|
| 1 | +#!/usr/bin/env bash |
| 2 | +# Reject fixture-specific behavior in production engine sources. |
| 3 | + |
| 4 | +set -euo pipefail |
| 5 | +export LC_ALL=C |
| 6 | + |
| 7 | +script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd) |
| 8 | +root=$(CDPATH='' cd -- "$script_dir/.." && pwd) |
| 9 | +cd "$root" |
| 10 | + |
| 11 | +die() { |
| 12 | + echo "error: $*" >&2 |
| 13 | + exit 1 |
| 14 | +} |
| 15 | + |
| 16 | +command -v rg >/dev/null 2>&1 || die "ripgrep is required" |
| 17 | + |
| 18 | +scan_roots=(src web/wasm/src) |
| 19 | +scan_globs=( |
| 20 | + --glob '*.rs' |
| 21 | + --glob '!**/tests.rs' |
| 22 | + --glob '!src/bin/run_test262.rs' |
| 23 | + --glob '!src/bin/run_test262/**' |
| 24 | +) |
| 25 | + |
| 26 | +path_pattern='\b(?:test/)?(?:built-ins|language|intl402|annexB|staging|harness)/[A-Za-z0-9_./@+-]+\.js\b|[A-Za-z0-9_.@+-]+_FIXTURE\.js\b' |
| 27 | +source_hash_pattern='\b(?:source|source_text|script|program|code)(?:_[a-z0-9_]*(?:hash|digest|sha_?(?:1|256|512))[a-z0-9_]*|\b[^;\n]{0,100}\.[a-z0-9_]*(?:hash|digest|sha_?(?:1|256|512))[a-z0-9_]*)\b|\b[a-z0-9_]*(?:hash|digest|sha_?(?:1|256|512))[a-z0-9_]*\s*\([^;\n]{0,100}\b(?:source|source_text|script|program|code)\b' |
| 28 | +source_literal_pattern='(?i:\b(?:source|source_text|script|program|code)\b)[^;\n]{0,80}(?:==|!=)\s*(?:r\#*)?"[^"\n]{16,}"\#*|(?:r\#*)?"[^"\n]{16,}"\#*\s*(?:==|!=)[^;\n]{0,80}(?i:\b(?:source|source_text|script|program|code)\b)' |
| 29 | +source_probe_pattern='(?i:\b(?:source|source_text|script|program|code)\b)[^;\n]{0,120}\.(?:contains|starts_with|ends_with)\(\s*(?:r\#*)?"[^"\n]{16,}"' |
| 30 | +filename_probe_pattern='(?i:\b(?:filename|file_name|path)\b)[^;\n]{0,120}\.(?:contains|starts_with|ends_with)\(\s*(?:r\#*)?"[^"\n]+\.js' |
| 31 | + |
| 32 | +scan_regex() { |
| 33 | + local label=$1 pattern=$2 output status |
| 34 | + set +e |
| 35 | + output=$(rg --line-number --no-heading --color never --pcre2 \ |
| 36 | + "${scan_globs[@]}" -- "$pattern" "${scan_roots[@]}" 2>&1) |
| 37 | + status=$? |
| 38 | + set -e |
| 39 | + case $status in |
| 40 | + 0) |
| 41 | + printf '%s\n' "$output" >&2 |
| 42 | + die "production sources contain $label" |
| 43 | + ;; |
| 44 | + 1) ;; |
| 45 | + *) |
| 46 | + printf '%s\n' "$output" >&2 |
| 47 | + die "could not scan production sources for $label" |
| 48 | + ;; |
| 49 | + esac |
| 50 | +} |
| 51 | + |
| 52 | +scan_regex "a Test262 path or fixture name" "$path_pattern" |
| 53 | +scan_regex "source-derived hash dispatch" "$source_hash_pattern" |
| 54 | +scan_regex "an exact authored-source comparison" "$source_literal_pattern" |
| 55 | +scan_regex "an authored-source substring probe" "$source_probe_pattern" |
| 56 | +scan_regex "a JavaScript filename-specific branch" "$filename_probe_pattern" |
| 57 | + |
| 58 | +tmp=$(mktemp -d "${TMPDIR:-/tmp}/quickjs-oxide-anticheat.XXXXXX") |
| 59 | +trap 'rm -rf -- "$tmp"' EXIT |
| 60 | + |
| 61 | +# Production code has one authenticated data-provenance digest: the pinned |
| 62 | +# QuickJS Unicode table source. Reject every other SHA-1/SHA-256-shaped literal |
| 63 | +# instead of coupling this gate to the runner's current profile history. |
| 64 | +hash_pattern='(?i:\b(?=[0-9a-f]{40}\b)(?=[0-9a-f]*[a-f])[0-9a-f]{40}\b|\b(?=[0-9a-f]{64}\b)(?=[0-9a-f]*[a-f])[0-9a-f]{64}\b)' |
