Node / ReticulumProjects / MeshChatX.git / files / meshchatx / src / backend / plugin_guard.py

Displaying Raw • Download

T8b949e# SPDX-License-Identifier: 0BSD

Tff7b72from T7ee787__future__ Tff7b72import Te6edf3annotations

Tff7b72import T7ee787os

Tff7b72import T7ee787zipfile

Te6edf3MAX_PLUGIN_ZIP_BYTES Tff7b72= T79c0ff20 Tff7b72* T79c0ff1024 Tff7b72* T79c0ff1024

Te6edf3MAX_EXTRACT_BYTES Tff7b72= T79c0ff50 Tff7b72* T79c0ff1024 Tff7b72* T79c0ff1024

Te6edf3MAX_EXTRACT_FILES Tff7b72= T79c0ff256

Te6edf3MAX_WASM_BYTES Tff7b72= T79c0ff10 Tff7b72* T79c0ff1024 Tff7b72* T79c0ff1024

Te6edf3MAX_INVOKE_PAYLOAD_BYTES Tff7b72= T79c0ff65_536

Te6edf3PLUGIN_ERROR_BUDGET Tff7b72= T79c0ff5

Te6edf3PLUGIN_ERROR_WINDOW_SECONDS Tff7b72= T79c0ff300

Tff7b72class T56d364PluginSecurityErrorTb4b4b4(Tf85149ValueErrorTb4b4b4)Tb4b4b4:

T8b949e"""Raised when a plugin archive or asset fails validation."""

Tff7b72def Td2a8ffnormalize_asset_pathTb4b4b4(Te6edf3asset_nameTb4b4b4: Tffa657strTb4b4b4) Tff7b72-Tff7b72> Tffa657strTb4b4b4:

Tff7b72if Tff7b72not Tffa657isinstanceTb4b4b4(Te6edf3asset_nameTb4b4b4, Tffa657strTb4b4b4) Tff7b72or Ta5d6ff"Tffea00\x00Ta5d6ff" Tff7b72in Te6edf3asset_nameTb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffinvalid asset pathTa5d6ff"Tb4b4b4)

Te6edf3normalized Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffnormpathTb4b4b4(Te6edf3asset_nameTb4b4b4)Tff7b72.Td2a8ffreplaceTb4b4b4(Ta5d6ff"Tffea00\\Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4)

Tff7b72if Tff7b72not Te6edf3normalized Tff7b72or Te6edf3normalized Tff7b72in Tb4b4b4{Ta5d6ff"Ta5d6ff.Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff..Ta5d6ff"Tb4b4b4}Tb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffinvalid asset pathTa5d6ff"Tb4b4b4)

Tff7b72if Te6edf3normalizedTff7b72.Td2a8ffstartswithTb4b4b4(Ta5d6ff"Ta5d6ff../Ta5d6ff"Tb4b4b4) Tff7b72or Te6edf3normalizedTff7b72.Td2a8ffstartswithTb4b4b4(Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4)Tb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffinvalid asset pathTa5d6ff"Tb4b4b4)

Tff7b72if Ta5d6ff"Ta5d6ff/../Ta5d6ff" Tff7b72in Ta5d6fffTa5d6ff"Ta5d6ff/Tffd700{Te6edf3normalizedTffd700}Ta5d6ff/Ta5d6ff"Tb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffinvalid asset pathTa5d6ff"Tb4b4b4)

T8b949e# Reject Windows drive-absolute forms (C:/...) that can escape on win32 joins.

