policy: cleanup to allow snapshotting

lib/internal/bootstrap/node.js

@@ -341,6 +341,7 @@ require('url');
 require('internal/options');
 if (config.hasOpenSSL) {
   require('crypto');
+  require('internal/process/policy');
 }
 
 function setupPrepareStackTrace() {

lib/internal/bootstrap/pre_execution.js

@@ -25,6 +25,8 @@ const {
 const { Buffer } = require('buffer');
 const { ERR_MANIFEST_ASSERT_INTEGRITY } = require('internal/errors').codes;
 const assert = require('internal/assert');
+const policy = require('internal/process/policy');
+const SRI = require('internal/policy/sri');
 
 function prepareMainThreadExecution(expandArgv1 = false) {
   // TODO(joyeecheung): this is also necessary for workers when they deserialize
@@ -434,7 +436,9 @@ function initializeClusterIPC() {
 }
 
 function initializePolicy() {
-  const experimentalPolicy = getOptionValue('--experimental-policy');
+  const experimentalPolicy = getOptionValue('[has_experimental_policy_string]') ?
+    getOptionValue('--experimental-policy') :
+    null;
   if (experimentalPolicy) {
     process.emitWarning('Policies are experimental.',
                         'ExperimentalWarning');
@@ -453,7 +457,6 @@ function initializePolicy() {
     const src = fs.readFileSync(manifestURL, 'utf8');
     const experimentalPolicyIntegrity = getOptionValue('--policy-integrity');
     if (experimentalPolicyIntegrity) {
-      const SRI = require('internal/policy/sri');
       const { createHash, timingSafeEqual } = require('crypto');
       const realIntegrities = new SafeMap();
       const integrityEntries = SRI.parse(experimentalPolicyIntegrity);
@@ -477,9 +480,17 @@ function initializePolicy() {
         throw new ERR_MANIFEST_ASSERT_INTEGRITY(manifestURL, realIntegrities);
       }
     }
-    require('internal/process/policy')
-      .setup(src, manifestURL.href);
+    policy.setup(src, manifestURL.href);
+  } else {
+    // This disables the policy TDZ checks so code can just check
+    //   if (!policy.manifest)
+    // it is important to keep the policy in TDZ until the user supplied
+    // options are determined at startup
+    policy.setup(null);
   }
+  // Ensure that policy no longer has a TDZ by checking
+  // that we can access .manifest policy.manifest
+  policy.manifest; // eslint-disable-line no-unused-expressions
 }
 
 function initializeWASI() {

lib/internal/main/worker_thread.js

@@ -63,6 +63,7 @@ let debug = require('internal/util/debuglog').debuglog('worker', (fn) => {
 });
 
 const assert = require('internal/assert');
+const policy = require('internal/process/policy');
 
 patchProcessObject();
 setupInspectorHooks();
@@ -124,7 +125,9 @@ port.on('message', (message) => {
     setupPerfHooks();
     initializeReport();
     if (manifestSrc) {
-      require('internal/process/policy').setup(manifestSrc, manifestURL);
+      policy.setup(manifestSrc, manifestURL);
+    } else {
+      policy.setup(null);
     }
     initializeDeprecations();
     initializeWASI();

lib/internal/modules/cjs/loader.js

@@ -101,9 +101,7 @@ const { getOptionValue } = require('internal/options');
 const preserveSymlinks = getOptionValue('--preserve-symlinks');
 const preserveSymlinksMain = getOptionValue('--preserve-symlinks-main');
 // Do not eagerly grab .manifest, it may be in TDZ
-const policy = getOptionValue('--experimental-policy') ?
-  require('internal/process/policy') :
-  null;
+const policy = require('internal/process/policy');
 
 // Whether any user-provided CJS modules had been loaded (executed).
 // Used for internal assertions.
@@ -1053,7 +1051,7 @@ function wrapSafe(filename, content, cjsModuleInstance) {
 Module.prototype._compile = function(content, filename) {
   let moduleURL;
   let redirects;
-  if (policy?.manifest) {
+  if (policy.manifest) {
     moduleURL = pathToFileURL(filename);
     redirects = policy.manifest.getDependencyMapper(moduleURL);
     policy.manifest.assertIntegrity(moduleURL, content);
@@ -1158,7 +1156,7 @@ Module._extensions['.js'] = function(module, filename) {
 Module._extensions['.json'] = function(module, filename) {
   const content = fs.readFileSync(filename, 'utf8');
 
-  if (policy?.manifest) {
+  if (policy.manifest) {
     const moduleURL = pathToFileURL(filename);
     policy.manifest.assertIntegrity(moduleURL, content);
   }
@@ -1174,7 +1172,7 @@ Module._extensions['.json'] = function(module, filename) {
 
 // Native extension for .node
 Module._extensions['.node'] = function(module, filename) {
-  if (policy?.manifest) {
+  if (policy.manifest) {
     const content = fs.readFileSync(filename);
     const moduleURL = pathToFileURL(filename);
     policy.manifest.assertIntegrity(moduleURL, content);

lib/internal/modules/esm/get_source.js

@@ -9,9 +9,7 @@ const { getOptionValue } = require('internal/options');
 const { fetchModule } = require('internal/modules/esm/fetch_module');
 
