Confine checked artifact loading and browser asset lookup

2026-09-19 23:38:06 -07:00
parent ac36edf62d
commit 0aaa80a4ba
6 changed files with 303 additions and 46 deletions
@@ -0,0 +1,88 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { mkdtemp, mkdir, writeFile, symlink, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import {
+  compileExecutionPlan,
+  artifactFileReader,
+  loadArtifactWorld,
+  BrowserArtifactGateway,
+  implementationDigest,
+} from "../src/execution-world/index.js";
+import { loadReaderWorkspace } from "./reader-fixture.js";
+import { buildArtifactFixture } from "./artifact-fixture.js";
+
+test("immutable-output loading rejects traversal, links, and files larger than the declared bound", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "camino-artifact-read-"));
+  try {
+    await mkdir(path.join(root, "output"));
+    await writeFile(path.join(root, "outside"), "secret");
+    await writeFile(path.join(root, "output", "file"), "data");
+    await symlink(path.join(root, "outside"), path.join(root, "output", "linked-file"));
+    await symlink(root, path.join(root, "output", "linked-dir"));
+    const read = await artifactFileReader({ package: path.join(root, "output") });
+    assert.equal(new TextDecoder().decode(await read("package", "file", 4)), "data");
+    await assert.rejects(read("package", "file", 3), /exceeds its declared bound/);
+    await assert.rejects(read("package", "linked-file", 100), /Only real directories/);
+    await assert.rejects(read("package", "linked-dir/outside", 100), /Only real directories/);
+    await assert.rejects(read("package", "../outside", 100), /normalized relative/);
+    await assert.rejects(read("unknown", "file", 100), /Unknown package output/);
+    await assert.rejects(read("package", "file", Infinity), /Invalid file byte limit/);
+    await assert.rejects(
+      artifactFileReader({ package: path.join(root, "output", "linked-dir") }),
+      /canonical absolute/,
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("gateway serves only declared browser assets with correct Wasm MIME and content identity", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "camino-artifact-world-"));
+  try {
+    const plan = compileExecutionPlan(await loadReaderWorkspace()),
+      fixture = buildArtifactFixture(plan);
+    const wasm = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0]);
+    const browser = fixture.manifest.implementations.find((i) => i.target === "browser")!;
+    browser.files.push({
+      path: "portable/browser/assets/café.wasm",
+      bytes: wasm.length,
+      digest: createHash("sha256").update(wasm).digest("hex"),
+      mediaType: "application/wasm",
+    });
+    const { contentDigest, ...body } = browser;
+    browser.contentDigest = implementationDigest(body);
+    for (const implementation of fixture.manifest.implementations)
+      for (const file of implementation.files) {
+        const target = path.join(root, file.path);
+        await mkdir(path.dirname(target), { recursive: true });
+        await writeFile(target, file.mediaType === "application/wasm" ? wasm : fixture.bytes);
+      }
+    await mkdir(path.join(root, "share/quixos"), { recursive: true });
+    await writeFile(path.join(root, "share/quixos/package-artifacts.json"), JSON.stringify(fixture.manifest));
+    const loaded = await loadArtifactWorld(plan, { [fixture.manifest.packageRevisionId]: root });
+    const gateway = new BrowserArtifactGateway(loaded);
+    assert.equal(gateway.entries.length, 1);
+    const entry = gateway.entries[0]!;
+    const response = await gateway.response(entry.url);
+    assert.equal(response?.status, 200);
+    assert.equal(response?.headers["content-type"], "text/javascript");
+    assert.equal(response?.headers["cache-control"], "private, max-age=31536000, immutable");
+    assert.deepEqual(response?.body, Buffer.from(fixture.bytes));
+    assert.equal((await gateway.response(entry.url, response?.headers.etag))?.status, 304);
+    const wasmUrl = entry.url.replace("module.mjs", "assets/caf%C3%A9.wasm");
+    const wasmResponse = await gateway.response(wasmUrl);
+    assert.equal(wasmResponse?.headers["content-type"], "application/wasm");
+    assert.deepEqual(wasmResponse?.body, Buffer.from(wasm));
+    assert.equal(await gateway.response(entry.url.replace("portable/browser/module.mjs", "bin/service")), undefined);
