Harden reader resource handling

scripts/check_reader_release.mjs

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 const args = Object.fromEntries(process.argv.slice(2).reduce((items, value, index, all) => value.startsWith("--") ? [...items, [value.slice(2), all[index + 1]?.startsWith("--") ? true : all[index + 1]]] : items, []));
-const required = ["reader.html", "reader.css", "reader.js", "reader-contract.js", "reader-store.js", "reader-request-manager.js", "reader-chapter-repository.js", "reader-scroll-anchor.js", "reader-section-virtualizer.js", "reader-runtime.js", "reader-format-adapters.js", "pdf-worker-wrapper.mjs", "foliate-reader/view.js"];
+const required = ["reader.html", "reader.css", "reader.js", "reader-contract.js", "reader-store.js", "reader-request-manager.js", "reader-chapter-repository.js", "reader-scroll-anchor.js", "reader-section-virtualizer.js", "reader-runtime.js", "reader-format-adapters.js", "reader-security.js", "pdf-worker-wrapper.mjs", "foliate-reader/view.js"];
 const behavioral = ["createReaderRuntime", "createAdapterRegistry", "registerReaderFormatAdapters", "formatAdapters.activate(capability.mode)", "disableStream: true", "nextReaderGeneration(\"navigation\")"];
 const hash = (file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex"), normalized = (file) => fs.readFileSync(file, "utf8").replaceAll("/search/static/", "/static/").replace(/\s+/g, "");
 function assert(condition, message) { if (!condition) throw new Error(message); }

static/app.js

@@ -961,7 +961,7 @@ function warmReaderIntent(rawUrl) {
     extension = (readerUrl.searchParams.get("ext") || "").toLowerCase();
     sourceUrl = readerUrl.searchParams.get("url") || "";
   } catch (_) { return; }
-  const shellAssets = ["/static/reader.css", "/static/reader-contract.js", "/static/reader-store.js", "/static/reader-request-manager.js", "/static/reader-chapter-repository.js", "/static/reader-scroll-anchor.js", "/static/reader-section-virtualizer.js", "/static/reader-runtime.js", "/static/reader-format-adapters.js", "/static/reader.js"];
+  const shellAssets = ["/static/reader.css", "/static/reader-contract.js", "/static/reader-store.js", "/static/reader-request-manager.js", "/static/reader-chapter-repository.js", "/static/reader-scroll-anchor.js", "/static/reader-section-virtualizer.js", "/static/reader-runtime.js", "/static/reader-format-adapters.js", "/static/reader-security.js", "/static/reader.js"];
   const engineAssets = extension === "pdf"
     ? ["/static/vendor/pdf.min.f80490490320.mjs", "/static/pdf-worker-wrapper.mjs", "/static/vendor/pdf.worker.min.8ab0e5e30031.mjs"]
     : extension === "epub" ? []

static/reader-security.js

@@ -7,5 +7,6 @@
   async function readText(response, limit, encoding = "utf-8") { return new TextDecoder(encoding).decode(await readBytes(response, limit)); }
   function inspectZip(bytes, limits = LIMITS) { bytes = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes); if (bytes.byteLength > limits.archiveCompressedBytes) throw error("READER_ARCHIVE_LIMIT"); const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength); let entries = 0, compressed = 0, expanded = 0; for (let offset = 0; offset + 46 <= bytes.byteLength;) { const signature = view.getUint32(offset, true); if (signature !== 0x02014b50) { offset += 1; continue; } const packed = view.getUint32(offset + 20, true), unpacked = view.getUint32(offset + 24, true), nameLength = view.getUint16(offset + 28, true), extraLength = view.getUint16(offset + 30, true), commentLength = view.getUint16(offset + 32, true); if (packed === 0xffffffff || unpacked === 0xffffffff) throw error("READER_ARCHIVE_LIMIT"); entries += 1; compressed += packed; expanded += unpacked; if (entries > limits.archiveEntries || expanded > limits.archiveExpandedBytes || (packed === 0 ? unpacked > 0 : unpacked / packed > limits.archiveRatio)) throw error("READER_ARCHIVE_LIMIT"); offset += 46 + nameLength + extraLength + commentLength; } if (!entries) throw error("READER_ARCHIVE_INVALID"); return Object.freeze({ entries, compressed, expanded }); }
   function validateChapterManifest(manifest) { if (manifest?.version !== 1 || manifest?.kind !== "epub-chapters" || !Array.isArray(manifest.chapters) || !manifest.chapters.length) throw error("EPUB_INVALID"); if (manifest.chapters.length > LIMITS.chapters) throw error("READER_RESOURCE_LIMIT"); let declaredBytes = 0; for (const chapter of manifest.chapters) { const size = Number(chapter.bytes ?? chapter.size ?? 0); if (Number.isFinite(size) && size > 0) { if (size > LIMITS.chapterBytes) throw error("READER_RESOURCE_LIMIT"); declaredBytes += size; } } if (declaredBytes > LIMITS.chapterTotalBytes) throw error("READER_RESOURCE_LIMIT"); return manifest; }
-  root.VoiceOfMLReaderSecurity = Object.freeze({ LIMITS, assertResponseSize, readBytes, readText, inspectZip, validateChapterManifest });
+  function isZipContainer(extension) { return ["epub", "fbz"].includes(String(extension || "").toLowerCase()); }
+  root.VoiceOfMLReaderSecurity = Object.freeze({ LIMITS, assertResponseSize, readBytes, readText, inspectZip, validateChapterManifest, isZipContainer });
 })(typeof self !== "undefined" ? self : globalThis);