 // Do not eagerly grab .manifest, it may be in TDZ
-const policy = getOptionValue('--experimental-policy') ?
-  require('internal/process/policy') :
-  null;
+const policy = require('internal/process/policy');
 const experimentalNetworkImports =
   getOptionValue('--experimental-network-imports');
 
@@ -52,7 +50,7 @@ async function defaultGetSource(url, context, defaultGetSource) {
       experimentalNetworkImports ? ['https', 'http'] : [],
     ]));
   }
-  if (policy?.manifest) {
+  if (policy.manifest) {
     policy.manifest.assertIntegrity(parsed, source);
   }
   return source;

lib/internal/modules/esm/resolve.js

@@ -10,6 +10,7 @@ const {
   ObjectFreeze,
   ObjectGetOwnPropertyNames,
   ObjectPrototypeHasOwnProperty,
+  ReflectApply,
   RegExp,
   RegExpPrototypeExec,
   RegExpPrototypeSymbolReplace,
@@ -35,9 +36,7 @@ const {
 } = require('fs');
 const { getOptionValue } = require('internal/options');
 // Do not eagerly grab .manifest, it may be in TDZ
-const policy = getOptionValue('--experimental-policy') ?
-  require('internal/process/policy') :
-  null;
+const policy = require('internal/process/policy');
 const { sep, relative, resolve } = require('path');
 const preserveSymlinks = getOptionValue('--preserve-symlinks');
 const preserveSymlinksMain = getOptionValue('--preserve-symlinks-main');
@@ -1090,7 +1089,7 @@ function throwIfUnsupportedURLScheme(parsed, experimentalNetworkImports) {
 
 async function defaultResolve(specifier, context = {}, defaultResolveUnused) {
   let { parentURL, conditions } = context;
-  if (parentURL && policy?.manifest) {
+  if (parentURL && policy.manifest) {
     const redirects = policy.manifest.getDependencyMapper(parentURL);
     if (redirects) {
       const { resolve, reaction } = redirects;
@@ -1217,9 +1216,33 @@ async function defaultResolve(specifier, context = {}, defaultResolveUnused) {
   };
 }
 
+function policyWrappingDefaultResolve() {
+  const $defaultResolve = defaultResolve;
+  if (policy.manifest) {
+    module.exports.defaultResolve = async function defaultResolve(
+      specifier,
+      context
+    ) {
+      const ret = await $defaultResolve(specifier, context, $defaultResolve);
+      // This is a preflight check to avoid data exfiltration by query params etc.
+      policy.manifest.mightAllow(ret.url, () =>
+        new ERR_MANIFEST_DEPENDENCY_MISSING(
+          context.parentURL,
+          specifier,
+          context.conditions
+        )
+      );
+      return ret;
+    };
+  } else {
+    module.exports.defaultResolve = $defaultResolve;
+  }
+  return ReflectApply(module.exports.defaultResolve, this, arguments);
+}
+
 module.exports = {
   DEFAULT_CONDITIONS,
-  defaultResolve,
+  defaultResolve: policyWrappingDefaultResolve,
   encodedSepRegEx,
   getPackageScopeConfig,
   getPackageType,
@@ -1231,22 +1254,3 @@ module.exports = {
 const {
   defaultGetFormatWithoutErrors,
 } = require('internal/modules/esm/get_format');
-
-if (policy) {
-  const $defaultResolve = defaultResolve;
-  module.exports.defaultResolve = async function defaultResolve(
-    specifier,
-    context
-  ) {
-    const ret = await $defaultResolve(specifier, context, $defaultResolve);
-    // This is a preflight check to avoid data exfiltration by query params etc.
-    policy.manifest.mightAllow(ret.url, () =>
-      new ERR_MANIFEST_DEPENDENCY_MISSING(
-        context.parentURL,
-        specifier,
-        context.conditions
-      )
-    );
-    return ret;
-  };
-}

lib/internal/modules/package_json_reader.js

@@ -4,6 +4,7 @@ const { SafeMap } = primordials;
 const { internalModuleReadJSON } = internalBinding('fs');
 const { pathToFileURL } = require('url');
 const { toNamespacedPath } = require('path');
+const policy = require('internal/process/policy');
 
 const cache = new SafeMap();
 
@@ -22,12 +23,9 @@ function read(jsonPath) {
     toNamespacedPath(jsonPath)
   );
   const result = { string, containsKeys };
-  const { getOptionValue } = require('internal/options');
   if (string !== undefined) {
     if (manifest === undefined) {
-      manifest = getOptionValue('--experimental-policy') ?
-        require('internal/process/policy').manifest :
-        null;
+      manifest = policy.manifest;
     }
     if (manifest !== null) {
       const jsonURL = pathToFileURL(jsonPath);

lib/internal/policy/manifest.js

@@ -38,9 +38,7 @@ const HashDigest = uncurryThis(crypto.Hash.prototype.digest);
 const BufferToString = uncurryThis(Buffer.prototype.toString);
 const kRelativeURLStringPattern = /^\.{0,2}\//;
 const { getOptionValue } = require('internal/options');
-const shouldAbortOnUncaughtException = getOptionValue(
-  '--abort-on-uncaught-exception'
-);
+let shouldAbortOnUncaughtException;
 const { abort, exit, _rawDebug } = process;
 // #endregion
 