| 65 | +unicode_source_sha=cf782bc7a07549e976f606bd3cb8555858482b279574554dcb8d46412986006c |
| 66 | +set +e |
| 67 | +hash_output=$(rg --line-number --no-heading --color never --pcre2 \ |
| 68 | + "${scan_globs[@]}" -- "$hash_pattern" "${scan_roots[@]}" 2>&1) |
| 69 | +hash_status=$? |
| 70 | +set -e |
| 71 | +case $hash_status in |
| 72 | + 0) |
| 73 | + unexpected_hashes=$tmp/unexpected-hashes.txt |
| 74 | + : > "$unexpected_hashes" |
| 75 | + while IFS= read -r occurrence; do |
| 76 | + case $occurrence in |
| 77 | + src/unicode_*"$unicode_source_sha"*) ;; |
| 78 | + *) printf '%s\n' "$occurrence" >> "$unexpected_hashes" ;; |
| 79 | + esac |
| 80 | + done <<< "$hash_output" |
| 81 | + if [[ -s "$unexpected_hashes" ]]; then |
| 82 | + cat "$unexpected_hashes" >&2 |
| 83 | + die "production sources contain an unauthenticated test-shaped hash" |
| 84 | + fi |
| 85 | + ;; |
| 86 | + 1) ;; |
| 87 | + *) |
| 88 | + printf '%s\n' "$hash_output" >&2 |
| 89 | + die "could not scan production sources for test-shaped hashes" |
| 90 | + ;; |
| 91 | +esac |
| 92 | + |
| 93 | +# Keep the patterns honest. Legitimate host vocabulary must stay allowed, |
| 94 | +# while each prohibited coupling class must have a positive canary. |
| 95 | +printf 'const HOST_NAME: &str = "$262";\n' > "$tmp/allowed.rs" |
| 96 | +! rg --quiet --pcre2 -- "$path_pattern|$source_hash_pattern|$source_literal_pattern|$source_probe_pattern|$filename_probe_pattern" "$tmp/allowed.rs" \ |
| 97 | + || die 'anti-cheat patterns reject the legitimate $262 host name' |
| 98 | + |
| 99 | +printf '// language/statements/fixture-special-case.js\n' > "$tmp/path.rs" |
| 100 | +rg --quiet --pcre2 -- "$path_pattern" "$tmp/path.rs" \ |
| 101 | + || die "Test262 path canary escaped the anti-cheat pattern" |
| 102 | + |
| 103 | +printf 'const FIXTURE_DIGEST: &str = "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF";\n' > "$tmp/hash.rs" |
| 104 | +rg --quiet --pcre2 -- "$hash_pattern" "$tmp/hash.rs" \ |
| 105 | + || die "test-shaped hash canary escaped the anti-cheat pattern" |
| 106 | + |
| 107 | +printf 'if source.contains("this exact fixture body") {}\n' > "$tmp/source.rs" |
| 108 | +rg --quiet --pcre2 -- "$source_probe_pattern" "$tmp/source.rs" \ |
| 109 | + || die "source-special-casing canary escaped the anti-cheat pattern" |
| 110 | + |
| 111 | +printf 'if source.trim().contains("this exact fixture body") {}\n' > "$tmp/source-chain.rs" |
| 112 | +rg --quiet --pcre2 -- "$source_probe_pattern" "$tmp/source-chain.rs" \ |
| 113 | + || die "chained source-special-casing canary escaped the anti-cheat pattern" |
| 114 | + |
| 115 | +printf 'if "this exact fixture body" == source {}\n' > "$tmp/source-reverse.rs" |
| 116 | +rg --quiet --pcre2 -- "$source_literal_pattern" "$tmp/source-reverse.rs" \ |
| 117 | + || die "reversed source-special-casing canary escaped the anti-cheat pattern" |
| 118 | + |
| 119 | +printf 'if source.content_hash() == 0xdeadbeef {}\n' > "$tmp/source-hash.rs" |
| 120 | +rg --quiet --pcre2 -- "$source_hash_pattern" "$tmp/source-hash.rs" \ |
| 121 | + || die "source-hash canary escaped the anti-cheat pattern" |
| 122 | + |
| 123 | +echo "Production engine Test262 anti-cheat gate passed." |
0 commit comments