windows-development-sandbox 1.13.2 → 1.14.0

package/native/csharp/StorageHelper/Protocol.cs

@@ -0,0 +1,107 @@
+// What goes over the pipe. A request is one line of JSON, at most 512 bytes, with exactly two string fields:
+// {"verb":"mount"|"dismount","set":"<data set name>"}; anything else is refused. The client is never asked who it is
+// or where its files are: that comes from Windows and from the service's own reading of the settings. The answer is
+// one JSON object: {"protocol":1,"ok":..,"message":..,"created":..,"alreadyMounted":..,"fallback":..,"image":..,
+// "mount":..,"notes":[..]}. The same shape is checked on the CLI side (src/host/storage/contained/helper-port.ts).
+using System;
+using System.Collections.Generic;
+using System.Text;
+using System.Web.Script.Serialization;
+
+namespace AgentSandbox.StorageHelper
+{
+    public static class Protocol
+    {
+        public const int Version = 1;
+        public const int MaxRequestBytes = 512;
+
+        /// <summary>The verb and set of a request, or a RefusedException that says what is wrong with it.</summary>
+        public static void Parse(string text, out string verb, out string set)
+        {
+            verb = null;
+            set = null;
+            if (text == null || Encoding.UTF8.GetByteCount(text) > MaxRequestBytes)
+            {
+                throw new RefusedException("The request is too long.");
+            }
+            object parsed;
+            try
+            {
+                JavaScriptSerializer serializer = new JavaScriptSerializer();
+                serializer.MaxJsonLength = MaxRequestBytes;
+                serializer.RecursionLimit = 4;
+                parsed = serializer.DeserializeObject(text);
+            }
+            catch (Exception)
+            {
+                throw new RefusedException("The request is not valid JSON.");
+            }
+            Dictionary<string, object> fields = parsed as Dictionary<string, object>;
+            if (fields == null || fields.Count != 2 || !fields.ContainsKey("verb") || !fields.ContainsKey("set"))
+            {
+                throw new RefusedException("The request must have exactly a verb and a set.");
+            }
+            verb = fields["verb"] as string;
+            set = fields["set"] as string;
+            if (verb != "mount" && verb != "dismount")
+            {
+                throw new RefusedException("Unknown verb: only mount and dismount.");
+            }
+            if (!Rules.IsSetName(set))
+            {
+                throw new RefusedException("The data set name is not allowed.");
+            }
+        }
+
+        public static string Answer(Outcome outcome)
+        {
+            StringBuilder sb = new StringBuilder();
+            sb.Append("{\"protocol\":").Append(Version);
+            sb.Append(",\"ok\":").Append(outcome.Ok ? "true" : "false");
+            sb.Append(",\"message\":").Append(Quote(Safe.Text(outcome.Message, 1500)));
+            sb.Append(",\"created\":").Append(outcome.Created ? "true" : "false");
+            sb.Append(",\"alreadyMounted\":").Append(outcome.AlreadyMounted ? "true" : "false");
+            sb.Append(",\"fallback\":").Append(outcome.Fallback ? "true" : "false");
+            sb.Append(",\"image\":").Append(Quote(outcome.Image ?? ""));
+            sb.Append(",\"mount\":").Append(Quote(outcome.Mount ?? ""));
+            sb.Append(",\"notes\":[");
+            for (int i = 0; i < outcome.Notes.Count && i < 20; i++)
+            {
+                if (i > 0)
+                {
+                    sb.Append(',');
+                }
+                sb.Append(Quote(Safe.Text(outcome.Notes[i], 300)));
+            }
+            sb.Append("]}");
+            return sb.ToString();
+        }
+
+        public static string Quote(string text)
+        {
+            StringBuilder sb = new StringBuilder();
+            sb.Append('"');
+            foreach (char ch in text ?? "")
+            {
+                if (ch == '"')
+                {
+                    sb.Append("\\\"");
+                }
+                else if (ch == '\\')
+                {
+                    sb.Append("\\\\");
+                }
+                else if (ch < ' ' || ch > (char)126)
+                {
+                    sb.Append("\\u").Append(((int)ch).ToString("x4"));
+                }
+                else
+                {
+                    sb.Append(ch);
+                }
+            }
+            sb.Append('"');
+            return sb.ToString();
+        }
+    }
+}

