Skip to content

Commit

Permalink
feat(import-bundle)!: Remove support for globalLexicals and inescapab…
Browse files Browse the repository at this point in the history 
…leGlobalLexicals

*BREAKING CHANGE*: Removes support for globalLexicals and inescapableGlobalLexicals, and consequently drops support for patterns like metering, where a hidden lexical and censoring transform were able to add invisible machinery to a compartment and all its descendants.
  • Loading branch information
@kriskowal
kriskowal committed Oct 28, 2022
1 parent b0b2fe7 commit c937056
Show file tree
Hide file tree
Showing 5 changed files with 21 additions and 199 deletions.
12 changes: 1 addition & 11 deletions packages/import-bundle/src/compartment-wrapper.js
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
export function wrapInescapableCompartment(
OldCompartment,
inescapableTransforms,
inescapableGlobalLexicals,
inescapableGlobalProperties,
) {
// This is the new Compartment constructor. We name it `Compartment` so
Expand All @@ -12,20 +11,11 @@ export function wrapInescapableCompartment(
modules,
oldOptions = {},
) {
const {
transforms: oldTransforms = [],
globalLexicals: oldGlobalLexicals = {},
...otherOptions
} = oldOptions;
const { transforms: oldTransforms = [], ...otherOptions } = oldOptions;
const newTransforms = [...oldTransforms, ...inescapableTransforms];
const newGlobalLexicals = {
...oldGlobalLexicals,
...inescapableGlobalLexicals,
};
const newOptions = {
...otherOptions,
transforms: newTransforms,
globalLexicals: newGlobalLexicals,
};

// The real Compartment is defined as a class, so 'new Compartment()'
Expand Down
63 changes: 14 additions & 49 deletions packages/import-bundle/src/compartment-wrapper.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,7 @@ Impose inescapable options on a `Compartment`.

[compartment][Compartments] provide a way to evaluate ECMAScript code against a specific global object, which can be used to limit that code's authority by simply removing access to host-provided IO properties like `Request`.

Compartments can also apply a transform to all the code they evaluate, and provide additional global lexicals to its environment, which can futher control its behavior. For example, the transform might inject a "metering check" into the beginning of each block, which decrements a counter and throws an exception if it underflows. This can be used to prevent the confined code from consuming excessive CPU.

The Compartment's configured transform will be applied to any code evaluated through external calls to `c.evaluate(code)` and `c.import(module)`. It will also be applied to internal evaluations via `eval(code)` and `new Function(code)`. However, the transforms and other options are not automatically propagated to new child Compartments.
Compartments can also apply a transform or add globals to all the code they evaluate which can futher control its behavior. Some of those transforms or globals may need to be inescapable, such that any child compartment (transitively) will have these transforms and globals. Particularly, to ensure that a Compartment and its transitive child Compartments all have a `WeakMap` or `WeakSet` that tracks the content of all guest `Weak*` collections, these endowments must be "inescapable".

To prevent code from escaping a transform by evaluating its code in a new child `Compartment`, the creator of the confined compartment must replace its `Compartment` constructor with a wrapped version. The wrapper will modify the arguments to include the transforms (and other options). It must merge the provided options with the imposed ones in the right order, to ensure they cannot be overridden (i.e. the imposed transforms must appear at the *end* of the list). Finally, it must also propogate the wrapper itself to the new child Compartment, by modifying `c.thisGlobal.Compartment` on each newly created compartment.

Expand All @@ -18,64 +16,31 @@ This module provides a function to create a `Compartment` constructor that enfor
```js
import { wrapInescapableCompartment } from '.../compartment-wrapper';

// Allow oldSrc to increment the odometer, but not read it. SES offers much
// easier ways to do this, of course.

function milageTransform(oldSrc) {
if (oldSrc.indexOf('getOdometer') !== -1) {
throw Error(`forbidden access to 'getOdometer' in oldSrc`);
}
return oldSrc.replace(/addMilage\(\)/g, 'getOdometer().add(1)');
}
const { WrappedWeakMap, WrappedWeakSet } = wrapWeakCollections();

// add a lexical that the original code cannot reach
function makeOdometer() {
let counter = 0;
function add(count) {
counter += count;
}
function read() {
return counter;
}
return { add, read };
}
const odometer = makeOdometer();
function getOdometer() {
return odometer;
}
const inescapableGlobalProperties = {
WeakMap: WrappedWeakMap,
WeakSet: WrappedWeakSet,
};
const WrappedCompartment = wrapInescapableCompartment(
Compartment,
inescapableGlobalProperties,
);

const inescapableTransforms = [milageTransform];
const inescapableGlobalLexicals = { getOdometer };
const WrappedCompartment = wrapInescapableCompartment(Compartment,
inescapableTransforms,
inescapableGlobalLexicals);
const endowments = {};
const modules = {};
const options = {};
const c = new WrappedCompartment(endowments, modules, options);
c.evaluate(confinedCode);
// c.import(confinedModule);
```

