avoid mjs for now, inject map, Buffer is node-only

.github/workflows/snyk-scan.yml

@@ -25,8 +25,6 @@ jobs:
       github.event.pull_request.author_association == 'OWNER' )
     steps:
       - uses: actions/checkout@v6
-      - name: Install Google Cloud Storage
-        run: composer require --no-update google/cloud-storage && composer update --no-dev
       - name: Run Snyk to check for vulnerabilities
         uses: snyk/actions/php@master
         continue-on-error: true # To make sure that SARIF upload gets called

.github/workflows/test-results.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
        - name: Download and Extract Artifacts
-         uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732
+         uses: dawidd6/action-download-artifact@8a338493df3d275e4a7a63bcff3b8fe97e51a927
          with:
           run_id: ${{ github.event.workflow_run.id }}
           path: artifacts

CHANGELOG.md

@@ -4,7 +4,7 @@
 * ADDED: Translations for Swedish & Persian
 * CHANGED: Deduplicate JSON error message translations
 * CHANGED: Refactored translation of exception messages
-* CHANGED: Upgrading libraries to: DOMpurify 3.3.2, ip-lib 1.22.0 & polyfill-php80 1.33.0
+* CHANGED: Upgrading libraries to: DOMpurify 3.3.2, ip-lib 1.22.0, polyfill-php80 1.33.0 & zlib 1.3.2
 * FIXED: Some exceptions not getting translated
 * FIXED: Attachment disappears after a "paste" in the message area (#1731)
 * FIXED: The content format is not reset when creating a new document (#1707)

js/common.js

@@ -10,7 +10,7 @@ global.WebCrypto = require('@peculiar/webcrypto').Crypto;
 
 // application libraries to test
 global.$ = global.jQuery = require('./jquery-3.7.1');
-global.zlib = require('./zlib-1.3.1-2').zlib;
+global.zlib = require('./zlib').zlib;
 require('./prettify');
 global.prettyPrint = window.PR.prettyPrint;
 global.prettyPrintOne = window.PR.prettyPrintOne;

js/eslint.config.js

@@ -1,7 +1,7 @@
 const globals = require('globals');
 const { globalIgnores } = require('eslint/config')
 
-module.exports = [globalIgnores(["./*.js", "!./privatebin.js"]), {
+module.exports = [globalIgnores(["./*.*js", "!./privatebin.js"]), {
     languageOptions: {
         globals: {
             ...globals.amd,

js/zlib.js

@@ -9,37 +9,22 @@
         const COMPRESSION_LEVEL = 7;
         const NO_ZLIB_HEADER = -1;
         const CHUNK_SIZE = 32 * 1024;
-        const map = {};
-        const memory = new WebAssembly.Memory({
-            initial: 1,
-            maximum: 1024, // 64MB
-        });
-        const env = {
-            memory,
-            writeToJs(ptr, size) {
-                const o = map[ptr];
-                o.onData(new Uint8Array(memory.buffer, dstPtr, size));
-            },
-            _abort: errno => { console.error(`Error: ${errno}`) },
-            _grow: () => { },
-        };
-        const ins = (await WebAssembly.instantiateStreaming(fetch('js/zlib-1.3.1.wasm'), { env })).instance;
-
-        const srcPtr = ins.exports._malloc(CHUNK_SIZE);
-        const dstPtr = ins.exports._malloc(CHUNK_SIZE);
+        const createModule = (await import('./zlib-1.3.2.js')).default;
+        const Module = await createModule({map: {}});
+        const srcPtr = Module.__malloc(CHUNK_SIZE);
+        const dstPtr = Module.__malloc(CHUNK_SIZE);
 
         class RawDef {
             constructor() {
-                this.zstreamPtr = ins.exports._createDeflateContext(COMPRESSION_LEVEL, NO_ZLIB_HEADER);
-                map[this.zstreamPtr] = this;
+                this.zstreamPtr = Module.__createDeflateContext(COMPRESSION_LEVEL, NO_ZLIB_HEADER);
+                Module.map[this.zstreamPtr] = this;
                 this.offset = 0;
                 this.buff = new Uint8Array(CHUNK_SIZE);
             }
 
             deflate(chunk, flush) {
-                const src = new Uint8Array(memory.buffer, srcPtr, chunk.length);
-                src.set(chunk);
-                ins.exports._deflate(this.zstreamPtr, srcPtr, dstPtr, chunk.length, CHUNK_SIZE, flush);
+                Module.HEAPU8.set(chunk, srcPtr);
+                Module.__deflate(this.zstreamPtr, srcPtr, dstPtr, chunk.length, CHUNK_SIZE, flush);
             }
 
