[Init] Initial commit - NetMesh terminal manager

electron/plugins/networkBroker.cjs

@@ -0,0 +1,334 @@
+"use strict";
+
+const { PluginRpcError, RPC_ERRORS } = require("./rpcRouter.cjs");
+const { PLUGIN_RPC_MAX_RAW_BYTES } = require("./constants.cjs");
+const { canonicalizeNetworkOrigin } = require("./permissionResources.cjs");
+
+const MAX_NETWORK_BODY_BYTES = PLUGIN_RPC_MAX_RAW_BYTES;
+const MAX_NETWORK_HEADERS = 64;
+const MAX_NETWORK_HEADER_BYTES = 64 * 1024;
+const MAX_NETWORK_REDIRECTS = 5;
+const FORBIDDEN_REQUEST_HEADERS = new Set([
+  "connection",
+  "content-length",
+  "cookie",
+  "host",
+  "proxy-authorization",
+  "transfer-encoding",
+]);
+const SENSITIVE_REDIRECT_HEADERS = new Set(["authorization", "cookie", "proxy-authorization"]);
+const ENTITY_REDIRECT_HEADERS = new Set(["content-encoding", "content-language", "content-type"]);
+
+function invalidArgument(message) {
+  return new PluginRpcError(RPC_ERRORS.invalidArgument, message);
+}
+
+async function cancelResponseBody(response, reason) {
+  try { await response.body?.cancel?.(reason); }
+  catch {}
+}
+
+function decodeBody(body) {
+  if (body === undefined) return undefined;
+  if (!body || typeof body !== "object" || Array.isArray(body) || typeof body.data !== "string") {
+    throw invalidArgument("Plugin network request body is invalid");
+  }
+  let bytes;
+  if (body.encoding === "utf8") bytes = Buffer.from(body.data, "utf8");
+  else if (body.encoding === "base64") {
+    bytes = Buffer.from(body.data, "base64");
+    if (bytes.toString("base64") !== body.data) throw invalidArgument("Plugin network base64 body is not canonical");
+  } else throw invalidArgument("Plugin network request body encoding is unsupported");
+  if (bytes.byteLength > MAX_NETWORK_BODY_BYTES) {
+    throw new PluginRpcError(RPC_ERRORS.resourceExhausted, "Plugin network request body is too large");
+  }
+  return bytes;
+}
+
+function normalizeHeaders(value) {
+  if (value === undefined) return {};
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw invalidArgument("Plugin network headers are invalid");
+  }
+  const entries = Object.entries(value);
+  if (entries.length > MAX_NETWORK_HEADERS) throw invalidArgument("Plugin network request has too many headers");
+  const headers = {};
+  let headerBytes = 0;
+  for (const [rawName, rawValue] of entries) {
+    const name = rawName.toLowerCase();
+    if (!/^[!#$%&'*+.^_`|~0-9a-z-]+$/u.test(name) || FORBIDDEN_REQUEST_HEADERS.has(name)) {
+      throw invalidArgument(`Plugin network request header is forbidden: ${rawName}`);
+    }
+    if (
+      typeof rawValue !== "string"
+      || rawValue.length > 8_192
+      || /[\u0000-\u0008\u000a-\u001f\u007f]/u.test(rawValue)
+    ) {
+      throw invalidArgument(`Plugin network request header value is invalid: ${rawName}`);
+    }
+    headerBytes += Buffer.byteLength(name) + Buffer.byteLength(rawValue);
+    if (headerBytes > MAX_NETWORK_HEADER_BYTES) {
+      throw new PluginRpcError(RPC_ERRORS.resourceExhausted, "Plugin network request headers are too large");
+    }
+    headers[name] = rawValue;
+  }
+  return headers;
+}
+
+function assertNetworkRequest(params) {
+  if (!params || typeof params !== "object" || Array.isArray(params)) {
+    throw invalidArgument("Plugin network request is invalid");
+  }
+  if (typeof params.url !== "string" || params.url.length > 8_192) {
+    throw invalidArgument("Plugin network URL is invalid");
+  }
+  let url;
+  try { url = new URL(params.url); }
+  catch { throw invalidArgument("Plugin network URL is invalid"); }
+  const origin = canonicalizeNetworkOrigin(url.origin);
+  if (url.username || url.password) throw invalidArgument("Plugin network URL cannot contain credentials");
+  const method = params.method ?? "GET";
+  if (!["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"].includes(method)) {
+    throw invalidArgument("Plugin network method is unsupported");
+  }
+  const timeoutMs = params.timeoutMs ?? 30_000;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 300_000) {
+    throw invalidArgument("Plugin network timeout is invalid");
+  }
+  const body = decodeBody(params.body);
+  if (body && (method === "GET" || method === "HEAD")) {
