fix(modules): harden the import-map preloader against poisoning and unbounded growth

extensions/ext-llm-anthropic/src/anthropic-request-builder.ts

@@ -2,7 +2,6 @@ import {
   jsonValuesEqual,
   readProviderOptions,
   readRecord,
-  stringifyJsonValue,
   stringifyToolResultValue,
   unwrapToolInputSchema,
 } from "veryfront/provider/shared";

extensions/ext-llm-openai/src/openai-responses-request-builder.ts

@@ -1,7 +1,6 @@
 import {
   jsonValuesEqual,
   readProviderOptions,
-  stringifyJsonValue,
   stringifyToolArguments,
   stringifyToolResultValue,
   unwrapToolInputSchema,

src/cache/config-hash.ts

@@ -14,6 +14,8 @@ import {
 } from "#veryfront/transforms/import-rewriter/url-builder.ts";
 import { buildDependencyPinningCacheVariant } from "./keys/dependency-pinning.ts";
 
+const JSONStringify = JSON.stringify;
+
 /**
  * Configuration that affects transform output.
  */
@@ -62,7 +64,7 @@ export function computeConfigHash(config: TransformConfig): Promise<string> {
     tailwind: TAILWIND_VERSION,
   };
 
-  return computeHash(JSON.stringify(normalized));
+  return computeHash(JSONStringify(normalized));
 }
 
 /**

src/modules/import-map/loader.ts

@@ -2,7 +2,7 @@ import { rendererLogger as logger } from "#veryfront/utils";
 import { dirname, join } from "#veryfront/compat/path/index.ts";
 import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
 import { isVirtualFilesystem } from "#veryfront/platform/adapters/fs/wrapper.ts";
-import { getConfig } from "#veryfront/config";
+import { getConfig, type VeryfrontConfig } from "#veryfront/config";
 import type { ImportMapConfig } from "./types.ts";
 import { getDefaultImportMap } from "./default-import-map.ts";
 import { mergeImportMaps } from "./merger.ts";
@@ -135,9 +135,20 @@ async function loadDenoJsonImportMap(
   return null;
 }
 
+function getConfigImportMap(config: VeryfrontConfig): ImportMapConfig | null {
+  const importMap = config.resolve?.importMap;
+  if (!importMap || typeof importMap !== "object") return null;
+
+  return {
+    imports: importMap.imports ?? {},
+    scopes: importMap.scopes ?? {},
+  };
+}
+
 export function loadImportMap(
   startPath: string,
   adapter?: RuntimeAdapter,
+  config?: VeryfrontConfig,
 ): Promise<ImportMapConfig> {
   return withSpan(
     "modules.importMap.load",
@@ -147,19 +158,19 @@ export function loadImportMap(
       // First, load import map from deno.json (if exists)
       const denoJsonMap = await loadDenoJsonImportMap(startPath, runtimeAdapter);
 
-      // Then, try to get config's import map
+      // Then, try to get config's import map. A config already validated for
+      // the authenticated request takes precedence over re-reading it from the
+      // project source.
       let configMap: ImportMapConfig | null = null;
-      try {
-        const cfg = await getConfig(startPath, runtimeAdapter);
-        const importMap = cfg?.resolve?.importMap;
-        if (importMap && typeof importMap === "object") {
-          configMap = {
-            imports: importMap.imports ?? {},
-            scopes: importMap.scopes ?? {},
-          };
+      if (config) {
+        configMap = getConfigImportMap(config);
+      } else {
+        try {
+          const cfg = await getConfig(startPath, runtimeAdapter);
+          if (cfg) configMap = getConfigImportMap(cfg);
+        } catch (_) {
+          /* expected: config not found or invalid, continue without it */
         }
-      } catch (_) {
-        /* expected: config not found or invalid, continue without it */
       }
 
