fix(sandbox): undefine the raw fetch host bridge before user code runs

Author: waleedlatif1

apps/sim/lib/execution/isolated-vm-worker-hardening.test.ts

@@ -0,0 +1,52 @@
+/**
+ * @vitest-environment node
+ *
+ * Guards the isolate hardening contract in `isolated-vm-worker.cjs`: no raw
+ * `ivm.Reference` host bridge may survive as an isolate global once user code
+ * runs. The bootstrap must capture each bridge in a closure and list its global
+ * name in `undefined_globals`.
+ */
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+const WORKER_SOURCE = readFileSync(join(__dirname, 'isolated-vm-worker.cjs'), 'utf8')
+
+/** Global names bound to a raw `ivm.Reference` (as opposed to an `ivm.Callback`). */
+const REFERENCE_BRIDGES = [
+  '__fetchRef',
+  '__brokerRef',
+  '__setTimeoutRef',
+  '__clearTimeoutRef',
+  '__setIntervalRef',
+]
+
+function hardeningLists(): string[] {
+  const lists = WORKER_SOURCE.match(/const undefined_globals = \[[\s\S]*?\]/g)
+  expect(lists).not.toBeNull()
+  return lists as string[]
+}
+
+describe('isolated-vm worker hardening', () => {
+  it('undefines every ivm.Reference bridge it installs as a global', () => {
+    const lists = hardeningLists()
+    expect(lists.length).toBeGreaterThanOrEqual(2)
+
+    for (const bridge of REFERENCE_BRIDGES) {
+      const installed = WORKER_SOURCE.includes(`jail.set('${bridge}'`)
+      if (!installed) continue
+      const undefinedSomewhere = lists.some((list) => list.includes(`'${bridge}'`))
+      expect(undefinedSomewhere, `${bridge} is set as an isolate global but never undefined`).toBe(
+        true
+      )
+    }
+  })
+
+  it('keeps the isolated-vm escape globals in every hardening list', () => {
+    for (const list of hardeningLists()) {
+      for (const name of ['Isolate', 'Context', 'Script', 'Reference', 'ExternalCopy']) {
+        expect(list).toContain(`'${name}'`)
+      }
+    }
+  })
+})

apps/sim/lib/execution/isolated-vm-worker.cjs

@@ -310,8 +310,12 @@ async function executeCode(request, executionId) {
         info: (...args) => __log(...args),
       };
 
-      // Set up fetch function that uses the host's secure fetch
-      async function fetch(url, options) {
+      // Set up fetch function that uses the host's secure fetch. The raw
+      // host bridge is captured in this closure so the hardening step below
+      // can undefine the global without breaking fetch().
+      (() => {
+      const __fetch = globalThis.__fetchRef;
+      globalThis.fetch = async function fetch(url, options) {
         let optionsJson;
         if (options) {
           try {
@@ -323,7 +327,7 @@ async function executeCode(request, executionId) {
             throw new Error('fetch options exceed maximum payload size');
           }
         }
-        const resultJson = await __fetchRef.apply(undefined, [url, optionsJson], { result: { promise: true } });
+        const resultJson = await __fetch.apply(undefined, [url, optionsJson], { result: { promise: true } });
         let result;
         try {
           result = JSON.parse(resultJson);
@@ -355,7 +359,8 @@ async function executeCode(request, executionId) {
           blob: async () => { throw new Error('blob() not supported in sandbox'); },
           arrayBuffer: async () => { throw new Error('arrayBuffer() not supported in sandbox'); },
         };
-      }
+      };
+      })();
 
       const sim = (() => {
         const broker = __brokerRef;
@@ -408,7 +413,7 @@ async function executeCode(request, executionId) {
       const undefined_globals = [
         'Isolate', 'Context', 'Script', 'Module', 'Callback', 'Reference',
         'ExternalCopy', 'process', 'require', 'module', 'exports', '__dirname', '__filename',
-        '__brokerRef', '__broker', '__callSimBroker'
+        '__fetchRef', '__brokerRef', '__broker', '__callSimBroker'
       ];
       for (const name of undefined_globals) {
         try {