+    throw invalidArgument(`Plugin network ${method} requests cannot contain a body`);
+  }
+  return {
+    url,
+    origin,
+    method,
+    headers: normalizeHeaders(params.headers),
+    body,
+    timeoutMs,
+  };
+}
+
+async function readBoundedResponse(response, maxBytes, signal) {
+  const declaredLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+    await cancelResponseBody(response);
+    throw new PluginRpcError(RPC_ERRORS.resourceExhausted, "Plugin network response is too large");
+  }
+  if (!response.body) return Buffer.alloc(0);
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      signal?.throwIfAborted();
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel();
+        throw new PluginRpcError(RPC_ERRORS.resourceExhausted, "Plugin network response is too large");
+      }
+      chunks.push(Buffer.from(value));
+    }
+  } catch (error) {
+    try { await reader.cancel(error); } catch {}
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, total);
+}
+
+function normalizeResponseHeaders(headers) {
+  const responseHeaders = {};
+  let responseHeaderBytes = 0;
+  let responseHeaderCount = 0;
+  for (const [name, value] of headers) {
+    if (name.toLowerCase() === "set-cookie") continue;
+    responseHeaderCount += 1;
+    responseHeaderBytes += Buffer.byteLength(name) + Buffer.byteLength(value);
+    if (responseHeaderCount > MAX_NETWORK_HEADERS || responseHeaderBytes > MAX_NETWORK_HEADER_BYTES) {
+      throw new PluginRpcError(RPC_ERRORS.resourceExhausted, "Plugin network response headers are too large");
+    }
+    responseHeaders[name.toLowerCase()] = value;
+  }
+  return responseHeaders;
+}
+
+class PluginNetworkBroker {
+  constructor(options) {
+    this.fetch = options.fetch ?? globalThis.fetch;
+    this.permissionEngine = options.permissionEngine;
+    this.quotaManager = options.quotaManager ?? null;
+    if (typeof this.fetch !== "function") throw new TypeError("Plugin network fetch implementation is required");
+  }
+
+  validate(params) {
+    const request = assertNetworkRequest(params);
+    const validated = {
+      url: request.url.href,
+      method: request.method,
+      headers: request.headers,
+      ...(request.body === undefined ? {} : {
+        body: { encoding: "base64", data: request.body.toString("base64") },
+      }),
+      timeoutMs: request.timeoutMs,
+    };
+    // Preserve host-consumed credential fields. assertNetworkRequest ignores
+    // unknown keys; without this, registry validateParams would strip them and
+    // network.request lease injection would become dead code.
+    if (params?.credentialLease !== undefined) {
+      const lease = params.credentialLease;
+      if (
+        !lease
+        || typeof lease !== "object"
+        || Array.isArray(lease)
+        || lease.kind !== "secret-lease"
+        || typeof lease.id !== "string"
+        || typeof lease.operationId !== "string"
+        || !Number.isFinite(lease.expiresAt)
+      ) {
+        throw invalidArgument("Plugin network credential lease is invalid");
+      }
+      validated.credentialLease = Object.freeze({
+        kind: "secret-lease",
+        id: lease.id,
+        operationId: lease.operationId,
+        expiresAt: lease.expiresAt,
+      });
+    }
+    if (params?.authorization !== undefined) {
+      const authorization = params.authorization;
+      if (!authorization || typeof authorization !== "object" || Array.isArray(authorization)) {
+        throw invalidArgument("Plugin network authorization is invalid");
+      }
+      const scheme = authorization.scheme === "Basic" ? "Basic" : "Bearer";
+      validated.authorization = Object.freeze({
+        scheme,
+        ...(typeof authorization.username === "string"
+          ? { username: authorization.username }
+          : {}),
+      });
+    }
+    return validated;
+  }
+
+  describeAuthorization(params) {
+    const request = assertNetworkRequest(params);
+    return {
+      permission: "network",
+      resources: [request.origin],
+      reason: `Connect to ${request.origin}`,
+      operationId: `network:${request.origin}`,
+    };
+  }
+
+  async request(params, context) {
+    const request = assertNetworkRequest(params);
+    const timeout = AbortSignal.timeout(request.timeoutMs);