package/native/csharp/StorageHelper/RateLimiter.cs

@@ -0,0 +1,97 @@
+// How often the service answers: a few calls a minute per user and a cap for everyone together, so no client can keep
+// it (and the disks) busy. A refused call is logged only once per window for each user, so the log cannot be flooded.
+using System;
+using System.Collections.Generic;
+
+namespace AgentSandbox.StorageHelper
+{
+    public sealed class RateLimiter
+    {
+        private readonly object gate = new object();
+        private readonly int perKey;
+        private readonly int total;
+        private readonly TimeSpan window;
+        private readonly Dictionary<string, Queue<DateTime>> calls = new Dictionary<string, Queue<DateTime>>(StringComparer.OrdinalIgnoreCase);
+        private readonly Queue<DateTime> all = new Queue<DateTime>();
+        private readonly Dictionary<string, DateTime> lastRefusalLogged = new Dictionary<string, DateTime>(StringComparer.OrdinalIgnoreCase);
+
+        public RateLimiter(int perKey, int total, TimeSpan window)
+        {
+            this.perKey = perKey;
+            this.total = total;
+            this.window = window;
+        }
+
+        /// <summary>True when this call may run (and counts it).</summary>
+        public bool TryTake(string key, DateTime now)
+        {
+            lock (gate)
+            {
+                Trim(all, now);
+                Queue<DateTime> mine;
+                if (!calls.TryGetValue(key, out mine))
+                {
+                    mine = new Queue<DateTime>();
+                    calls[key] = mine;
+                }
+                Trim(mine, now);
+                DropIdleKeys(now);
+                if (mine.Count >= perKey || all.Count >= total)
+                {
+                    return false;
+                }
+                mine.Enqueue(now);
+                all.Enqueue(now);
+                return true;
+            }
+        }
+
+        /// <summary>True for the first refusal of this key in a window (that one is logged, the rest are not).</summary>
+        public bool ShouldLogRefusal(string key, DateTime now)
+        {
+            lock (gate)
+            {
+                DateTime last;
+                if (lastRefusalLogged.TryGetValue(key, out last) && now - last < window)
+                {
+                    return false;
+                }
+                if (lastRefusalLogged.Count > 1000)
+                {
+                    lastRefusalLogged.Clear();
+                }
+                lastRefusalLogged[key] = now;
+                return true;
+            }
+        }
+
+        private void Trim(Queue<DateTime> queue, DateTime now)
+        {
+            while (queue.Count > 0 && now - queue.Peek() >= window)
+            {
+                queue.Dequeue();
+            }
+        }
+
+        private void DropIdleKeys(DateTime now)
+        {
+            if (calls.Count < 1000)
+            {
+                return;
+            }
+            List<string> idle = new List<string>();
+            foreach (KeyValuePair<string, Queue<DateTime>> pair in calls)
+            {
+                Trim(pair.Value, now);
+                if (pair.Value.Count == 0)
+                {
+                    idle.Add(pair.Key);
+                }
+            }
+            foreach (string key in idle)
+            {
+                calls.Remove(key);
+            }
+        }
+    }
+}