@@ -354,6 +352,14 @@ function findScopeHREF(href, scopeStore, allowSame) {
  * @typedef {boolean | string | SRI[] | typeof kCascade} Integrity
  */
 
+// To get this in the snapshot we can't have things that use getOptionsValue or
+// expose C++ functions so we do these lazily
+function lazyBits() {
+  shouldAbortOnUncaughtException = getOptionValue(
+    '--abort-on-uncaught-exception'
+  );
+}
+
 class Manifest {
   #defaultDependencies;
   /**
@@ -423,6 +429,7 @@ class Manifest {
    * @param {string} manifestHREF
    */
   constructor(obj, manifestHREF) {
+    lazyBits();
     this.href = manifestHREF;
     const scopes = this.#scopeDependencies;
     const integrities = this.#resourceIntegrities;

lib/internal/policy/sri.js

@@ -33,7 +33,11 @@ ObjectSeal(kAllWSP);
 
 const BufferFrom = require('buffer').Buffer.from;
 
-// Returns {algorithm, value (in base64 string), options,}[]
+/**
+ * Strictly parses an SRI string and returns all found entries
+ * @param {string} str
+ * @returns {Array<{algorithm:string, value:string, options: string | null}>}
+ */
 const parse = (str) => {
   let prevIndex = 0;
   let match;

lib/internal/process/policy.js

@@ -10,17 +10,33 @@ const {
   ERR_MANIFEST_TDZ,
 } = require('internal/errors').codes;
 const { Manifest } = require('internal/policy/manifest');
+/**
+ * @type {InstanceType<Manifest>}
+ */
 let manifest;
+/**
+ * @type {string}
+ */
 let manifestSrc;
+/**
+ * @type {string}
+ */
 let manifestURL;
 
 module.exports = ObjectFreeze({
   __proto__: null,
+  /**
+   * @param {string | null} src null to not use a policy
+   * @param {string} url
+   * @returns {void}
+   */
   setup(src, url) {
     manifestSrc = src;
     manifestURL = url;
     if (src === null) {
       manifest = null;
+      manifestSrc = null;
+      manifestURL = null;
       return;
     }
 

lib/internal/worker.js

@@ -38,7 +38,7 @@ const {
   ERR_INVALID_ARG_TYPE,
   ERR_INVALID_ARG_VALUE,
 } = errorCodes;
-const { getOptionValue } = require('internal/options');
+const policy = require('internal/process/policy');
 
 const workerIo = require('internal/worker/io');
 const {
@@ -241,12 +241,8 @@ class Worker extends EventEmitter {
       workerData: options.workerData,
       environmentData,
       publicPort: port2,
-      manifestURL: getOptionValue('--experimental-policy') ?
-        require('internal/process/policy').url :
-        null,
-      manifestSrc: getOptionValue('--experimental-policy') ?
-        require('internal/process/policy').src :
-        null,
+      manifestURL: policy.url,
+      manifestSrc: policy.src,
       hasStdin: !!options.stdin
     }, transferList);
     // Use this to cache the Worker's loopStart value once available.

src/node_options.cc

@@ -344,11 +344,15 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "experimental ES Module import.meta.resolve() support",
             &EnvironmentOptions::experimental_import_meta_resolve,
             kAllowedInEnvironment);
+  AddOption("[has_experimental_policy_string]",
+            "",
+            &EnvironmentOptions::has_experimental_policy_string);
   AddOption("--experimental-policy",
             "use the specified file as a "
             "security policy",
             &EnvironmentOptions::experimental_policy,
             kAllowedInEnvironment);
+  Implies("--experimental-policy", "[has_experimental_policy_string]");
   AddOption("[has_policy_integrity_string]",
             "",
             &EnvironmentOptions::has_policy_integrity_string);

src/node_options.h

@@ -114,6 +114,7 @@ class EnvironmentOptions : public Options {
   bool experimental_wasm_modules = false;
   bool experimental_import_meta_resolve = false;
   std::string module_type;
+  bool has_experimental_policy_string = false;
   std::string experimental_policy;
   std::string experimental_policy_integrity;
   bool has_policy_integrity_string = false;

test/parallel/test-bootstrap-modules.js

@@ -99,6 +99,9 @@ const expectedModules = new Set([
   'NativeModule internal/perf/timerify',
   'NativeModule internal/perf/usertiming',
   'NativeModule internal/perf/utils',
+  'NativeModule internal/policy/manifest',
+  'NativeModule internal/policy/sri',
+  'NativeModule internal/process/policy',
   'NativeModule internal/priority_queue',
   'NativeModule internal/process/esm_loader',
   'NativeModule internal/process/execution',