6 lines
29 KiB
JavaScript
6 lines
29 KiB
JavaScript
import{createRequire} from"node:module";const require=createRequire(import.meta.url);
|
|
import{a as f}from"./chunk-BZUGFHVS.js";function v(){let a=[{prop:"Function",target:globalThis,violationType:"function_constructor",strategy:"throw",reason:"Function constructor allows arbitrary code execution"},{prop:"eval",target:globalThis,violationType:"eval",strategy:"throw",reason:"eval() allows arbitrary code execution"},{prop:"setTimeout",target:globalThis,violationType:"setTimeout",strategy:"throw",reason:"setTimeout with string argument allows code execution"},{prop:"setInterval",target:globalThis,violationType:"setInterval",strategy:"throw",reason:"setInterval with string argument allows code execution"},{prop:"setImmediate",target:globalThis,violationType:"setImmediate",strategy:"throw",reason:"setImmediate could be used to escape sandbox context"},{prop:"env",target:process,violationType:"process_env",strategy:"throw",reason:"process.env could leak sensitive environment variables",allowedKeys:new Set(["NODE_V8_COVERAGE","NODE_DEBUG","NODE_DEBUG_NATIVE","NODE_COMPILE_CACHE","WATCH_REPORT_DEPENDENCIES","FORCE_COLOR","DEBUG","UNDICI_NO_FG","JEST_WORKER_ID","__MINIMATCH_TESTING_PLATFORM__","LOG_TOKENS","LOG_STREAM"])},{prop:"binding",target:process,violationType:"process_binding",strategy:"throw",reason:"process.binding provides access to native Node.js modules"},{prop:"_linkedBinding",target:process,violationType:"process_binding",strategy:"throw",reason:"process._linkedBinding provides access to native Node.js modules"},{prop:"dlopen",target:process,violationType:"process_dlopen",strategy:"throw",reason:"process.dlopen allows loading native addons"},{prop:"getBuiltinModule",target:process,violationType:"process_get_builtin_module",strategy:"throw",reason:"process.getBuiltinModule allows loading native Node.js modules (fs, child_process, vm)"},{prop:"exit",target:process,violationType:"process_exit",strategy:"throw",reason:"process.exit could terminate the interpreter"},{prop:"abort",target:process,violationType:"process_exit",strategy:"throw",reason:"process.abort could crash the interpreter"},{prop:"kill",target:process,violationType:"process_kill",strategy:"throw",reason:"process.kill could signal other processes"},{prop:"setuid",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.setuid could escalate privileges"},{prop:"setgid",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.setgid could escalate privileges"},{prop:"seteuid",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.seteuid could escalate effective user privileges"},{prop:"setegid",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.setegid could escalate effective group privileges"},{prop:"initgroups",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.initgroups could modify supplementary group IDs"},{prop:"setgroups",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.setgroups could modify supplementary group IDs"},{prop:"umask",target:process,violationType:"process_umask",strategy:"throw",reason:"process.umask could modify file creation permissions"},{prop:"argv",target:process,violationType:"process_argv",strategy:"throw",reason:"process.argv may contain secrets in CLI arguments"},{prop:"cwd",target:process,violationType:"process_chdir",strategy:"throw",reason:"process.cwd could disclose real host working directory path"},{prop:"chdir",target:process,violationType:"process_chdir",strategy:"throw",reason:"process.chdir could confuse the interpreter's CWD tracking"},{prop:"report",target:process,violationType:"process_report",strategy:"throw",reason:"process.report could disclose full environment, host paths, and system