package/native/csharp/StorageHelper/Rules.cs

@@ -0,0 +1,156 @@
+// The pure rules of contained storage, the same as native\scripts\contained-common.ps1 (Test-PlainAbsolute and
+// Assert-ContainedRequest): a data set name, a plain full path, and the two paths a data set may use, which the service
+// builds itself from the storage folder: <storage>\images\<set>.vhdx and <storage>\mounts\<set>.
+using System;
+using System.Text.RegularExpressions;
+
+namespace AgentSandbox.StorageHelper
+{
+    public sealed class ContainedPaths
+    {
+        public ContainedPaths(string storageRoot, string set)
+        {
+            StorageRoot = storageRoot;
+            Set = set;
+            ImagesDir = storageRoot + "\\images";
+            MountsDir = storageRoot + "\\mounts";
+            Image = ImagesDir + "\\" + set + ".vhdx";
+            Mount = MountsDir + "\\" + set;
+        }
+
+        public string StorageRoot { get; private set; }
+        public string Set { get; private set; }
+        public string ImagesDir { get; private set; }
+        public string MountsDir { get; private set; }
+        public string Image { get; private set; }
+        public string Mount { get; private set; }
+    }
+
+    public static class Rules
+    {
+        public const int MinGb = 8;
+        public const int MaxGb = 4096;
+        private static readonly Regex NameRule = new Regex("^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$", RegexOptions.CultureInvariant);
+        private static readonly Regex PathRule = new Regex("^[^\"<>|*?\\x00-\\x1f]+$", RegexOptions.CultureInvariant);
+        private static readonly Regex DriveRule = new Regex("^[A-Za-z]:\\\\", RegexOptions.CultureInvariant);
+        private const int MaxPathLength = 240;
+
+        public static bool IsSetName(string name)
+        {
+            return name != null && NameRule.IsMatch(name);
+        }
+
+        /// <summary>A drive letter and plain folder names: no UNC or \\?\ form, no . or .. part, no stream, no slash.</summary>
+        public static bool IsPlainAbsolute(string path)
+        {
+            if (string.IsNullOrEmpty(path) || path.Trim().Length == 0 || path.Length > MaxPathLength)
+            {
+                return false;
+            }
+            if (!PathRule.IsMatch(path) || !DriveRule.IsMatch(path))
+            {
+                return false;
+            }
+            if (path.IndexOf(':', 2) >= 0 || path.IndexOf('/') >= 0)
+            {
+                return false;
+            }
+            string rest = path.Substring(3).TrimEnd('\\');
+            if (rest.Length == 0)
+            {
+                return true;
+            }
+            foreach (string part in rest.Split('\\'))
+            {
+                if (part.Length == 0 || part == "." || part == ".." || part.EndsWith(" ") || part.EndsWith("."))
+                {
+                    return false;
+                }
+            }
+            return true;
+        }
+
+        /// <summary>The paths of one data set under a storage folder, or an exception that says why not.</summary>
+        public static ContainedPaths PathsFor(string storageRoot, string set)
+        {
+            if (!IsSetName(set))
+            {
+                throw new RefusedException("The data set name is not allowed: " + Safe.Text(set, 80));
+            }
+            if (!IsPlainAbsolute(storageRoot))
+            {
+                throw new RefusedException("The storage folder is not a plain full path (no .., no network path): " + Safe.Text(storageRoot, 300));
+            }
+            string root = storageRoot.TrimEnd('\\');
+            if (root.Length <= 3)
+            {
+                throw new RefusedException("The storage folder cannot be a drive root.");
+            }
+            ContainedPaths paths = new ContainedPaths(root, set);
+            if (!IsPlainAbsolute(paths.Image) || !IsPlainAbsolute(paths.Mount))
+            {
+                throw new RefusedException("The storage folder path is too long.");
+            }
+            return paths;
+        }
+
+        public static void CheckMaxGb(long maxGb)
+        {
+            if (maxGb < MinGb || maxGb > MaxGb)
+            {
+                throw new RefusedException("The size limit must be between 8 and 4096 GB.");
+            }
+        }
+
+        /// <summary>The folders from the drive root down to (and with) the storage folder, the drive root first.</summary>
+        public static string[] FoldersDownTo(string root)
+        {
+            string[] parts = root.Substring(3).Split('\\');
+            string[] folders = new string[parts.Length + 1];
+            folders[0] = root.Substring(0, 3);
+            string at = root.Substring(0, 2);
+            for (int i = 0; i < parts.Length; i++)
+            {
+                at = at + "\\" + parts[i];
+                folders[i + 1] = at;
+            }
+            return folders;
+        }
+
+        public static bool SamePath(string a, string b)
+        {
+            return string.Equals(a.TrimEnd('\\'), b.TrimEnd('\\'), StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    /// <summary>A request the rules refuse: the message is for the user (no stack, no internals).</summary>
+    public sealed class RefusedException : Exception
+    {
+        public RefusedException(string message) : base(message)
+        {
+        }
+    }
+
+    public static class Safe
+    {
+        /// <summary>Printable ASCII only, at most max characters: what goes into the log and the answer from outside text.</summary>
+        public static string Text(string text, int max)
+        {
+            if (text == null)
+            {
+                return "";
+            }
+            System.Text.StringBuilder sb = new System.Text.StringBuilder();
+            foreach (char ch in text)
+            {
+                if (sb.Length >= max)
+                {
+                    sb.Append("...");
+                    break;
+                }
+                sb.Append(ch >= ' ' && ch < (char)127 ? ch : '?');
+            }
+            return sb.ToString();
+        }
+    }
+}