+    const signal = context.signal ? AbortSignal.any([context.signal, timeout]) : timeout;
+    let currentUrl = request.url;
+    let currentOrigin = request.origin;
+    let currentMethod = request.method;
+    let currentBody = request.body;
+    let headers = { ...request.headers };
+    try {
+      for (let redirects = 0; redirects <= MAX_NETWORK_REDIRECTS; redirects += 1) {
+        await context.assertActive();
+        if (currentBody) {
+          this.quotaManager?.chargeBytes(context.runtimeId, "network", currentBody.byteLength);
+        }
+        const response = await this.fetch(currentUrl, {
+          method: currentMethod,
+          headers,
+          ...(currentBody === undefined ? {} : { body: currentBody }),
+          credentials: "omit",
+          redirect: "manual",
+          signal,
+        });
+        const effectiveUrl = response.url ? new URL(response.url) : currentUrl;
+        if (
+          effectiveUrl.username
+          || effectiveUrl.password
+          || canonicalizeNetworkOrigin(effectiveUrl.origin) !== currentOrigin
+        ) {
+          await cancelResponseBody(response);
+          throw new PluginRpcError(
+            RPC_ERRORS.permissionDenied,
+            "Plugin network transport followed an unauthorized redirect",
+          );
+        }
+        let responseHeaders;
+        try {
+          responseHeaders = normalizeResponseHeaders(response.headers);
+        } catch (error) {
+          await cancelResponseBody(response, error);
+          throw error;
+        }
+        if (response.status >= 300 && response.status < 400 && response.headers.get("location")) {
+          await cancelResponseBody(response);
+          if (redirects === MAX_NETWORK_REDIRECTS) {
+            throw new PluginRpcError(RPC_ERRORS.outOfRange, "Plugin network redirect limit exceeded");
+          }
+          const nextUrl = new URL(response.headers.get("location"), currentUrl);
+          if (nextUrl.username || nextUrl.password) {
+            throw invalidArgument("Plugin network redirect URL cannot contain credentials");
+          }
+          const nextOrigin = canonicalizeNetworkOrigin(nextUrl.origin);
+          await this.permissionEngine.authorize(context, {
+            permission: "network",
+            resources: [nextOrigin],
+            reason: `Follow network redirect to ${nextOrigin}`,
+            operationId: `network:${nextOrigin}`,
+          });
+          if (nextOrigin !== currentOrigin) {
+            headers = Object.fromEntries(Object.entries(headers).filter(([name]) => (
+              !SENSITIVE_REDIRECT_HEADERS.has(name)
+            )));
+          }
+          if (response.status === 303 || ((response.status === 301 || response.status === 302) && currentMethod === "POST")) {
+            currentMethod = currentMethod === "HEAD" ? "HEAD" : "GET";
+            currentBody = undefined;
+            headers = Object.fromEntries(Object.entries(headers).filter(([name]) => (
+              !ENTITY_REDIRECT_HEADERS.has(name)
+            )));
+          }
+          currentUrl = nextUrl;
+          currentOrigin = nextOrigin;
+          continue;
+        }
+        const bytes = await readBoundedResponse(response, MAX_NETWORK_BODY_BYTES, signal);
+        this.quotaManager?.chargeBytes(context.runtimeId, "network", bytes.byteLength);
+        await context.assertActive();
+        return {
+          url: effectiveUrl.href,
+          status: response.status,
+          headers: responseHeaders,
+          body: { encoding: "base64", data: bytes.toString("base64") },
+        };
+      }
+    } catch (error) {
+      context.signal?.throwIfAborted();
+      if (timeout.aborted) {
+        throw new PluginRpcError(RPC_ERRORS.deadlineExceeded, "Plugin network request timed out");
+      }
+      throw error;
+    }
+    throw new PluginRpcError(RPC_ERRORS.internal, "Plugin network redirect handling failed");
+  }
+}
+
+module.exports = {
+  FORBIDDEN_REQUEST_HEADERS,
+  ENTITY_REDIRECT_HEADERS,
+  MAX_NETWORK_BODY_BYTES,
+  MAX_NETWORK_HEADER_BYTES,
+  MAX_NETWORK_HEADERS,
+  MAX_NETWORK_REDIRECTS,
+  PluginNetworkBroker,
+  assertNetworkRequest,
+  cancelResponseBody,
+  normalizeResponseHeaders,
+  readBoundedResponse,
+};