader({
+        // Do not expose the private verification context as a custom loader's receiver.
+        const loader = context.config.loader;
+        if (loader) {
+            const pendingResult = Promise.resolve(loader({
                 runtime: this.runtime,
                 asset,
                 reportProgress,
@@ -930,7 +968,8 @@ export class WorkerAssetBridge {
                     'bridge-v1',
                     context.config.baseUrl,
                     allowedBaseUrlsKey(context.config),
-                    maxAssetBytes
+                    maxAssetBytes,
+                    expected?.mediaType
                 ])
             }
             : undefined;
@@ -943,13 +982,44 @@ export class WorkerAssetBridge {
             if (bytes) {
                 requireRuntimeAssetSize(asset, bytes.byteLength, maxAssetBytes);
                 context.progress.update(asset, bytes.byteLength, bytes.byteLength);
-                return { bytes, mimeType: receipt?.mediaType, transferOwnership: true };
+                // A hit was validated against this same expected MIME type before it was stored.
+                return {
+                    bytes,
+                    mimeType: expected?.mediaType ?? receipt?.mediaType,
+                    transferOwnership: true
+                };
             }
         }
         const loaded = await this.fetchAssetFromNetwork(context, url, asset, signal, maxAssetBytes);
+        if (receipt) {
+            // Verify even when storage is disabled, unavailable or skipped. A body that the browser
+            // HTTP-decoded and that lost its gzip header is checked against the logical receipt.
+            const decoded = !!loaded.contentEncoding && !(loaded.bytes[0] === 0x1f && loaded.bytes[1] === 0x8b);
+            if (decoded && receipt.uncompressedSha256 !== undefined) {
+                await verifyRuntimeAssetIntegrity({
+                    asset,
+                    bytes: loaded.bytes,
+                    expected: {
+                        sha256: receipt.sha256,
+                        uncompressedSha256: receipt.uncompressedSha256,
+                        uncompressedBytes: receipt.uncompressedBytes
+                    },
+                    stage: 'uncompressed'
+                });
+            }
+            else if (!decoded || !asset.endsWith('.gz')) {
+                // Unpaired receipts for other assets already describe their logical bytes.
+                await verifyRuntimeAssetIntegrity({
+                    asset,
+                    bytes: loaded.bytes,
+                    expected: { sha256: receipt.sha256, bytes: receipt.bytes }
+                });
+            }
+            // A decoded .gz body with an unpaired receipt is left to runtime validation.
+        }
         if (identity && !loaded.contentEncoding) {
-            // Only checksum-matching bytes are published. Existing runtime validation still runs.
-            await writePersistentRuntimeAsset({
+            // A hit skips the response MIME check, so publish only bytes that passed it.
+            loaded.persist = () => writePersistentRuntimeAsset({
                 identity,
                 cache: persistentCache,
                 signal,
@@ -1177,6 +1247,11 @@ export class WorkerAssetBridge {
         if (url.hash) {
             throw new Error(`Runtime asset ${asset} URL must not include a fragment`);
         }
+        // The prefix check below sees `/base/..%2fother` as inside `/base/`, but a server that
+        // decodes the separator before resolving dot segments serves `/other`.
+        if (/%2f|%5c/iu.test(url.pathname)) {
+            throw new Error(`Runtime asset ${asset} URL must not include encoded path separators`);
+        }
         const allowed = [context.config.baseUrl, ...(context.config.allowedBaseUrls || [])].some((baseUrl) => {
             let base;
             try {