info"},{prop:"loadEnvFile",target:process,violationType:"process_env",strategy:"throw",reason:"process.loadEnvFile could load env files bypassing env proxy"},{prop:"setUncaughtExceptionCaptureCallback",target:process,violationType:"process_exception_handler",strategy:"throw",reason:"setUncaughtExceptionCaptureCallback could intercept security errors"},{prop:"send",target:process,violationType:"process_send",strategy:"throw",reason:"process.send could communicate with parent process in IPC contexts"},{prop:"channel",target:process,violationType:"process_channel",strategy:"throw",reason:"process.channel could access IPC channel to parent process"},{prop:"cpuUsage",target:process,violationType:"process_timing",strategy:"throw",reason:"process.cpuUsage could enable timing side-channel attacks"},{prop:"memoryUsage",target:process,violationType:"process_timing",strategy:"throw",reason:"process.memoryUsage could enable timing side-channel attacks"},{prop:"hrtime",target:process,violationType:"process_timing",strategy:"throw",reason:"process.hrtime could enable timing side-channel attacks"},{prop:"WeakRef",target:globalThis,violationType:"weak_ref",strategy:"throw",reason:"WeakRef could be used to leak references outside sandbox"},{prop:"FinalizationRegistry",target:globalThis,violationType:"finalization_registry",strategy:"throw",reason:"FinalizationRegistry could be used to leak references outside sandbox"},{prop:"Reflect",target:globalThis,violationType:"reflect",strategy:"freeze",reason:"Reflect provides introspection capabilities"},{prop:"Proxy",target:globalThis,violationType:"proxy",strategy:"throw",reason:"Proxy allows intercepting and modifying object behavior"},{prop:"WebAssembly",target:globalThis,violationType:"webassembly",strategy:"throw",reason:"WebAssembly allows executing arbitrary compiled code"},{prop:"SharedArrayBuffer",target:globalThis,violationType:"shared_array_buffer",strategy:"throw",reason:"SharedArrayBuffer could enable side-channel communication or timing attacks"},{prop:"Atomics",target:globalThis,violationType:"atomics",strategy:"throw",reason:"Atomics could enable side-channel communication or timing attacks"},{prop:"performance",target:globalThis,violationType:"performance_timing",strategy:"throw",reason:"performance.now() provides sub-millisecond timing for side-channel attacks"},{prop:"stdout",target:process,violationType:"process_stdout",strategy:"throw",reason:"process.stdout could bypass interpreter output to write to host stdout"},{prop:"stderr",target:process,violationType:"process_stderr",strategy:"throw",reason:"process.stderr could bypass interpreter output to write to host stderr"},{prop:"__defineGetter__",target:Object.prototype,violationType:"prototype_mutation",strategy:"throw",reason:"__defineGetter__ allows prototype pollution via getter injection"},{prop:"__defineSetter__",target:Object.prototype,violationType:"prototype_mutation",strategy:"throw",reason:"__defineSetter__ allows prototype pollution via setter injection"},{prop:"__lookupGetter__",target:Object.prototype,violationType:"prototype_mutation",strategy:"throw",reason:"__lookupGetter__ enables introspection for prototype pollution attacks"},{prop:"__lookupSetter__",target:Object.prototype,violationType:"prototype_mutation",strategy:"throw",reason:"__lookupSetter__ enables introspection for prototype pollution attacks"},{prop:"JSON",target:globalThis,violationType:"json_mutation",strategy:"freeze",reason:"Freeze JSON to prevent mutation of parsing/serialization"},{prop:"Math",target:globalThis,violationType:"math_mutation",strategy:"freeze",reason:"Freeze Math to prevent mutation of math utilities"}];try{let e=Object.getPrototypeOf(async()=>{}).constructor;e&&e!