static/reader.js

@@ -573,6 +573,7 @@ function loadScript(url) {
 }
 function fetchWithReaderTimeout(url, timeoutMs = READER_PROXY_TIMEOUT_MS) { return readerRequestManager.request(url, timeoutMs); }
 function fetchReaderUrl(rawUrl) {
+  if (String(rawUrl).includes("/api/reader-bucket-resource?")) return fetchWithReaderTimeout(rawUrl);
   const proxyUrl = `/api/reader-content?url=${encodeURIComponent(rawUrl)}`;
   return fetchWithReaderTimeout(proxyUrl).then((response) => response.ok ? response : fetchWithReaderTimeout(rawUrl), () => fetchWithReaderTimeout(rawUrl));
 }
@@ -593,7 +594,7 @@ function fail(message, code = "READER_PARSE") { if (readerLifecycle.disposed) re
 async function renderPdfPages(prepared) {
   const response = await prepared; if (!response.ok) throw new Error(`HTTP ${response.status}`);
   const manifest = JSON.parse(await VoiceOfMLReaderSecurity.readText(response, VoiceOfMLReaderSecurity.LIMITS.manifestBytes)), entries = (manifest.pages || []).map((item) => ({ page: Number(item.page), path: String(item.path || "") })).sort((a, b) => a.page - b.page), rootMatch = entries[0]?.path.match(/^(objects\/[0-9a-f]{2}\/[0-9a-f]{64}\/[0-9a-f]{16})\/pages\//);
-  if (manifest.version !== 1 || manifest.kind !== "pdf-pages" || !rootMatch || !entries.length || entries.some((item, index) => item.page !== index + 1 || !new RegExp(`^objects/${rootMatch[1]}/pages/page-[0-9]{6}\\.webp$`).test(item.path))) throw new Error("PDF_MANIFEST_INVALID");
+  if (manifest.version !== 1 || manifest.kind !== "pdf-pages" || !rootMatch || !entries.length || entries.some((item, index) => item.page !== index + 1 || !new RegExp(`^${rootMatch[1]}/pages/page-[0-9]{6}\\.webp$`).test(item.path))) throw new Error("PDF_MANIFEST_INVALID");
   pdfPageManifest = { entries }; updateDocumentState({ pageCount: entries.length }); pageInput.max = String(documentState.pageCount); document.querySelector("#page-total").textContent = `/ ${documentState.pageCount}`; status.textContent = `${documentState.pageCount} 页`;
    const visibleObserver = new IntersectionObserver((items) => {
      const intersecting = items.filter((entry) => entry.isIntersecting).sort((a, b) => {
@@ -1089,7 +1090,7 @@ async function renderFoliate(prepared) {
   if (!response.ok) throw new Error(`HTTP ${response.status}`);
   await import("/static/foliate-reader/view.js");
   const bytes = await VoiceOfMLReaderSecurity.readBytes(response, VoiceOfMLReaderSecurity.LIMITS.archiveCompressedBytes);
-  VoiceOfMLReaderSecurity.inspectZip(bytes);
+  if (VoiceOfMLReaderSecurity.isZipContainer(extension)) VoiceOfMLReaderSecurity.inspectZip(bytes);
   const view = document.createElement("foliate-view"),
     stream = document.createElement("div");
   view.className = "foliate-reader-view";

static/sw.js

@@ -11,6 +11,7 @@ const PRECACHE_URLS = [
   "/static/reader-section-virtualizer.js",
   "/static/reader-runtime.js",
   "/static/reader-format-adapters.js",
+  "/static/reader-security.js",
   "/static/reader.html",
   "/static/reader.css",
   "/static/reader.js",
@@ -33,6 +34,7 @@ const READER_RUNTIME_PATHS = new Set([
   "/static/reader-section-virtualizer.js",
   "/static/reader-runtime.js",
   "/static/reader-format-adapters.js",
+  "/static/reader-security.js",
   "/static/reader.css",
   "/static/reader.js"
 ]);