If `confinedCode` creates its own Compartment with something like:
If `confinedCode` creates its own `Compartment`, in which `WeakMap` will
still produced wrapped `WeakMap` instances.

```js
const c2 = new Compartment(endowments, modules, { transforms, globalLexicals });
const c2 = new Compartment();
c2.evaluate(`new WeakMap()`);
```

then its Compartment constructor will actually be invoked like this:

```js
new Compartment(endowments, modules,
{
transforms: [...transforms, milageTransform],
globalLexicals: { ...globalLexicals, getOdometer },
});
```

except that it could not make such an invocation itself, because it won't have access to `milageTransform` (which doesn't appear in the globals or global lexicals), or `getOdometer` (which *does* appear in the global lexicals, but the transform ensures that it cannot be reached by the pre-transformed `confinedCode`).



[Compartments]: ../../ses/README.md#compartment
[SES]: ../../ses/README.md
6 changes: 1 addition & 5 deletions packages/import-bundle/src/index.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,12 +14,10 @@ export async function importBundle(bundle, options = {}) {
const {
filePrefix,
endowments: optEndowments = {},
globalLexicals = {},
// transforms are indeed __shimTransforms__, intended to apply to both
// evaluated programs and modules shimmed to programs.
transforms = [],
inescapableTransforms = [],
inescapableGlobalLexicals = {},
inescapableGlobalProperties = {},
} = options;
const endowments = {
Expand All @@ -35,13 +33,11 @@ export async function importBundle(bundle, options = {}) {
let CompartmentToUse = Compartment;
if (
inescapableTransforms.length ||
Object.keys(inescapableGlobalLexicals).length ||
Object.keys(inescapableGlobalProperties).length
) {
CompartmentToUse = wrapInescapableCompartment(
Compartment,
inescapableTransforms,
inescapableGlobalLexicals,
inescapableGlobalProperties,
);
}
Expand Down Expand Up @@ -89,7 +85,7 @@ export async function importBundle(bundle, options = {}) {
assert.fail(X`unrecognized moduleFormat '${moduleFormat}'`);
}

c = new CompartmentToUse(endowments, {}, { globalLexicals, transforms });
c = new CompartmentToUse(endowments, {}, { transforms });
harden(c.globalThis);
const actualSource = `(${source})\n${sourceMap || ''}`;
const namespace = c.evaluate(actualSource)(filePrefix);
Expand Down
121 changes: 5 additions & 116 deletions packages/import-bundle/test/test-compartment-wrapper.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,113 +4,9 @@ import { test } from './prepare-test-env-ava.js';
// eslint-disable-next-line import/order
import { wrapInescapableCompartment } from '../src/compartment-wrapper.js';

const { details: X } = assert;

// We build a transform that allows oldSrc to increment the odometer, but not
// read it. Note, of course, that SES provides a far easier way to accomplish
// this (pass in a hardened `addMilage` endowment), but there are metering
// use cases that don't involve voluntary participation by oldSrc.

function milageTransform(oldSrc) {
oldSrc.indexOf('getOdometer') === -1 ||
assert.fail(X`forbidden access to 'getOdometer' in oldSrc`);
return oldSrc.replace(/addMilage\(\)/g, 'getOdometer().add(1)');
}

// add a lexical that the original code cannot reach
function makeOdometer() {
let counter = 0;
function add(count) {
counter += count;
}
function reset() {
counter = 0; // forbidden
}
function read() {
return counter;
}
return { add, read, reset };
}

const createChild = `() => new Compartment({console})`;
const doAdd = `addMilage()`;
const doAddInChild = `(doAdd) => (new Compartment({console})).evaluate(doAdd)`;
const attemptReset = `() => getOdometer().reset()`;
const attemptResetInChild = `(attemptReset) => {
const c = new Compartment();
c.evaluate(attemptReset)();
}`;