             onData(chunk) {
@@ -53,32 +38,27 @@
             }
 
             destroy() {
-                ins.exports._freeDeflateContext(this.zstreamPtr);
-                delete map[this.zstreamPtr];
+                Module.__freeDeflateContext(this.zstreamPtr);
+                delete Module.map[this.zstreamPtr];
                 this.buff = null;
             }
 
             getBuffer() {
-                const res = new Uint8Array(this.offset);
-                for (let i = 0; i < this.offset; ++i) {
-                    res[i] = this.buff[i];
-                }
-                return res;
+                return this.buff.slice(0, this.offset);
             }
         }
 
         class RawInf {
             constructor() {
-                this.zstreamPtr = ins.exports._createInflateContext(NO_ZLIB_HEADER);
-                map[this.zstreamPtr] = this;
+                this.zstreamPtr = Module.__createInflateContext(NO_ZLIB_HEADER);
+                Module.map[this.zstreamPtr] = this;
                 this.offset = 0;
                 this.buff = new Uint8Array(CHUNK_SIZE);
             }
 
             inflate(chunk) {
-                const src = new Uint8Array(memory.buffer, srcPtr, chunk.length);
-                src.set(chunk);
-                ins.exports._inflate(this.zstreamPtr, srcPtr, dstPtr, chunk.length, CHUNK_SIZE);
+                Module.HEAPU8.set(chunk, srcPtr);
+                Module.__inflate(this.zstreamPtr, srcPtr, dstPtr, chunk.length, CHUNK_SIZE);
             }
 
             onData(chunk) {
@@ -92,17 +72,13 @@
             }
 
             destroy() {
-                ins.exports._freeInflateContext(this.zstreamPtr);
-                delete map[this.zstreamPtr];
+                Module.__freeInflateContext(this.zstreamPtr);
+                delete Module.map[this.zstreamPtr];
                 this.buff = null;
             }
 
             getBuffer() {
-                const res = new Uint8Array(this.offset);
-                for (let i = 0; i < this.offset; ++i) {
-                    res[i] = this.buff[i];
-                }
-                return res;
+                return this.buff.slice(0, this.offset);
             }
         }
 

lib/Configuration.php

@@ -125,7 +125,8 @@ class Configuration
             'js/privatebin.js'       => 'sha512-6SwOJniNN8RBmAK7yCt4ly2qYyH8OALxB74/K1AJgw+YnZgRCfTDVq1qY1K5Y2QCxCODGGTpAjTqQRExzCqV7g==',
             'js/purify-3.3.2.js'     => 'sha512-I6igPVpf3xNghG92mujwqB6Zi3LpUTsni4bRuLnMThEGH6BDbsumv7373+AXHzA4OUlxGsym8ZxKFHy4xjYvkQ==',
             'js/showdown-2.1.0.js'   => 'sha512-WYXZgkTR0u/Y9SVIA4nTTOih0kXMEd8RRV6MLFdL6YU8ymhR528NLlYQt1nlJQbYz4EW+ZsS0fx1awhiQJme1Q==',
-            'js/zlib-1.3.1-2.js'     => 'sha512-4gT+v+BkBqdVBbKOO4qKGOAzuay+v1FmOLksS+bMgQ08Oo4xEb3X48Xq1Kv2b4HtiCQA7xq9dFRzxal7jmQI7w==',
+            'js/zlib-1.3.2.js'       => 'sha512-RAhJgxg9siMIA8ky4c10Rc2zUgnK80olHB8Tt1IOYWY4Eh1WmrviQkDn+sgBlb38ZHq3tzufGC41kP360gmosQ==',
+            'js/zlib.js'             => 'sha512-QOaEwssHqHRRcWJ2Un3Kl2Zhyprzl7T8zmsKN2FppFxW3VR+8UChYOx2iuL0HbXK42fuBWJm5PNQJxufulrt/w==',
         ),
     );
 