==Function&&a.push({prop:"constructor",target:Object.getPrototypeOf(async()=>{}),violationType:"async_function_constructor",strategy:"throw",reason:"AsyncFunction constructor allows arbitrary async code execution"})}catch{}try{let e=Object.getPrototypeOf(function*(){}).constructor;e&&e!==Function&&a.push({prop:"constructor",target:Object.getPrototypeOf(function*(){}),violationType:"generator_function_constructor",strategy:"throw",reason:"GeneratorFunction constructor allows arbitrary generator code execution"})}catch{}try{let e=Object.getPrototypeOf(async function*(){}).constructor;e&&e!==Function&&e!==Object.getPrototypeOf(async()=>{}).constructor&&a.push({prop:"constructor",target:Object.getPrototypeOf(async function*(){}),violationType:"async_generator_function_constructor",strategy:"throw",reason:"AsyncGeneratorFunction constructor allows arbitrary async generator code execution"})}catch{}return a.filter(e=>{try{return e.target[e.prop]!==void 0}catch{return!1}})}var g=typeof __BROWSER__<"u"&&__BROWSER__;function w(){return typeof crypto<"u"&&crypto.randomUUID?crypto.randomUUID():"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,a=>{let e=Math.random()*16|0;return(a==="x"?e:e&3|8).toString(16)})}var x=null;if(!g)try{let{AsyncLocalStorage:a}=f("node:async_hooks");x=a}catch{}var k=`
|
|
|
|
This is a defense-in-depth measure and indicates a bug in just-bash. Please report this at security@vercel.com`,d=class extends Error{violation;constructor(e,t){super(e+k),this.violation=t,this.name="SecurityViolationError"}},u=!g&&x?new x:null,T=1e3;function D(a,e,...t){return u.run(a,()=>e(...t))}var m={enabled:!0,auditMode:!1};function E(a){return a===void 0?{...m,enabled:!1}:typeof a=="boolean"?{...m,enabled:a}:{...m,...a}}var _=class a{static instance=null;static importHooksRegistered=!1;static trustedExecutionDepth=new Map;config;refCount=0;patchFailures=[];activeExecutionIds=new Set;contextCache=new Map;originalDescriptors=[];violations=[];activationTime=0;totalActiveTimeMs=0;constructor(e){this.config=e}static getInstance(e){let t=E(e);if(!a.instance)a.instance=new a(t);else{let r=a.instance.config;if(t.enabled!==r.enabled||t.auditMode!==r.auditMode)throw new Error(`DefenseInDepthBox config conflict: requested {enabled: ${t.enabled}, auditMode: ${t.auditMode}} but singleton already has {enabled: ${r.enabled}, auditMode: ${r.auditMode}}. All Bash instances must use the same defense-in-depth security settings, or call DefenseInDepthBox.resetInstance() between incompatible configurations.`)}return a.instance}static resetInstance(){a.instance&&(a.instance.forceDeactivate(),a.instance=null),a.trustedExecutionDepth.clear()}static isInSandboxedContext(){return u?u?.getStore()?.sandboxActive===!0:!1}static getCurrentExecutionId(){if(u)return u?.getStore()?.executionId}static enterTrustedScope(e){let t=a.trustedExecutionDepth.get(e)??0;a.trustedExecutionDepth.set(e,t+1)}static leaveTrustedScope(e){let t=a.trustedExecutionDepth.get(e);if(t){if(t===1){a.trustedExecutionDepth.delete(e);return}a.trustedExecutionDepth.set(e,t-1)}}static isTrustedScopeActive(e){return e?(a.trustedExecutionDepth.get(e)??0)>0:!1}isExecutionIdActive(e){return this.activeExecutionIds.has(e)}getCachedContext(e){let t=this.contextCache.get(e);return t||(t={sandboxActive:!0,executionId:e},this.contextCache.set(e,t)),t}getPreferredActiveExecutionId(){if(this.activeExecutionIds.size!==0)for(let e of this.activeExecutionIds)return e}static bindCurrentContext(e){if(!u)return e;let t=a.instance,r=u.getStore(),s=r?.sandboxActive===!0?r.executionId:t?.getPreferredActiveExecutionId();if(!s)return e;let n=t?.getCachedContext(s)??{sandboxActive:!0,executionId:s};return((...o)=>{let i=a.instance;if(!