From c937056f9784294fcda793fe25d86baa5d5ca052 Mon Sep 17 00:00:00 2001 From: Kris Kowal Date: Wed, 26 Oct 2022 17:23:39 -0700 Subject: [PATCH] feat(import-bundle)!: Remove support for globalLexicals and inescapableGlobalLexicals *BREAKING CHANGE*: Removes support for globalLexicals and inescapableGlobalLexicals, and consequently drops support for patterns like metering, where a hidden lexical and censoring transform were able to add invisible machinery to a compartment and all its descendants. --- .../import-bundle/src/compartment-wrapper.js | 12 +- .../import-bundle/src/compartment-wrapper.md | 63 ++------- packages/import-bundle/src/index.js | 6 +- .../test/test-compartment-wrapper.js | 121 +----------------- .../import-bundle/test/test-import-bundle.js | 18 --- 5 files changed, 21 insertions(+), 199 deletions(-) diff --git a/packages/import-bundle/src/compartment-wrapper.js b/packages/import-bundle/src/compartment-wrapper.js index a664e741e6..b5bc57da75 100644 --- a/packages/import-bundle/src/compartment-wrapper.js +++ b/packages/import-bundle/src/compartment-wrapper.js @@ -1,7 +1,6 @@ export function wrapInescapableCompartment( OldCompartment, inescapableTransforms, - inescapableGlobalLexicals, inescapableGlobalProperties, ) { // This is the new Compartment constructor. We name it `Compartment` so @@ -12,20 +11,11 @@ export function wrapInescapableCompartment( modules, oldOptions = {}, ) { - const { - transforms: oldTransforms = [], - globalLexicals: oldGlobalLexicals = {}, - ...otherOptions - } = oldOptions; + const { transforms: oldTransforms = [], ...otherOptions } = oldOptions; const newTransforms = [...oldTransforms, ...inescapableTransforms]; - const newGlobalLexicals = { - ...oldGlobalLexicals, - ...inescapableGlobalLexicals, - }; const newOptions = { ...otherOptions, transforms: newTransforms, - globalLexicals: newGlobalLexicals, }; // The real Compartment is defined as a class, so 'new Compartment()' diff --git a/packages/import-bundle/src/compartment-wrapper.md b/packages/import-bundle/src/compartment-wrapper.md index b3720429d0..e43c6a9711 100644 --- a/packages/import-bundle/src/compartment-wrapper.md +++ b/packages/import-bundle/src/compartment-wrapper.md @@ -4,9 +4,7 @@ Impose inescapable options on a `Compartment`. [compartment][Compartments] provide a way to evaluate ECMAScript code against a specific global object, which can be used to limit that code's authority by simply removing access to host-provided IO properties like `Request`. -Compartments can also apply a transform to all the code they evaluate, and provide additional global lexicals to its environment, which can futher control its behavior. For example, the transform might inject a "metering check" into the beginning of each block, which decrements a counter and throws an exception if it underflows. This can be used to prevent the confined code from consuming excessive CPU. - -The Compartment's configured transform will be applied to any code evaluated through external calls to `c.evaluate(code)` and `c.import(module)`. It will also be applied to internal evaluations via `eval(code)` and `new Function(code)`. However, the transforms and other options are not automatically propagated to new child Compartments. +Compartments can also apply a transform or add globals to all the code they evaluate which can futher control its behavior. Some of those transforms or globals may need to be inescapable, such that any child compartment (transitively) will have these transforms and globals. Particularly, to ensure that a Compartment and its transitive child Compartments all have a `WeakMap` or `WeakSet` that tracks the content of all guest `Weak*` collections, these endowments must be "inescapable". To prevent code from escaping a transform by evaluating its code in a new child `Compartment`, the creator of the confined compartment must replace its `Compartment` constructor with a wrapped version. The wrapper will modify the arguments to include the transforms (and other options). It must merge the provided options with the imposed ones in the right order, to ensure they cannot be overridden (i.e. the imposed transforms must appear at the *end* of the list). Finally, it must also propogate the wrapper itself to the new child Compartment, by modifying `c.thisGlobal.Compartment` on each newly created compartment. @@ -18,64 +16,31 @@ This module provides a function to create a `Compartment` constructor that enfor ```js import { wrapInescapableCompartment } from '.../compartment-wrapper'; -// Allow oldSrc to increment the odometer, but not read it. SES offers much -// easier ways to do this, of course. - -function milageTransform(oldSrc) { - if (oldSrc.indexOf('getOdometer') !