// attempt to shadow 'getOdometer' (blocked by the inescapable lexical coming
// last)
const attemptResetByShadow = `(doAdd) => {
const taboo = 'get' + 'Odometer';
let fakeCalled = false;
function fakeGet() {
fakeCalled = true;
return {
add(_) {addMilage(); addMilage();},
};
}
const globalLexicals = { [taboo]: fakeGet };
const c = new Compartment({ console }, {}, { globalLexicals });
c.evaluate(doAdd);
return fakeCalled;
}`;

// attempt to undo the transform (blocked by the inescapable transform coming
// last)
const attemptResetByTransform = `() => {
const taboo = 'get' + 'Odometer';
function transform(oldSrc) {
return oldSrc.replace(/getTaboo/g, taboo);
}
const transforms = [ transform ];
const c = new Compartment({ console }, {}, { transforms });
c.evaluate('getTaboo().reset()');
}`;

function check(t, c, odometer, n) {
t.is(odometer.read(), 0, `${n}.start`);
c.evaluate(doAdd);
t.is(odometer.read(), 1, `${n}.doAdd`);
odometer.reset();

c.evaluate(doAddInChild)(doAdd);
t.is(odometer.read(), 1, `${n}.doAddInChild`);
odometer.reset();

odometer.add(5);
t.throws(
() => c.evaluate(attemptReset)(),
{ message: /forbidden access/ },
`${n}.attemptReset`,
);
t.is(odometer.read(), 5, `${n} not reset`);

t.throws(
() => c.evaluate(attemptResetInChild)(attemptReset),
{ message: /forbidden access/ },
`${n}.attemptResetInChild`,
);
t.is(odometer.read(), 5, `${n} not reset`);
odometer.reset();

const fakeCalled = c.evaluate(attemptResetByShadow)(doAdd);
t.falsy(fakeCalled, `${n}.attemptResetByShadow`);
t.is(odometer.read(), 1, `${n} called anyway`);
odometer.reset();

odometer.add(5);
t.throws(
() => c.evaluate(attemptResetByTransform)(),
{ message: /forbidden access/ },
`${n}.attemptResetByTransform`,
);
t.is(odometer.read(), 5, `${n} not reset`);
odometer.reset();

function check(t, c, n) {
t.is(c.evaluate('Compartment.name'), 'Compartment', `${n}.Compartment.name`);

t.truthy(c instanceof Compartment, `${n} instanceof`);
Expand All @@ -132,27 +28,20 @@ function check(t, c, odometer, n) {
}

test('wrap', t => {
const odometer = makeOdometer();
function getOdometer() {
return odometer;
}

const inescapableTransforms = [milageTransform];
const inescapableGlobalLexicals = { getOdometer };
const inescapableTransforms = [];
const inescapableGlobalProperties = { WeakMap: 'replaced' };
const WrappedCompartment = wrapInescapableCompartment(
Compartment,
inescapableTransforms,
inescapableGlobalLexicals,
inescapableGlobalProperties,
);
const endowments = { console };
const c1 = new WrappedCompartment(endowments);
check(t, c1, odometer, 'c1');
check(t, c1, 'c1');

const c2 = c1.evaluate(createChild)();
check(t, c2, odometer, 'c2');
check(t, c2, 'c2');

const c3 = c2.evaluate(createChild)();
check(t, c3, odometer, 'c3');
check(t, c3, 'c3');
});
18 changes: 0 additions & 18 deletions packages/import-bundle/test/test-import-bundle.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -122,21 +122,3 @@ test('inescapable transforms', async function testInescapableTransforms(t) {
});
t.is(ns.f4('is ok'), 'substitution is ok', `iT ns.f4 ok`);
});

test('inescapable globalLexicals', async function testInescapableGlobalLexicals(t) {
const b1 = await bundleSource(
url.fileURLToPath(new URL('bundle1.js', import.meta.url)),
'nestedEvaluate',
);
function req(what) {
console.log(`require(${what})`);
}
harden(Object.getPrototypeOf(console));
const endowments = { require: req, console };

const ns = await importBundle(b1, {
endowments,
inescapableGlobalLexicals: { endow1: 3 },
});
t.is(ns.f3(1), 4, `iGL ns.f3 ok`);
});

0 comments on commit c937056

Please sign in to comment.