(i&&!i.isExecutionIdActive(s)&&(i.recordViolation("bound_callback_after_deactivate","bound callback","Bound callback blocked after originating execution was deactivated"),!i.config.auditMode)))return D(n,e,...o)})}isEnabled(){return this.config.enabled===!0&&u!==null&&!g}updateConfig(e){this.config={...this.config,...e}}activate(){if(g||!this.config.enabled||!u){let r=w(),s=!1;return{run:n=>s?Promise.reject(new Error("DefenseInDepthBox handle is deactivated and cannot run new work")):n(),deactivate:()=>{s=!0},executionId:r}}this.refCount++,this.refCount===1&&(this.applyPatches(),this.activationTime=Date.now());let e=w(),t=!1;return{run:r=>t?Promise.reject(new Error("DefenseInDepthBox handle is deactivated and cannot run new work")):(this.activeExecutionIds.add(e),u.run({sandboxActive:!0,executionId:e},r)),deactivate:()=>{t||(t=!0,this.activeExecutionIds.delete(e),this.contextCache.delete(e),this.refCount--,this.refCount===0&&(this.restorePatches(),this.totalActiveTimeMs+=Date.now()-this.activationTime),this.refCount<0&&(this.refCount=0))},executionId:e}}forceDeactivate(){this.refCount>0&&(this.restorePatches(),this.totalActiveTimeMs+=Date.now()-this.activationTime),this.activeExecutionIds.clear(),this.contextCache.clear(),this.refCount=0}isActive(){return this.refCount>0}getStats(){return{violationsBlocked:this.violations.length,violations:[...this.violations],activeTimeMs:this.totalActiveTimeMs+(this.refCount>0?Date.now()-this.activationTime:0),refCount:this.refCount}}getPatchFailures(){return[...this.patchFailures]}clearViolations(){this.violations=[]}getPathForTarget(e,t){return e===globalThis?`globalThis.${t}`:e===process?`process.${t}`:e===Error?`Error.${t}`:e===Function.prototype?`Function.prototype.${t}`:e===Object.prototype?`Object.prototype.${t}`:`<object>.${t}`}static runTrusted(e){if(!u)return e();let t=u.getStore();if(!t)return e();let{executionId:r}=t;return u.run({...t,trusted:!0},()=>{a.enterTrustedScope(r);try{let s=e();return typeof s=="object"&&s!==null&&"finally"in s&&typeof s.finally=="function"?s.finally(()=>{a.leaveTrustedScope(r)}):(a.leaveTrustedScope(r),s)}catch(s){throw a.leaveTrustedScope(r),s}})}static async runTrustedAsync(e){if(!u)return e();let t=u.getStore();if(!t)return e();let{executionId:r}=t;return u.run({...t,trusted:!0},async()=>{a.enterTrustedScope(r);try{return await e()}finally{a.leaveTrustedScope(r)}})}shouldBlock(){if(g||this.config.auditMode||!u)return!1;let e=u?.getStore();return!(e?.sandboxActive!==!0||e.trusted||a.isTrustedScopeActive(e.executionId))}recordViolation(e,t,r){let s={timestamp:Date.now(),type:e,message:r,path:t,stack:new Error().stack,executionId:u?.getStore()?.executionId};if(this.violations.length<T&&this.violations.push(s),this.config.onViolation)try{this.config.onViolation(s)}catch(n){console.debug("[DefenseInDepthBox] onViolation callback threw:",n instanceof Error?n.message:n)}return s}createBlockingProxy(e,t,r){let s=this;return new Proxy(e,{apply(n,o,i){if(s.shouldBlock()){let c=`${t} is blocked during script execution`,l=s.recordViolation(r,t,c);throw new d(c,l)}return s.config.auditMode&&u?.getStore()?.sandboxActive===!0&&s.recordViolation(r,t,`${t} called (audit mode)`),Reflect.apply(n,o,i)},construct(n,o,i){if(s.shouldBlock()){let c=`${t} constructor is blocked during script execution`,l=s.recordViolation(r,t,c);throw new d(c,l)}return s.config.auditMode&&u?.getStore()?.sandboxActive===!0&&s.recordViolation(r,t,`${t} constructor called (audit mode)`),Reflect.construct(n,o,i)}})}createBlockingObjectProxy(e,t,r,s){let n=this;return new Proxy(e,{get(o,i,c){if(n.shouldBlock()){if(s&&typeof i=="string"&&s.has(i))return Reflect.get(o,i,c);let l=`${t}.