fix(security): RQ-2426 — sandbox rule code (QuickJS-WASM)

dist/components/proxy-middleware/rule_action_processor/processors/modify_request_processor.js

@@ -25,16 +25,9 @@ const modify_request = (ctx, new_req) => {
         ctx.rq_request_body = new_req;
 };
 const modify_request_using_code = async (action, ctx) => {
-    let userFunction = null;
-    try {
-        userFunction = (0, utils_2.getFunctionFromString)(action.request);
-    }
-    catch (error) {
-        // User has provided an invalid function
-        return modify_request(ctx, "Can't parse Requestly function. Please recheck. Error Code 7201. Actual Error: " +
-            error.message);
-    }
-    if (!userFunction || typeof userFunction !== "function") {
+    // RQ-2426: validate the function source parses (compile-only, no execution)
+    // before running it in the sandboxed worker.
+    if (!(await (0, utils_2.isValidFunctionString)(action.request))) {
         // User has provided an invalid function
         return modify_request(ctx, "Can't parse Requestly function. Please recheck. Error Code 944.");
     }
@@ -58,7 +51,7 @@ const modify_request_using_code = async (action, ctx) => {
         catch (_a) {
             /*Do nothing -- could not parse body as JSON */
         }
-        finalRequest = await (0, utils_2.executeUserFunction)(ctx, userFunction, args);
+        finalRequest = await (0, utils_2.executeUserFunction)(ctx, action.request, args);
         if (finalRequest && typeof finalRequest === "string") {
             return modify_request(ctx, finalRequest);
         }

dist/components/proxy-middleware/rule_action_processor/processors/modify_response_processor.js

@@ -103,16 +103,9 @@ const modify_response_using_local = (action, ctx) => {
 };
 const modify_response_using_code = async (action, ctx) => {
     var _a, _b, _c, _d;
-    let userFunction = null;
-    try {
-        userFunction = (0, utils_2.getFunctionFromString)(action.response);
-    }
-    catch (error) {
-        // User has provided an invalid function
-        return modify_response(ctx, "Can't parse Requestly function. Please recheck. Error Code 7201. Actual Error: " +
-            error.message);
-    }
-    if (!userFunction || typeof userFunction !== "function") {
+    // RQ-2426: validate the function source parses (compile-only, no execution)
+    // before running it in the sandboxed worker.
+    if (!(await (0, utils_2.isValidFunctionString)(action.response))) {
         // User has provided an invalid function
         return modify_response(ctx, "Can't parse Requestly function. Please recheck. Error Code 944.");
     }

dist/utils/index.d.ts

@@ -1,2 +1,9 @@
-export declare const getFunctionFromString: (functionStringEscaped: any) => any;
+/**
+ * Verify a rule's code string parses WITHOUT executing it. Constructing
+ * `new Function(body)` compiles/parses the body but never runs it (the function
+ * is never called), so even an IIFE-shaped string cannot execute here. Avoids the
+ * `vm` module (unsupported in Electron's renderer); the sandboxed execution
+ * happens inside QuickJS.
+ */
+export declare const isValidFunctionString: (functionStringEscaped: string) => Promise<boolean>;
 export declare function executeUserFunction(ctx: any, functionString: string, args: any): Promise<any>;

dist/utils/sandbox-globals.d.ts

@@ -0,0 +1,14 @@
+/**
+ * sandbox-globals — the JavaScript SOURCE that runs INSIDE the QuickJS guest realm
+ * (split out of utils/index.ts for readability/debuggability). These are plain
+ * strings injected into the sandbox; nothing here executes in the host. index.ts
+ * owns the host side (module/context lifecycle, the crypto/fetch bridges, the
+ * pump loop). Three blocks, concatenated in this order by executeUserFunction:
+ *   SANDBOX_POLYFILLS  — pure-JS web/Node global shims (URL, encoding, clone…)
+ *   SANDBOX_BRIDGE_SHIMS — guest halves of the host bridges (crypto, fetch, require)
+ *   SANDBOX_SETUP      — console/atob/btoa + args/$sharedState/__OUTPUT wiring
+ */
+export declare const SANDBOX_SETUP: string;
+export declare const SANDBOX_POLYFILLS: string;
+export declare const SANDBOX_BRIDGE_SHIMS: string;
+export declare const SANDBOX_EXTRA_SHIMS: string;