== -1) { - throw Error(`forbidden access to 'getOdometer' in oldSrc`); - } - return oldSrc.replace(/addMilage\(\)/g, 'getOdometer().add(1)'); -} +const { WrappedWeakMap, WrappedWeakSet } = wrapWeakCollections(); -// add a lexical that the original code cannot reach -function makeOdometer() { - let counter = 0; - function add(count) { - counter += count; - } - function read() { - return counter; - } - return { add, read }; -} -const odometer = makeOdometer(); -function getOdometer() { - return odometer; -} +const inescapableGlobalProperties = { + WeakMap: WrappedWeakMap, + WeakSet: WrappedWeakSet, +}; +const WrappedCompartment = wrapInescapableCompartment( + Compartment, + inescapableGlobalProperties, +); -const inescapableTransforms = [milageTransform]; -const inescapableGlobalLexicals = { getOdometer }; -const WrappedCompartment = wrapInescapableCompartment(Compartment, - inescapableTransforms, - inescapableGlobalLexicals); const endowments = {}; const modules = {}; const options = {}; const c = new WrappedCompartment(endowments, modules, options); c.evaluate(confinedCode); -// c.import(confinedModule); ``` -If `confinedCode` creates its own Compartment with something like: +If `confinedCode` creates its own `Compartment`, in which `WeakMap` will +still produced wrapped `WeakMap` instances. ```js -const c2 = new Compartment(endowments, modules, { transforms, globalLexicals }); +const c2 = new Compartment(); +c2.evaluate(`new WeakMap()`); ``` -then its Compartment constructor will actually be invoked like this: - -```js -new Compartment(endowments, modules, - { - transforms: [...transforms, milageTransform], - globalLexicals: { ...globalLexicals, getOdometer }, - }); -``` - -except that it could not make such an invocation itself, because it won't have access to `milageTransform` (which doesn't appear in the globals or global lexicals), or `getOdometer` (which *does* appear in the global lexicals, but the transform ensures that it cannot be reached by the pre-transformed `confinedCode`). - - - [Compartments]: ../../ses/README.md#compartment [SES]: ../../ses/README.md diff --git a/packages/import-bundle/src/index.js b/packages/import-bundle/src/index.js index dbb87c8969..51b47153f7 100644 --- a/packages/import-bundle/src/index.js +++ b/packages/import-bundle/src/index.js @@ -14,12 +14,10 @@ export async function importBundle(bundle, options = {}) { const { filePrefix, endowments: optEndowments = {}, - globalLexicals = {}, // transforms are indeed __shimTransforms__, intended to apply to both // evaluated programs and modules shimmed to programs. transforms = [], inescapableTransforms = [], - inescapableGlobalLexicals = {}, inescapableGlobalProperties = {}, } = options; const endowments = { @@ -35,13 +33,11 @@ export async function importBundle(bundle, options = {}) { let CompartmentToUse = Compartment; if ( inescapableTransforms.length || - Object.keys(inescapableGlobalLexicals).length || Object.keys(inescapableGlobalProperties).length ) { CompartmentToUse = wrapInescapableCompartment( Compartment, inescapableTransforms, - inescapableGlobalLexicals, inescapableGlobalProperties, ); } @@ -89,7 +85,7 @@ export async function importBundle(bundle, options = {}) { assert.fail(X`unrecognized moduleFormat '${moduleFormat}'`); } - c = new CompartmentToUse(endowments, {}, { globalLexicals, transforms }); + c = new CompartmentToUse(endowments, {}, { transforms }); harden(c.globalThis); const actualSource = `(${source})\n${sourceMap || ''}`; const namespace = c.evaluate(actualSource)(filePrefix); diff --git a/packages/import-bundle/test/test-compartment-wrapper.js b/packages/import-bundle/test/test-compartment-wrapper.js index b96779f417..ba0f00a9ad 100644 --- a/packages/import-bundle/test/test-compartment-wrapper.js +++ b/packages/import-bundle/test/test-compartment-wrapper.js @@ -4,113 +4,9 @@ import { test } from './prepare-test-env-ava.js'; // eslint-disable-next-line import/order import { wrapInescapableCompartment } from '../src/compartment-wrapper.js'; -const { details: X } = assert; - -// We build a transform that allows oldSrc to increment the odometer, but not -// read it. Note, of course, that SES provides a far easier way to accomplish -// this (pass in a hardened `addMilage` endowment), but there are metering -// use cases that don't involve voluntary participation by oldSrc. - -function milageTransform(oldSrc) { - oldSrc.indexOf('getOdometer') === -1 || - assert.fail(X`forbidden access to 'getOdometer' in oldSrc`); - return oldSrc.replace(/addMilage\(\)/g, 'getOdometer().add(1)'); -} - -// add a lexical that the original code cannot reach -function makeOdometer() { - let counter = 0; - function add(count) { - counter += count; - } - function reset() { - counter = 0; // forbidden - } - function read() { - return counter; - } - return { add, read, reset }; -} - const createChild = `() => new Compartment({console})`; -const doAdd = `addMilage()`; -const doAddInChild = `(doAdd) => (new Compartment({console})).evaluate(doAdd)`; -const attemptReset = `() => getOdometer().reset()`; -const attemptResetInChild = `(attemptReset) => { - const c = new Compartment(); - c.evaluate(attemptReset)(); -}`; - -// attempt to shadow 'getOdometer' (blocked by the inescapable lexical coming -// last) -const attemptResetByShadow = `(doAdd) => { - const taboo = 'get' + 'Odometer'; - let fakeCalled = false; - function fakeGet() { - fakeCalled = true; - return { - add(_) {addMilage(); addMilage();}, - }; - } - const globalLexicals = { [taboo]: fakeGet }; - - const c = new Compartment({ console }, {}, { globalLexicals }); - c.evaluate(doAdd); - return fakeCalled; -}`; - -// attempt to undo the transform (blocked by the inescapable transform coming -// last) -const attemptResetByTransform = `() => { - const taboo = 'get' + 'Odometer'; - function transform(oldSrc) { - return oldSrc.replace(/getTaboo/g, taboo); - } - const transforms = [ transform ]; - const c = new Compartment({ console }, {}, { transforms }); - c.evaluate('getTaboo().reset()'); -}`; - -function check(t, c, odometer, n) { - t.is(odometer.read(), 0, `${n}.start`); - c.evaluate(doAdd); - t.is(odometer.read(), 1, `${n}.doAdd`); - odometer.reset(); - - c.evaluate(doAddInChild)(doAdd); - t.is(odometer.read(), 1, `${n}.doAddInChild`); - odometer.reset(); - - odometer.add(5); - t.throws( - () => c.evaluate(attemptReset)(), - { message: /forbidden access/ }, - `${n}.attemptReset`, - ); - t.is(odometer.read(), 5, `${n} not reset`); - - t.throws( - () => c.evaluate(attemptResetInChild)(attemptReset), - { message: /forbidden access/ }, - `${n}.attemptResetInChild`, - ); - t.is(odometer.read(), 5, `${n} not reset`); - odometer.reset(); - - const fakeCalled = c.evaluate(attemptResetByShadow)(doAdd); - t.falsy(fakeCalled, `${n}.attemptResetByShadow`); - t.is(odometer.read(), 1, `${n} called anyway`); - odometer.reset(); - - odometer.add(5); - t.throws( - () => c.evaluate(attemptResetByTransform)(), - { message: /forbidden access/ }, - `${n}.attemptResetByTransform`, - ); - t.is(odometer.read(), 5, `${n} not reset`); - odometer.reset(); +function check(t, c, n) { t.is(c.evaluate('Compartment.name'), 'Compartment', `${n}.Compartment.name`); t.truthy(c instanceof Compartment, `${n} instanceof`); @@ -132,27 +28,20 @@ function check(t, c, odometer, n) { } test('wrap', t => { - const odometer = makeOdometer(); - function getOdometer() { - return odometer; - } - - const inescapableTransforms = [milageTransform]; - const inescapableGlobalLexicals = { getOdometer }; + const inescapableTransforms = []; const inescapableGlobalProperties = { WeakMap: 'replaced' }; const WrappedCompartment = wrapInescapableCompartment( Compartment, inescapableTransforms, - inescapableGlobalLexicals, inescapableGlobalProperties, ); const endowments = { console }; const c1 = new WrappedCompartment(endowments); - check(t, c1, odometer, 'c1'); + check(t, c1, 'c1'); const c2 = c1.evaluate(createChild)(); - check(t, c2, odometer, 'c2'); + check(t, c2, 'c2'); const c3 = c2.evaluate(createChild)(); - check(t, c3, odometer, 'c3'); + check(t, c3, 'c3'); }); diff --git a/packages/import-bundle/test/test-import-bundle.js b/packages/import-bundle/test/test-import-bundle.js index 039983032d..c6ccddaddc 100644 --- a/packages/import-bundle/test/test-import-bundle.js +++ b/packages/import-bundle/test/test-import-bundle.js @@ -122,21 +122,3 @@ test('inescapable transforms', async function testInescapableTransforms(t) { }); t.is(ns.f4('is ok'), 'substitution is ok', `iT ns.f4 ok`); }); - -test('inescapable globalLexicals', async function testInescapableGlobalLexicals(t) { - const b1 = await bundleSource( - url.fileURLToPath(new URL('bundle1.js', import.meta.url)), - 'nestedEvaluate', - ); - function req(what) { - console.log(`require(${what})`); - } - harden(Object.getPrototypeOf(console)); - const endowments = { require: req, console }; - - const ns = await importBundle(b1, { - endowments, - inescapableGlobalLexicals: { endow1: 3 }, - }); - t.is(ns.f3(1), 4, `iGL ns.f3 ok`); -});