+    assert.equal(await gateway.response("/nix/store/secret"), undefined);
+    assert.equal(await gateway.response(entry.url.replace(loaded.digest, "0".repeat(64))), undefined);
+    await writeFile(path.join(root, browser.path), "x".repeat(fixture.bytes.length));
+    await assert.rejects(gateway.response(entry.url), /changed after world validation/);
+    await assert.rejects(loadArtifactWorld(plan, { [fixture.manifest.packageRevisionId]: root }), /Artifact bytes/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
@@ -0,0 +1,49 @@
+import { createHash } from "node:crypto";
+import {
+  implementationDigest,
+  type ExecutionPlan,
+  type PackageArtifacts,
+  type ArtifactImplementation,
+} from "../src/execution-world/index.js";
+export const buildArtifactFixture = (plan: ExecutionPlan) => {
+  const expected = plan.definition.packages[0]!;
+  const bytes = new TextEncoder().encode("export const handlers = Object.freeze({});\n");
+  const implementation = (
+    id: string,
+    target: string,
+    compatibility: ArtifactImplementation["compatibility"],
+  ): ArtifactImplementation => {
+    const path = compatibility === "quixos-service-v1" ? "bin/service" : `portable/${target}/module.mjs`;
+    const value = {
+      id,
+      target,
+      compatibility,
+      path,
+      ports: "quixos-transaction-ports-v1" as const,
+      ...(compatibility === "quixos-js-module-v1" ? { registryExport: "handlers" } : {}),
+      exports: expected.exports.map((e) => e.id),
+      files: [
+        {
+          path,
+          digest: createHash("sha256").update(bytes).digest("hex"),
+          bytes: bytes.length,
+          mediaType: compatibility === "quixos-service-v1" ? "application/octet-stream" : "text/javascript",
+        },
+      ],
+    };
+    return { ...value, contentDigest: implementationDigest(value) };
+  };
+  const manifest: PackageArtifacts = {
+    schemaVersion: 1,
+    packageRevisionId: expected.revision,
+    bindingDigest: expected.bindingDigest,
+    sourceDigest: expected.sourceDigest,
+    versions: plan.definition.versions,
+    implementations: [
+      implementation("service", "server", "quixos-service-v1"),
+      implementation("server", "server", "quixos-js-module-v1"),
+      implementation("browser", "browser", "quixos-js-module-v1"),
+    ],
+  };
+  return { manifest, bytes, read: async () => bytes };
+};
@@ -15,48 +15,7 @@ import {
  type ArtifactImplementation,
 } from "../src/execution-world/index.js";

-const buildFixture = (plan: ExecutionPlan) => {
-  const expected = plan.definition.packages[0]!;
-  const bytes = new TextEncoder().encode("export const handlers = Object.freeze({});\n");
-  const implementation = (
-    id: string,
-    target: string,
-    compatibility: ArtifactImplementation["compatibility"],
-  ): ArtifactImplementation => {
-    const path = compatibility === "quixos-service-v1" ? "bin/service" : `portable/${target}/module.mjs`;
-    const value = {
-      id,
-      target,
-      compatibility,
-      path,
-      ports: "quixos-transaction-ports-v1" as const,
-      ...(compatibility === "quixos-js-module-v1" ? { registryExport: "handlers" } : {}),
-      exports: expected.exports.map((e) => e.id),
-      files: [
-        {
-          path,
-          digest: createHash("sha256").update(bytes).digest("hex"),
-          bytes: bytes.length,
-          mediaType: compatibility === "quixos-service-v1" ? "application/octet-stream" : "text/javascript",
-        },
-      ],
-    };
-    return { ...value, contentDigest: implementationDigest(value) };
-  };
-  const manifest: PackageArtifacts = {
-    schemaVersion: 1,
-    packageRevisionId: expected.revision,
-    bindingDigest: expected.bindingDigest,
-    sourceDigest: expected.sourceDigest,
-    versions: plan.definition.versions,
-    implementations: [
-      implementation("service", "server", "quixos-service-v1"),
-      implementation("server", "server", "quixos-js-module-v1"),
-      implementation("browser", "browser", "quixos-js-module-v1"),
-    ],
-  };
-  return { manifest, bytes, read: async () => bytes };
-};
+import { buildArtifactFixture as buildFixture } from "./artifact-fixture.js";
 const resign = (implementation: ArtifactImplementation) => {
  const { contentDigest, ...body } = implementation;
  implementation.contentDigest = implementationDigest(body);