${String(i)}`,p=`${l} is blocked during script execution`,h=n.recordViolation(r,l,p);throw new d(p,h)}if(n.config.auditMode&&u?.getStore()?.sandboxActive===!0){let l=`${t}.${String(i)}`;n.recordViolation(r,l,`${l} accessed (audit mode)`)}return Reflect.get(o,i,c)},set(o,i,c,l){if(n.shouldBlock()){let p=`${t}.${String(i)}`,h=`${p} modification is blocked during script execution`,y=n.recordViolation(r,p,h);throw new d(h,y)}return t==="process.env"&&i==="DEBUG"?Reflect.set(o,i,c):Reflect.set(o,i,c,l)},ownKeys(o){if(n.shouldBlock()){let i=`${t} enumeration is blocked during script execution`,c=n.recordViolation(r,t,i);throw new d(i,c)}return Reflect.ownKeys(o)},getOwnPropertyDescriptor(o,i){if(n.shouldBlock()){let c=`${t}.${String(i)}`,l=`${c} descriptor access is blocked during script execution`,p=n.recordViolation(r,c,l);throw new d(l,p)}return Reflect.getOwnPropertyDescriptor(o,i)},has(o,i){if(n.shouldBlock()){let c=`${t}.${String(i)}`,l=`${c} existence check is blocked during script execution`,p=n.recordViolation(r,c,l);throw new d(l,p)}return Reflect.has(o,i)},deleteProperty(o,i){if(n.shouldBlock()){let c=`${t}.${String(i)}`,l=`${c} deletion is blocked during script execution`,p=n.recordViolation(r,c,l);throw new d(l,p)}return Reflect.deleteProperty(o,i)},setPrototypeOf(o,i){if(n.shouldBlock()){let c=`${t} setPrototypeOf is blocked during script execution`,l=n.recordViolation(r,t,c);throw new d(c,l)}return Reflect.setPrototypeOf(o,i)},defineProperty(o,i,c){if(n.shouldBlock()){let l=`${t}.${String(i)}`,p=`${l} defineProperty is blocked during script execution`,h=n.recordViolation(r,l,p);throw new d(p,h)}return Reflect.defineProperty(o,i,c)}})}applyPatches(){this.patchFailures=[];let e=v(),t=new Set(["process_send","process_channel","process_stdout","process_stderr"]);for(let n of e)t.has(n.violationType)||this.applyPatch(n);this.protectConstructorChain(),this.protectErrorPrepareStackTrace(),this.protectPromiseThen(),this.protectDynamicImport(),this.protectModuleLoad(),this.protectModuleResolveFilename(),this.protectProcessMainModule(),this.protectProcessExecPath(),this.lockWellKnownSymbols(),this.protectProxyRevocable();let r=["Function.prototype.constructor","Module._load"],s=this.patchFailures.filter(n=>r.includes(n));if(s.length>0)throw this.restorePatches(),new Error(`DefenseInDepthBox: critical patches failed: ${s.join(", ")}`)}protectConstructorChain(){this.patchPrototypeConstructor(Function.prototype,"Function.prototype.constructor","function_constructor");try{let e=Object.getPrototypeOf(async()=>{}).constructor;e&&e!==Function&&this.patchPrototypeConstructor(e.prototype,"AsyncFunction.prototype.constructor","async_function_constructor")}catch(e){this.patchFailures.push("AsyncFunction.prototype.constructor"),console.debug("[DefenseInDepthBox] Could not patch AsyncFunction.prototype.constructor:",e instanceof Error?e.message:e)}try{let e=Object.getPrototypeOf(function*(){}).constructor;e&&e!==Function&&this.patchPrototypeConstructor(e.prototype,"GeneratorFunction.prototype.constructor","generator_function_constructor")}catch(e){this.patchFailures.push("GeneratorFunction.prototype.constructor"),console.debug("[DefenseInDepthBox] Could not patch GeneratorFunction.prototype.constructor:",e instanceof Error?e.message:e)}try{let e=Object.getPrototypeOf(async function*(){}).constructor,t=Object.getPrototypeOf(async()=>{}).constructor;e&&e!==Function&&e!