package/dist/playground/assets.d.ts

@@ -663,12 +663,12 @@ export interface ResolvedZigRuntimeAssetConfig {
     integrity: ZigExecutionAssetReceipts;
 }
 export declare const PYTHON_RUNTIME_LOAD_ASSETS: readonly ["pyodide.mjs", "pyodide.asm.mjs", "pyodide-lock.json", "pyodide.asm.wasm", "python_stdlib.zip"];
-export declare const JAVA_RUNTIME_LOAD_ASSETS: readonly ["compiler.wasm-runtime.js", "compiler.wasm", "compile-classlib-teavm.bin", "runtime-classlib-teavm.bin"];
+export declare const JAVA_RUNTIME_LOAD_ASSETS: readonly ["compiler.wasm-runtime.js", "compiler.wasm", "compiler.wasm-deobfuscator.wasm", "compile-classlib-teavm.bin", "runtime-classlib-teavm.bin"];
 export declare const CLANG_RUNTIME_LOAD_ASSETS: readonly ["runtime-manifest.v1.json", "bin/memfs.wasm.gz", "bin/clang.wasm.gz", "bin/lld.wasm.gz", "bin/sysroot.tar.gz"];
 export declare const CLANGD_RUNTIME_LOAD_ASSETS: readonly ["clangd.js", "clangd.wasm.gz", "clangd.headers.json.gz"];
 export declare const RUNTIME_LOAD_ASSETS: {
     python: readonly ["pyodide.mjs", "pyodide.asm.mjs", "pyodide-lock.json", "pyodide.asm.wasm", "python_stdlib.zip"];
-    java: readonly ["compiler.wasm-runtime.js", "compiler.wasm", "compile-classlib-teavm.bin", "runtime-classlib-teavm.bin"];
+    java: readonly ["compiler.wasm-runtime.js", "compiler.wasm", "compiler.wasm-deobfuscator.wasm", "compile-classlib-teavm.bin", "runtime-classlib-teavm.bin"];
     clang: readonly ["runtime-manifest.v1.json", "bin/memfs.wasm.gz", "bin/clang.wasm.gz", "bin/lld.wasm.gz", "bin/sysroot.tar.gz"];
     clangd: readonly ["clangd.js", "clangd.wasm.gz", "clangd.headers.json.gz"];
 };

package/dist/playground/c3.js

@@ -2,6 +2,7 @@ import { resolveC3BaseUrl } from './assets';
 import { StaticWorkerRuntimeSandbox } from './staticWorkerRuntime';
 import { bundledC3Profile as profile, bundledC3WorkerReceipt } from './wasmC3Version';
 import { preflightRuntimeAssets, RuntimeConfigurationError } from '@wasm-idle/core';
+import { limitC3WasmMemory } from './c3Memory.js';
 export const C3_DEFAULT_WASM_MEMORY_BYTES = 1024 ** 3;
 function c3ExecutionOptions(options = {}) {
     if (options.compileArgs?.length)
@@ -114,6 +115,27 @@ class C3 extends StaticWorkerRuntimeSandbox {
                     workerReceipt: bundledC3WorkerReceipt
                 };
             },
+            compilerModules(_urls, limits) {
+                const totalCap = Math.min(limits.maxWasmMemoryBytes, 2 * 1024 ** 3);
+                const guestCap = Math.min(64 * 1024 ** 2, Math.floor(totalCap / 8 / 65536) * 65536);
+                const compilerCap = totalCap - guestCap;
+                return {
+                    compiler: {
+                        receipt: profile.compilerWasmReceipt,
+                        compileKey: `c3-defined-memory-cap-v1:${compilerCap}`,
+                        async compile(bytes) {
+                            const limited = await limitC3WasmMemory(bytes, compilerCap, {
+                                verifyModules: false
+                            });
+                            const module = await WebAssembly.compile(limited.bytes);
+                            if (WebAssembly.Module.imports(module).some((item) => item.kind === 'memory')) {
+                                throw new Error('Imported C3 Wasm memories are unsupported');
+                            }
+                            return module;
+                        }
+                    }
+                };
+            },
             async preflightRuntimeAssets(urls, context) {
                 memoryEvidence.current = undefined;
                 const result = await preflightRuntimeAssets({

package/dist/playground/c3Memory.d.ts

@@ -0,0 +1,19 @@
+/** @param {Uint8Array<ArrayBuffer>} bytes */
+export function c3Digest(bytes: Uint8Array<ArrayBuffer>): Promise<string>;
+/**
+ * @param {Uint8Array<ArrayBuffer>} bytes
+ * @param {number} maximumBytes
+ * @param {{verifyModules?: boolean}} [options]
+ */
+export function limitC3WasmMemory(bytes: Uint8Array<ArrayBuffer>, maximumBytes: number, { verifyModules }?: {
+    verifyModules?: boolean;
+}): Promise<{
+    bytes: Uint8Array<ArrayBuffer>;
+    evidence: {
+        originalSha256: string;
+        limitedSha256: string;
+        initialBytes: number;
+        maximumBytes: number;
+        originalMaximumBytes: number | null;
+    };
+}>;

