Horizontal42/summarum
1
0
Fork 0
mirror of https://github.com/Horizontal42/summarum.git synced 2026-11-10 23:51:59 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix CSP vulnerability by replacing quickjs singlefile with wasmfile async variant

Browse source 
Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>
This commit is contained in:
google-labs-jules[bot] 2026-08-12 17:51:09 +00:00
parent 268ac9e81b
commit 72a4fd93cd
4 changed files with 14 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
package-lock.json generated
View file

@ -13,7 +13,7 @@
"@codemirror/language": "^6.10.0",
"@codemirror/state": "^6.5.0",
"@codemirror/view": "^6.36.0",
"@jitl/quickjs-singlefile-browser-release-sync": "^0.32.0",
"@jitl/quickjs-wasmfile-release-asyncify": "^0.32.0",
"@lezer/highlight": "^1.2.0",
"@tauri-apps/api": "^2.5.0",
"@tauri-apps/plugin-autostart": "^2.3.0",
@ -540,10 +540,10 @@
"integrity": "sha512-v9T+GQpmk43VDJ7d72sf0Nexhk+ArvtUihW27dy7lqAl0zBObFKtSBBIm5RBjwIhE8VwsPPm9PNuvPvNqLWUEg==",
"license": "MIT"
},
"node_modules/@jitl/quickjs-singlefile-browser-release-sync": {
"node_modules/@jitl/quickjs-wasmfile-release-asyncify": {
"version": "0.32.0",
"resolved": "https://registry.npmjs.org/@jitl/quickjs-singlefile-browser-release-sync/-/quickjs-singlefile-browser-release-sync-0.32.0.tgz",
"integrity": "sha512-Hfdl7rh8dzxNWFRiYAYNbhn0RMF1/tO6SMH2mUW0aTibqwaAtqPRbi4WkwaIDlhNz8Z4dksJi1Zjl1R54Jsc/Q==",
"resolved": "https://registry.npmjs.org/@jitl/quickjs-wasmfile-release-asyncify/-/quickjs-wasmfile-release-asyncify-0.32.0.tgz",
"integrity": "sha512-3oSwPfja12ICz4aIblB58cuY8JlEq5Txt8Cut4VLo+LH47QN+mzCnSgnbB03hWzg1LBcc+VyyI9UOag7a1NF+Q==",
"license": "MIT",
"dependencies": {
"@jitl/quickjs-ffi-types": "0.32.0"

2
package.json
View file

@ -19,7 +19,7 @@
"@codemirror/language": "^6.10.0",
"@codemirror/state": "^6.5.0",
"@codemirror/view": "^6.36.0",
"@jitl/quickjs-singlefile-browser-release-sync": "^0.32.0",
"@jitl/quickjs-wasmfile-release-asyncify": "^0.32.0",
"@lezer/highlight": "^1.2.0",
"@tauri-apps/api": "^2.5.0",
"@tauri-apps/plugin-autostart": "^2.3.0",

2
src-tauri/tauri.conf.json
View file

@ -23,7 +23,7 @@
}
],
"security": {
"csp": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src ipc: http://ipc.localhost https://open.er-api.com https://api.coingecko.com https://query1.finance.yahoo.com https://query2.finance.yahoo.com https://api.frankfurter.dev"
"csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src ipc: http://ipc.localhost https://open.er-api.com https://api.coingecko.com https://query1.finance.yahoo.com https://query2.finance.yahoo.com https://api.frankfurter.dev"
}
},
"bundle": {

16
src/extensions.ts
View file

@ -1,11 +1,11 @@
// JS extensions runtime: numi.setVariable, numi.addUnit, numi.addFunction.
// Scripts run inside a QuickJS WASM sandbox — no DOM, no Tauri IPC, no host globals.
import {
newQuickJSWASMModuleFromVariant,
QuickJSContext,
newQuickJSAsyncWASMModuleFromVariant,
QuickJSAsyncContext,
QuickJSHandle,
} from "quickjs-emscripten-core";
import releaseSyncVariant from "@jitl/quickjs-singlefile-browser-release-sync";
import releaseAsyncVariant from "@jitl/quickjs-wasmfile-release-asyncify";
import { SumEngine, ExtensionUnitSpec, ExtensionValue } from "./engine";
interface ExtensionApi {
@ -82,7 +82,7 @@ export async function runExtensions(
type RunWithTimeout = <T>(timeoutMs: number, fn: () => T) => T;
function callGuest(
vm: QuickJSContext,
vm: QuickJSAsyncContext,
id: string,
fn: QuickJSHandle,
values: ExtensionValue[],
@ -121,7 +121,7 @@ function callGuest(
}
function exposeApi(
vm: QuickJSContext,
vm: QuickJSAsyncContext,
api: ExtensionApi,
runWithTimeout: RunWithTimeout,
) {
@ -184,7 +184,7 @@ function exposeApi(
}
function evaluateScripts(
vm: QuickJSContext,
vm: QuickJSAsyncContext,
scripts: { name: string; code: string }[],
runWithTimeout: RunWithTimeout,
) {
@ -209,8 +209,8 @@ async function load(
engine: SumEngine,
scripts: { name: string; code: string }[],
): Promise<void> {
const mod = await newQuickJSWASMModuleFromVariant(releaseSyncVariant);
const vm: QuickJSContext = mod.newContext();
const mod = await newQuickJSAsyncWASMModuleFromVariant(releaseAsyncVariant);
const vm: QuickJSAsyncContext = mod.newContext();
vm.runtime.setMemoryLimit(MEMORY_LIMIT);
vm.runtime.setMaxStackSize(STACK_SIZE);