==t&&this.patchPrototypeConstructor(e.prototype,"AsyncGeneratorFunction.prototype.constructor","async_generator_function_constructor")}catch(e){this.patchFailures.push("AsyncGeneratorFunction.prototype.constructor"),console.debug("[DefenseInDepthBox] Could not patch AsyncGeneratorFunction.prototype.constructor:",e instanceof Error?e.message:e)}}protectErrorPrepareStackTrace(){let e=this;try{let t=Object.getOwnPropertyDescriptor(Error,"prepareStackTrace");this.originalDescriptors.push({target:Error,prop:"prepareStackTrace",descriptor:t});let r=t?.value;Object.defineProperty(Error,"prepareStackTrace",{get(){return r},set(s){if(e.shouldBlock()){let n="Error.prepareStackTrace modification is blocked during script execution",o=e.recordViolation("error_prepare_stack_trace","Error.prepareStackTrace",n);throw new d(n,o)}e.config.auditMode&&u?.getStore()?.sandboxActive===!0&&e.recordViolation("error_prepare_stack_trace","Error.prepareStackTrace","Error.prepareStackTrace set (audit mode)"),r=s},configurable:!0})}catch(t){this.patchFailures.push("Error.prepareStackTrace"),console.debug("[DefenseInDepthBox] Could not protect Error.prepareStackTrace:",t instanceof Error?t.message:t)}}protectPromiseThen(){let e=this;try{let n=function(...o){return u.run(this.captured,()=>{if(!this.box.isExecutionIdActive(this.executionId)){if(this.box.recordViolation("promise_then_after_deactivate","Promise.then","Promise.then callback is blocked after defense deactivation"),this.box.config.auditMode)return Reflect.apply(this.cb,void 0,o);if(this.kind==="fulfilled")return o[0];throw o[0]}return Reflect.apply(this.cb,void 0,o)})};var t=n;let r=Object.getOwnPropertyDescriptor(Promise.prototype,"then");this.originalDescriptors.push({target:Promise.prototype,prop:"then",descriptor:r});let s=r?.value;if(typeof s!="function")return;Object.defineProperty(Promise.prototype,"then",{value:function(i,c){if(!u)return Reflect.apply(s,this,[i,c]);let l=u.getStore(),p=l?.sandboxActive===!0&&l.trusted!==!0?l.executionId:void 0;if(!p)return Reflect.apply(s,this,[i,c]);let h=e.getCachedContext(p),y=(b,P)=>typeof b!="function"?b:n.bind({box:e,executionId:p,captured:h,cb:b,kind:P});return Reflect.apply(s,this,[y(i,"fulfilled"),y(c,"rejected")])},writable:!0,configurable:!0})}catch(r){this.patchFailures.push("Promise.prototype.then"),console.debug("[DefenseInDepthBox] Could not protect Promise.prototype.then:",r instanceof Error?r.message:r)}}patchPrototypeConstructor(e,t,r){let s=this;try{let n=Object.getOwnPropertyDescriptor(e,"constructor");this.originalDescriptors.push({target:e,prop:"constructor",descriptor:n});let o=n?.value;Object.defineProperty(e,"constructor",{get(){if(s.shouldBlock()){let i=`${t} access is blocked during script execution`,c=s.recordViolation(r,t,i);throw new d(i,c)}return s.config.auditMode&&u?.getStore()?.sandboxActive===!0&&s.recordViolation(r,t,`${t} accessed (audit mode)`),o},set(i){if(s.shouldBlock()){let c=`${t} modification is blocked during script execution`,l=s.recordViolation(r,t,c);throw new d(c,l)}Object.defineProperty(this,"constructor",{value:i,writable:!0,configurable:!0})},configurable:!0})}catch(n){this.patchFailures.push(t),console.debug(`[DefenseInDepthBox] Could not patch ${t}:`,n instanceof Error?n.message:n)}}protectProcessMainModule(){if(typeof process>"u")return;let e=this;try{let t=Object.getOwnPropertyDescriptor(process,"mainModule");this.originalDescriptors.push({target:process,prop:"mainModule",descriptor:t});let r=t?.value;r!==void 0&&Object.defineProperty(process,"mainModule",{get(){if(e.shouldBlock()){let s="process.mainModule access is blocked during script execution",n=e.recordViolation("process_main_module","process.mainModule",s);throw new d(s,n)}return e.config.auditMode&&u?.getStore()?.sandboxActive===!0&&e.recordViolation("process_main_module","process.mainModule","process.mainModule accessed (audit mode)"),r},set(s){if(e.shouldBlock()){let n="process.mainModule modification is blocked during script execution",o=e.recordViolation("process_main_module","process.mainModule",n);throw new