lib/View.php

@@ -62,6 +62,48 @@ class View
         include $path;
     }
 
+    /**
+     * get cache buster query string
+     *
+     * if the file isn't versioned (ends in a digit), adds our own version as a query string
+     *
+     * @access private
+     * @param  string $file
+     */
+    private function _getCacheBuster($file)
+    {
+        if ((bool) preg_match('#[0-9]\.m?js$#', (string) $file)) {
+            return '';
+        }
+        return '?' . rawurlencode($this->_variables['VERSION']);
+    }
+
+    /**
+     * get SRI hash for given file
+     *
+     * @access private
+     * @param  string $file
+     */
+    private function _getSri($file)
+    {
+        if (array_key_exists($file, $this->_variables['SRI'])) {
+            return ' integrity="' . $this->_variables['SRI'][$file] . '"';
+        }
+        return '';
+    }
+
+    /**
+     * echo module preload link tag incl. SRI hash for given script file
+     *
+     * @access private
+     * @param  string $file
+     */
+    private function _linkTag($file)
+    {
+        echo '<link rel="modulepreload" href="', $file,
+        $this->_getCacheBuster($file), '"', $this->_getSri($file), ' />', PHP_EOL;
+    }
+
     /**
      * echo script tag incl. SRI hash for given script file
      *
@@ -71,13 +113,9 @@ class View
      */
     private function _scriptTag($file, $attributes = '')
     {
-        $sri = array_key_exists($file, $this->_variables['SRI']) ?
-            ' integrity="' . $this->_variables['SRI'][$file] . '"' : '';
-        // if the file isn't versioned (ends in a digit), add our own version
-        $cacheBuster = (bool) preg_match('#[0-9]\.js$#', (string) $file) ?
-            '' : '?' . rawurlencode($this->_variables['VERSION']);
         echo '<script ', $attributes,
         ' type="text/javascript" data-cfasync="false" src="', $file,
-        $cacheBuster, '"', $sri, ' crossorigin="anonymous"></script>', PHP_EOL;
+        $this->_getCacheBuster($file), '"', $this->_getSri($file),
+        ' crossorigin="anonymous"></script>', PHP_EOL;
     }
 }

tpl/bootstrap.php

@@ -42,6 +42,7 @@ if ($SYNTAXHIGHLIGHTING) :
 endif;
 ?>
 		<noscript><link type="text/css" rel="stylesheet" href="css/noscript.css" /></noscript>
+		<?php $this->_linkTag('js/zlib-1.3.2.js'); ?>
 		<?php $this->_scriptTag('js/jquery-3.7.1.js', 'defer'); ?>
 <?php
 if ($QRCODE) :
@@ -50,7 +51,7 @@ if ($QRCODE) :
 <?php
 endif;
 ?>
-		<?php $this->_scriptTag('js/zlib-1.3.1-2.js', 'defer'); ?>
+		<?php $this->_scriptTag('js/zlib.js', 'defer'); ?>
 		<?php $this->_scriptTag('js/base-x-5.0.1.js', 'defer'); ?>
 		<?php $this->_scriptTag('js/bootstrap-3.4.1.js', 'defer'); ?>
 <?php

tpl/bootstrap5.php

@@ -25,6 +25,7 @@ if ($SYNTAXHIGHLIGHTING) :
 endif;
 ?>
 		<noscript><link type="text/css" rel="stylesheet" href="css/noscript.css" /></noscript>
+		<?php $this->_linkTag('js/zlib-1.3.2.js'); ?>
 		<?php $this->_scriptTag('js/jquery-3.7.1.js', 'defer'); ?>
 <?php
 if ($QRCODE) :
@@ -33,7 +34,7 @@ if ($QRCODE) :
 <?php
 endif;
 ?>
-		<?php $this->_scriptTag('js/zlib-1.3.1-2.js', 'defer'); ?>
+		<?php $this->_scriptTag('js/zlib.js', 'defer'); ?>
 		<?php $this->_scriptTag('js/base-x-5.0.1.js', 'defer'); ?>
 		<?php $this->_scriptTag('js/bootstrap-5.3.8.js', 'defer'); ?>
 		<?php $this->_scriptTag('js/dark-mode-switch.js', 'defer'); ?>

tst/Bootstrap.php

@@ -341,7 +341,7 @@ class Helper
      */
     public static function updateSubresourceIntegrity(): void
     {
-        foreach (new GlobIterator(PATH . 'js' . DIRECTORY_SEPARATOR . '*.js') as $file) {
+        foreach (new GlobIterator(PATH . 'js' . DIRECTORY_SEPARATOR . '*.*js') as $file) {
             if ($file->getBasename() === 'common.js' || $file->getBasename() === 'eslint.config.js') {
                 continue; // ignore JS unit test bootstrap
             }