package/dist/playground/c3Memory.js

@@ -0,0 +1,117 @@
+const C3_WASM_PAGE_BYTES = 65536;
+
+/** @param {Uint8Array<ArrayBuffer>} bytes */
+export async function c3Digest(bytes) {
+	return Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', bytes)), (value) =>
+		value.toString(16).padStart(2, '0')
+	).join('');
+}
+
+// Only lower the limit of one defined, unshared wasm32 memory. Instructions and data stay intact.
+/**
+ * @param {Uint8Array<ArrayBuffer>} bytes
+ * @param {number} maximumBytes
+ * @param {{verifyModules?: boolean}} [options]
+ */
+export async function limitC3WasmMemory(bytes, maximumBytes, { verifyModules = true } = {}) {
+	if (
+		!(bytes instanceof Uint8Array) ||
+		bytes.length < 8 ||
+		!Number.isSafeInteger(maximumBytes) ||
+		maximumBytes < 0
+	) {
+		throw new Error('Invalid C3 Wasm memory limit request');
+	}
+	const header = [0, 97, 115, 109, 1, 0, 0, 0];
+	if (!header.every((byte, index) => bytes[index] === byte))
+		throw new Error('Invalid Wasm header');
+	let offset = 8;
+	const u32 = (end = bytes.length) => {
+		let result = 0;
+		for (let index = 0; index < 5; index++) {
+			if (offset >= end) throw new Error('Truncated Wasm integer');
+			const byte = bytes[offset++];
+			if (index === 4 && byte > 15) throw new Error('Invalid Wasm u32');
+			result += (byte & 127) * 2 ** (7 * index);
+			if (!(byte & 128)) return result;
+		}
+		throw new Error('Invalid Wasm integer');
+	};
+	/** @param {number} value */
+	const encode = (value) => {
+		const result = [];
+		do {
+			const low = value % 128;
+			value = Math.floor(value / 128);
+			result.push(low | (value ? 128 : 0));
+		} while (value);
+		return result;
+	};
+	let memory;
+	while (offset < bytes.length) {
+		const start = offset;
+		const id = bytes[offset++];
+		const size = u32();
+		const end = offset + size;
+		if (end > bytes.length) throw new Error('Truncated Wasm section');
+		if (id === 5) {
+			if (memory || u32(end) !== 1)
+				throw new Error('C3 supports exactly one defined Wasm memory');
+			const flags = u32(end);
+			if (flags !== 0 && flags !== 1)
+				throw new Error('Shared and memory64 C3 memories are unsupported');
+			const minimum = u32(end);
+			const originalMaximum = flags === 1 ? u32(end) : null;
+			if (
+				offset !== end ||
+				minimum > 65536 ||
+				(originalMaximum !== null && (originalMaximum < minimum || originalMaximum > 65536))
+			) {
+				throw new Error('Invalid Wasm memory section');
+			}
+			const maximum = Math.min(
+				Math.floor(maximumBytes / C3_WASM_PAGE_BYTES),
+				originalMaximum ?? 65536
+			);
+			if (minimum > maximum) {
+				const error = new Error(
+					'C3 Wasm initial memory exceeds the configured memory limit'
+				);
+				Object.assign(error, {
+					code: 'resource-limit',
+					resource: 'wasm-memory',
+					actual: minimum * C3_WASM_PAGE_BYTES,
+					limit: maximumBytes
+				});
+				throw error;
+			}
+			memory = { start, end, minimum, maximum, originalMaximum };
+		}
+		offset = end;
+	}
+	if (!memory) throw new Error('C3 requires one defined Wasm memory');
+	if (verifyModules) {
+		const module = await WebAssembly.compile(bytes);
+		if (WebAssembly.Module.imports(module).some((item) => item.kind === 'memory')) {
+			throw new Error('Imported C3 Wasm memories are unsupported');
+		}
+	}
+	const payload = [1, 1, ...encode(memory.minimum), ...encode(memory.maximum)];
+	const section = Uint8Array.from([5, ...encode(payload.length), ...payload]);
+	const limited = new Uint8Array(bytes.length - (memory.end - memory.start) + section.length);
+	limited.set(bytes.subarray(0, memory.start));
+	limited.set(section, memory.start);
+	limited.set(bytes.subarray(memory.end), memory.start + section.length);
+	if (verifyModules) await WebAssembly.compile(limited);
+	return {
+		bytes: limited,
+		evidence: {
+			originalSha256: await c3Digest(bytes),
+			limitedSha256: await c3Digest(limited),
+			initialBytes: memory.minimum * C3_WASM_PAGE_BYTES,
+			maximumBytes: memory.maximum * C3_WASM_PAGE_BYTES,
+			originalMaximumBytes:
+				memory.originalMaximum === null ? null : memory.originalMaximum * C3_WASM_PAGE_BYTES
+		}
+	};
+}