Tff7b72if Ta5d6ff"Ta5d6ff:Ta5d6ff" Tff7b72in Te6edf3normalizedTb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffinvalid asset pathTa5d6ff"Tb4b4b4)

Tff7b72return Te6edf3normalized

Tff7b72def Td2a8ffvalidate_wasm_fileTb4b4b4(Te6edf3pathTb4b4b4: Tffa657strTb4b4b4) Tff7b72-Tff7b72> Tff7b72NoneTb4b4b4:

Tff7b72if Tff7b72not Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffisfileTb4b4b4(Te6edf3pathTb4b4b4)Tb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffbackend wasm entry not foundTa5d6ff"Tb4b4b4)

Te6edf3size Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffgetsizeTb4b4b4(Te6edf3pathTb4b4b4)

Tff7b72if Te6edf3size Tff7b72<Tff7b72= T79c0ff0Tb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffbackend wasm entry is emptyTa5d6ff"Tb4b4b4)

Tff7b72if Te6edf3size Tff7b72> Te6edf3MAX_WASM_BYTESTb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffbackend wasm entry is too largeTa5d6ff"Tb4b4b4)

Tff7b72def Td2a8ffvalidate_invoke_payloadTb4b4b4(Te6edf3payloadTb4b4b4: Tffa657bytesTb4b4b4) Tff7b72-Tff7b72> Tff7b72NoneTb4b4b4:

Tff7b72if Tffa657lenTb4b4b4(Te6edf3payloadTb4b4b4) Tff7b72> Te6edf3MAX_INVOKE_PAYLOAD_BYTESTb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffplugin invoke payload is too largeTa5d6ff"Tb4b4b4)

Tff7b72def Td2a8ff_zip_entry_is_safeTb4b4b4(Te6edf3nameTb4b4b4: Tffa657strTb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:

Tff7b72if Tff7b72not Tffa657isinstanceTb4b4b4(Te6edf3nameTb4b4b4, Tffa657strTb4b4b4) Tff7b72or Ta5d6ff"Tffea00\x00Ta5d6ff" Tff7b72in Te6edf3nameTb4b4b4:

Tff7b72return Tff7b72False

Te6edf3normalized Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffnormpathTb4b4b4(Te6edf3nameTb4b4b4)Tff7b72.Td2a8ffreplaceTb4b4b4(Ta5d6ff"Tffea00\\Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4)

Tff7b72if Te6edf3normalizedTff7b72.Td2a8ffstartswithTb4b4b4(Ta5d6ff"Ta5d6ff../Ta5d6ff"Tb4b4b4) Tff7b72or Te6edf3normalizedTff7b72.Td2a8ffstartswithTb4b4b4(Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4)Tb4b4b4:

Tff7b72return Tff7b72False

Tff7b72if Te6edf3normalized Tff7b72in Tb4b4b4{Ta5d6ff"Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff.Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff..Ta5d6ff"Tb4b4b4}Tb4b4b4:

Tff7b72return Tff7b72False

Tff7b72if Ta5d6ff"Ta5d6ff:Ta5d6ff" Tff7b72in Te6edf3normalizedTb4b4b4:

Tff7b72return Tff7b72False

Tff7b72if Ta5d6ff"Ta5d6ff/../Ta5d6ff" Tff7b72in Ta5d6fffTa5d6ff"Ta5d6ff/Tffd700{Te6edf3normalizedTffd700}Ta5d6ff/Ta5d6ff"Tb4b4b4:

Tff7b72return Tff7b72False

Tff7b72return Tff7b72True

Tff7b72def Td2a8ffsafe_extract_zipTb4b4b4(Te6edf3zip_pathTb4b4b4: Tffa657strTb4b4b4, Te6edf3extract_dirTb4b4b4: Tffa657strTb4b4b4) Tff7b72-Tff7b72> Tffa657strTb4b4b4:

Te6edf3total_bytes Tff7b72= T79c0ff0

Te6edf3file_count Tff7b72= T79c0ff0

Tff7b72with Te6edf3zipfileTff7b72.Td2a8ffZipFileTb4b4b4(Te6edf3zip_pathTb4b4b4) Tff7b72as Te6edf3archiveTb4b4b4:

Tff7b72for Te6edf3info Tff7b72in Te6edf3archiveTff7b72.Td2a8ffinfolistTb4b4b4(Tb4b4b4)Tb4b4b4:

Tff7b72if Te6edf3infoTff7b72.Td2a8ffis_dirTb4b4b4(Tb4b4b4)Tb4b4b4:

Tff7b72continue

Tff7b72if Tff7b72not Te6edf3_zip_entry_is_safeTb4b4b4(Te6edf3infoTff7b72.Td2a8fffilenameTb4b4b4)Tb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffplugin archive contains unsafe pathsTa5d6ff"Tb4b4b4)

Te6edf3total_bytes Tff7b72+Tff7b72= Te6edf3infoTff7b72.Td2a8fffile_size

Te6edf3file_count Tff7b72+Tff7b72= T79c0ff1

Tff7b72if Te6edf3file_count Tff7b72> Te6edf3MAX_EXTRACT_FILESTb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffplugin archive contains too many filesTa5d6ff"Tb4b4b4)

Tff7b72if Te6edf3total_bytes Tff7b72> Te6edf3MAX_EXTRACT_BYTESTb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffplugin archive is too large when extractedTa5d6ff"Tb4b4b4)

Te6edf3archiveTff7b72.Td2a8ffextractallTb4b4b4(Te6edf3extract_dirTb4b4b4)

Tff7b72return Te6edf3resolve_plugin_rootTb4b4b4(Te6edf3extract_dirTb4b4b4)

Tff7b72def Td2a8ffresolve_plugin_rootTb4b4b4(Te6edf3extract_dirTb4b4b4: Tffa657strTb4b4b4) Tff7b72-Tff7b72> Tffa657strTb4b4b4:

Te6edf3manifest_path Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffjoinTb4b4b4(Te6edf3extract_dirTb4b4b4, Ta5d6ff"Ta5d6ffplugin.jsonTa5d6ff"Tb4b4b4)

Tff7b72if Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffisfileTb4b4b4(Te6edf3manifest_pathTb4b4b4)Tb4b4b4:

Tff7b72return Te6edf3extract_dir

Te6edf3children Tff7b72= Tb4b4b4[

Te6edf3name

Tff7b72for Te6edf3name Tff7b72in Te6edf3osTff7b72.Td2a8fflistdirTb4b4b4(Te6edf3extract_dirTb4b4b4)

Tff7b72if Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffisdirTb4b4b4(Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffjoinTb4b4b4(Te6edf3extract_dirTb4b4b4, Te6edf3nameTb4b4b4)Tb4b4b4)

Tb4b4b4]

Tff7b72if Tffa657lenTb4b4b4(Te6edf3childrenTb4b4b4) Tff7b72== T79c0ff1Tb4b4b4:

Te6edf3candidate Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffjoinTb4b4b4(Te6edf3extract_dirTb4b4b4, Te6edf3childrenTb4b4b4[T79c0ff0Tb4b4b4]Tb4b4b4)

Tff7b72if Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffisfileTb4b4b4(Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffjoinTb4b4b4(Te6edf3candidateTb4b4b4, Ta5d6ff"Ta5d6ffplugin.jsonTa5d6ff"Tb4b4b4)Tb4b4b4)Tb4b4b4:

Tff7b72return Te6edf3candidate

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffplugin.json not found in archiveTa5d6ff"Tb4b4b4)

Tff7b72def Td2a8ffvalidate_zip_bytesTb4b4b4(Te6edf3payloadTb4b4b4: Tffa657bytesTb4b4b4) Tff7b72-Tff7b72> Tff7b72NoneTb4b4b4:

Tff7b72if Tff7b72not Te6edf3payloadTb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffempty plugin archiveTa5d6ff"Tb4b4b4)

Tff7b72if Tffa657lenTb4b4b4(Te6edf3payloadTb4b4b4) Tff7b72> Te6edf3MAX_PLUGIN_ZIP_BYTESTb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffplugin archive is too largeTa5d6ff"Tb4b4b4)

Tff7b72if Tff7b72not Te6edf3payloadTff7b72.Td2a8ffstartswithTb4b4b4(Ta5d6ffbTa5d6ff"Ta5d6ffPKTa5d6ff"Tb4b4b4)Tb4b4b4:

Tff7b72raise Te6edf3PluginSecurityErrorTb4b4b4(Ta5d6ff"Ta5d6ffplugin archive is not a zip fileTa5d6ff"Tb4b4b4)