       // Merge: defaults < deno.json < config

src/modules/import-map/preloader-primordial-poisoning.worker.ts

@@ -0,0 +1,153 @@
+import type { VeryfrontConfig } from "#veryfront/config";
+import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
+import { ImportMapPreloader } from "./preloader.ts";
+
+const adapter = {
+  fs: {},
+  env: {},
+} as unknown as RuntimeAdapter;
+const configA = {
+  resolve: {
+    importMap: {
+      imports: { package: "https://example.com/package-a.ts" },
+    },
+  },
+} as VeryfrontConfig;
+const configB = {
+  resolve: {
+    importMap: {
+      imports: { package: "https://example.com/package-b.ts" },
+    },
+  },
+} as VeryfrontConfig;
+
+async function runPoisoningRegression() {
+  const original = {
+    arrayMap: Array.prototype.map,
+    arraySort: Array.prototype.sort,
+    dateNow: Date.now,
+    jsonStringify: JSON.stringify,
+    map: Map,
+    mapClear: Map.prototype.clear,
+    mapDelete: Map.prototype.delete,
+    mapForEach: Map.prototype.forEach,
+    mapGet: Map.prototype.get,
+    mapSet: Map.prototype.set,
+    mapSize: Object.getOwnPropertyDescriptor(Map.prototype, "size")!,
+    mathMin: Math.min,
+    numberIsFinite: Number.isFinite,
+    numberIsSafeInteger: Number.isSafeInteger,
+    objectEntries: Object.entries,
+    promise: Promise,
+    promiseResolve: Promise.resolve,
+    set: Set,
+    setAdd: Set.prototype.add,
+    setDelete: Set.prototype.delete,
+    setSize: Object.getOwnPropertyDescriptor(Set.prototype, "size")!,
+  };
+  const poisoned = () => {
+    throw new Error("poisoned primordial");
+  };
+  let first: Awaited<ReturnType<ImportMapPreloader["preload"]>> | undefined;
+  let firstAgain: Awaited<ReturnType<ImportMapPreloader["preload"]>> | undefined;
+  let second: Awaited<ReturnType<ImportMapPreloader["preload"]>> | undefined;
+  let evicted:
+    | Awaited<ReturnType<ImportMapPreloader["getCached"]>>
+    | undefined;
+  let loads = 0;
+
+  try {
+    Reflect.set(Array.prototype, "map", poisoned);
+    Reflect.set(Array.prototype, "sort", poisoned);
+    Reflect.set(Date, "now", poisoned);
+    Reflect.set(JSON, "stringify", poisoned);
+    Reflect.set(globalThis, "Map", class PoisonedMap {});
+    Reflect.set(original.map.prototype, "clear", poisoned);
+    Reflect.set(original.map.prototype, "delete", poisoned);
+    Reflect.set(original.map.prototype, "forEach", poisoned);
+    Reflect.set(original.map.prototype, "get", poisoned);
+    Reflect.set(original.map.prototype, "set", poisoned);
+    Object.defineProperty(original.map.prototype, "size", {
+      configurable: true,
+      get: poisoned,
+    });
+    Reflect.set(Math, "min", poisoned);
+    Reflect.set(Number, "isFinite", poisoned);
+    Reflect.set(Number, "isSafeInteger", poisoned);
+    Reflect.set(Object, "entries", poisoned);
+    Reflect.set(globalThis, "Promise", class PoisonedPromise {});
+    Reflect.set(original.promise, "resolve", poisoned);
+    Reflect.set(globalThis, "Set", class PoisonedSet {});
+    Reflect.set(original.set.prototype, "add", poisoned);
+    Reflect.set(original.set.prototype, "delete", poisoned);
+    Object.defineProperty(original.set.prototype, "size", {
+      configurable: true,
+      get: poisoned,
+    });
+
+    const preloader = new ImportMapPreloader({
+      maxProjects: 1,
+      maxVariantsPerProject: 1,
+      ttlMs: 1_000,
+      loadImportMap: async (_path, _adapter, config) => ({
+        imports: {
+          loaded: String(++loads),
+          package: config?.resolve?.importMap?.imports?.package ?? "",
+        },
+      }),
+    });
+    const contextA = { contentSourceId: "source", config: configA };
+    const contextB = { contentSourceId: "source", config: configB };
+
+    first = await preloader.preload("/project", adapter, "project", contextA);
+    firstAgain = await preloader.preload(
+      "/project",
+      adapter,
+      "project",
+      contextA,
+    );
+    second = await preloader.preload("/project", adapter, "project", contextB);
+    evicted = await preloader.getCached("project", contextA);
+  } finally {
+    Reflect.set(Array.prototype, "map", original.arrayMap);
+    Reflect.set(Array.prototype, "sort", original.arraySort);
+    Reflect.set(Date, "now", original.dateNow);
+    Reflect.set(JSON, "stringify", original.jsonStringify);
+    Reflect.set(original.map.prototype, "clear", original.mapClear);
+    Reflect.set(original.map.prototype, "delete", original.mapDelete);
+    Reflect.set(original.map.prototype, "forEach", original.mapForEach);
+    Reflect.set(original.map.prototype, "get", original.mapGet);
+    Reflect.set(original.map.prototype, "set", original.mapSet);
+    Object.defineProperty(original.map.prototype, "size", original.mapSize);
+    Reflect.set(Math, "min", original.mathMin);
+    Reflect.set(Number, "isFinite", original.numberIsFinite);
+    Reflect.set(Number, "isSafeInteger", original.numberIsSafeInteger);
+    Reflect.set(Object, "entries", original.objectEntries);
+    Reflect.set(original.promise, "resolve", original.promiseResolve);
+    Reflect.set(original.set.prototype, "add", original.setAdd);
+    Reflect.set(original.set.prototype, "delete", original.setDelete);
+    Object.defineProperty(original.set.prototype, "size", original.setSize);
+    Reflect.set(globalThis, "Map", original.map);
+    Reflect.set(globalThis, "Promise", original.promise);
+    Reflect.set(globalThis, "Set", original.set);
+  }
+
+  return {
+    firstLoaded: first?.imports?.loaded,
+    firstSame: firstAgain === first,
+    secondLoaded: second?.imports?.loaded,
+    secondPackage: second?.imports?.package,
+    evicted: evicted === undefined,
+    loads,
+  };
+}
+
+try {
+  const result = await runPoisoningRegression();
+  postMessage({ ok: true, result });
+} catch (error) {
+  postMessage({
+    ok: false,
+    error: error instanceof Error ? (error.stack ?? error.message) : String(error),
+  });
+}