d(n,o)}Object.defineProperty(process,"mainModule",{value:s,writable:!0,configurable:!0})},configurable:!0})}catch(t){this.patchFailures.push("process.mainModule"),console.debug("[DefenseInDepthBox] Could not protect process.mainModule:",t instanceof Error?t.message:t)}}protectProcessExecPath(){if(typeof process>"u")return;let e=this;try{let t=Object.getOwnPropertyDescriptor(process,"execPath");this.originalDescriptors.push({target:process,prop:"execPath",descriptor:t});let r=t?.value??process.execPath;Object.defineProperty(process,"execPath",{get(){if(e.shouldBlock()){let s="process.execPath access is blocked during script execution",n=e.recordViolation("process_exec_path","process.execPath",s);throw new d(s,n)}return e.config.auditMode&&u?.getStore()?.sandboxActive===!0&&e.recordViolation("process_exec_path","process.execPath","process.execPath accessed (audit mode)"),r},set(s){if(e.shouldBlock()){let n="process.execPath modification is blocked during script execution",o=e.recordViolation("process_exec_path","process.execPath",n);throw new d(n,o)}Object.defineProperty(process,"execPath",{value:s,writable:!0,configurable:!0})},configurable:!0})}catch(t){this.patchFailures.push("process.execPath"),console.debug("[DefenseInDepthBox] Could not protect process.execPath:",t instanceof Error?t.message:t)}}lockWellKnownSymbols(){let e=(t,r)=>{try{let s=Object.getOwnPropertyDescriptor(t,r);if(s?.configurable){if("value"in s){Object.defineProperty(t,r,{...s,configurable:!1,writable:!1});return}Object.defineProperty(t,r,{...s,configurable:!1})}}catch{}};for(let t of[Array,Map,Set,RegExp,Promise])e(t,Symbol.species);for(let t of[Array.prototype,String.prototype,Map.prototype,Set.prototype])e(t,Symbol.iterator);e(Symbol.prototype,Symbol.toPrimitive),e(Date.prototype,Symbol.toPrimitive);for(let t of[Symbol.match,Symbol.matchAll,Symbol.replace,Symbol.search,Symbol.split])e(RegExp.prototype,t);e(Function.prototype,Symbol.hasInstance),e(Array.prototype,Symbol.unscopables);for(let t of[Map.prototype,Set.prototype,Promise.prototype,ArrayBuffer.prototype])e(t,Symbol.toStringTag);try{let t=Object.getOwnPropertyDescriptor(Error,"stackTraceLimit");this.originalDescriptors.push({target:Error,prop:"stackTraceLimit",descriptor:t}),Object.defineProperty(Error,"stackTraceLimit",{value:Error.stackTraceLimit,writable:!1,configurable:!0})}catch{}}protectProxyRevocable(){let e=this;try{let t=Proxy.revocable;if(typeof t!="function")return;let r=Object.getOwnPropertyDescriptor(Proxy,"revocable");this.originalDescriptors.push({target:Proxy,prop:"revocable",descriptor:r}),Object.defineProperty(Proxy,"revocable",{value:function(n,o){if(e.shouldBlock()){let i="Proxy.revocable is blocked during script execution",c=e.recordViolation("proxy","Proxy.revocable",i);throw new d(i,c)}return e.config.auditMode&&u?.getStore()?.sandboxActive===!0&&e.recordViolation("proxy","Proxy.revocable","Proxy.revocable called (audit mode)"),t(n,o)},writable:!1,configurable:!0})}catch(t){this.patchFailures.push("Proxy.revocable"),console.debug("[DefenseInDepthBox] Could not protect Proxy.revocable:",t instanceof Error?t.message:t)}}protectDynamicImport(){if(!(g||a.importHooksRegistered))try{let e=this,t=f("node:module"),r=new Set;for(let o of t.builtinModules??[]){let i=o.startsWith("node:")?o.slice(5):o;r.add(i);let c=i.indexOf("/");c>0&&r.add(i.slice(0,c))}let s=o=>{if(o.startsWith("./")||o.startsWith("../")||o.startsWith("/")||o.startsWith("file:")||o.startsWith("data:")||o.startsWith("blob:")||o.startsWith("http:")||o.startsWith("https:"))return!1;let i=o.startsWith("node:")?o.slice(5):o;if(!i)return!1;if(typeof t.isBuiltin=="function"&&t.isBuiltin(i)||r.has(i))return!0;let c=i.indexOf("/");return c>0&&r.has(i.slice(0,c))},n=()=>{let o=u?.getStore();return e.config.auditMode===!0&&o?.sandboxActive===!0&&o.trusted!==!0&&!a.isTrustedScopeActive(o.executionId)};if(typeof t.registerHooks=="function"){t.registerHooks({resolve(o,i,c){if(o.startsWith("data:")||o.startsWith("blob:"))throw new Error(`dynamic import of ${o.startsWith("data:")?"data:":"blob:"} URLs is blocked by defense-in-depth`);if(s(o)){let l=`import(${o})`,p=`dynamic import of Node.js builtin '${o}' is blocked during script execution`;if(e.shouldBlock()){let h=e.recordViolation("dynamic_import_builtin",l,p);throw new d(p,h)}n()&&e.recordViolation("dynamic_import_builtin",l,`dynamic import of Node.js builtin '${o}' called (audit mode)`)}return c(o,i)}}),a.importHooksRegistered=!0;return}if(typeof t.register=="function"){let o=["export async function resolve(specifier, context, nextResolve) {",' if (specifier.startsWith("data:") || specifier.startsWith("blob:")) {',' throw new Error("dynamic import of " + (specifier.startsWith("data:") ? "data:" : "blob:") + " URLs is blocked by defense-in-depth");'," }"," return nextResolve(specifier, context);","}"].join(`
|
|
`);t.register(`data:text/javascript,${encodeURIComponent(o)}`),a.importHooksRegistered=!0}}catch(e){console.debug("[DefenseInDepthBox] Could not register import() hooks:",e instanceof Error?e.message:e)}}protectModuleLoad(){if(!g)try{let e=null;if(typeof process<"u"){let o=process.mainModule;o&&typeof o=="object"&&(e=o.constructor)}if(!e&&typeof f<"u"&&typeof f.main<"u"&&(e=f.main.constructor),!e||typeof e._load!="function")return;let t=e._load,r=Object.getOwnPropertyDescriptor(e,"_load");this.originalDescriptors.push({target:e,prop:"_load",descriptor:r});let n=this.createBlockingProxy(t,"Module._load","module_load");Object.defineProperty(e,"_load",{value:n,writable:!0,configurable:!0})}catch(e){this.patchFailures.push("Module._load"),console.debug("[DefenseInDepthBox] Could not protect Module._load:",e instanceof Error?e.message:e)}}protectModuleResolveFilename(){if(!g)try{let e=null;if(typeof process<"u"){let o=process.mainModule;o&&typeof o=="object"&&(e=o.constructor)}if(!e&&typeof f<"u"&&typeof f.main<"u"&&(e=f.main.constructor),!e||typeof e._resolveFilename!="function")return;let t=e._resolveFilename,r=Object.getOwnPropertyDescriptor(e,"_resolveFilename");this.originalDescriptors.push({target:e,prop:"_resolveFilename",descriptor:r});let n=this.createBlockingProxy(t,"Module._resolveFilename","module_resolve_filename");Object.defineProperty(e,"_resolveFilename",{value:n,writable:!0,configurable:!0})}catch(e){this.patchFailures.push("Module._resolveFilename"),console.debug("[DefenseInDepthBox] Could not protect Module._resolveFilename:",e instanceof Error?e.message:e)}}applyPatch(e){let{target:t,prop:r,violationType:s,strategy:n}=e;try{let o=t[r];if(o===void 0)return;let i=Object.getOwnPropertyDescriptor(t,r);if(this.originalDescriptors.push({target:t,prop:r,descriptor:i}),n==="freeze")typeof o=="object"&&o!==null&&Object.freeze(o);else{let c=this.getPathForTarget(t,r),l=typeof o=="function"?this.createBlockingProxy(o,c,s):this.createBlockingObjectProxy(o,c,s,e.allowedKeys);Object.defineProperty(t,r,{value:l,writable:!0,configurable:!0})}}catch(o){let i=this.getPathForTarget(t,r);this.patchFailures.push(i),console.debug(`[DefenseInDepthBox] Could not patch ${i}:`,o instanceof Error?o.message:o)}}restorePatches(){for(let e=this.originalDescriptors.length-1;e>=0;e--){let{target:t,prop:r,descriptor:s}=this.originalDescriptors[e];try{s?Object.defineProperty(t,r,s):delete t[r]}catch(n){let o=this.getPathForTarget(t,r);console.debug(`[DefenseInDepthBox] Could not restore ${o}:`,n instanceof Error?n.message:n)}}this.originalDescriptors=[]}};export{d as a,_ as b};
|