package.json

@@ -27,6 +27,7 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
+    "@jitl/quickjs-singlefile-cjs-release-sync": "^0.32.0",
     "@requestly/requestly-core": "1.1.1",
     "@sentry/browser": "^8.33.1",
     "async": "^3.2.5",
@@ -39,6 +40,7 @@
     "mime-types": "^2.1.35",
     "mkdirp": "^0.5.5",
     "node-forge": "^1.3.0",
+    "quickjs-emscripten-core": "^0.32.0",
     "semaphore": "^1.1.0",
     "ua-parser-js": "^1.0.37",
     "url": "^0.11.3",

src/components/proxy-middleware/rule_action_processor/processors/modify_request_processor.js

@@ -5,7 +5,7 @@ import {
 } from "@requestly/requestly-core";
 import { get_request_url } from "../../helpers/proxy_ctx_helper";
 import { build_action_processor_response } from "../utils";
-import { executeUserFunction, getFunctionFromString } from "../../../../utils";
+import { executeUserFunction, isValidFunctionString } from "../../../../utils";
 
 const process_modify_request_action = (action, ctx) => {
   const allowed_handlers = [PROXY_HANDLER_TYPE.ON_REQUEST_END];
@@ -31,19 +31,9 @@ const modify_request = (ctx, new_req) => {
 };
 
 const modify_request_using_code = async (action, ctx) => {
-  let userFunction = null;
-  try {
-    userFunction = getFunctionFromString(action.request);
-  } catch (error) {
-    // User has provided an invalid function
-    return modify_request(
-      ctx,
-      "Can't parse Requestly function. Please recheck. Error Code 7201. Actual Error: " +
-        error.message
-    );
-  }
-
-  if (!userFunction || typeof userFunction !== "function") {
+  // RQ-2426: validate the function source parses (compile-only, no execution)
+  // before running it in the sandboxed worker.
+  if (!(await isValidFunctionString(action.request))) {
     // User has provided an invalid function
     return modify_request(
       ctx,
@@ -73,7 +63,7 @@ const modify_request_using_code = async (action, ctx) => {
       /*Do nothing -- could not parse body as JSON */
     }
 
-    finalRequest = await executeUserFunction(ctx, userFunction, args)
+    finalRequest = await executeUserFunction(ctx, action.request, args)
 
     if (finalRequest && typeof finalRequest === "string") {
       return modify_request(ctx, finalRequest);

src/components/proxy-middleware/rule_action_processor/processors/modify_response_processor.js

@@ -6,7 +6,7 @@ import {
 import { getResponseContentTypeHeader, getResponseHeaders, get_request_url } from "../../helpers/proxy_ctx_helper";
 import { build_action_processor_response, build_post_process_data, get_file_contents } from "../utils";
 import { getContentType, parseJsonBody } from "../../helpers/http_helpers";
-import { executeUserFunction, getFunctionFromString } from "../../../../utils";
+import { executeUserFunction, isValidFunctionString } from "../../../../utils";
 import { RQ_INTERCEPTED_CONTENT_TYPES_REGEX } from "../../constants";
 
 const process_modify_response_action = async (action, ctx) => {
@@ -123,19 +123,9 @@ const modify_response_using_local = (action, ctx) => {
 };
 
 const modify_response_using_code = async (action, ctx) => {
-  let userFunction = null;
-  try {
-    userFunction = getFunctionFromString(action.response);
-  } catch (error) {
-    // User has provided an invalid function
-    return modify_response(
-      ctx,
-      "Can't parse Requestly function. Please recheck. Error Code 7201. Actual Error: " +
-        error.message
-    );
-  }
-
-  if (!userFunction || typeof userFunction !== "function") {
+  // RQ-2426: validate the function source parses (compile-only, no execution)
+  // before running it in the sandboxed worker.
+  if (!(await isValidFunctionString(action.response))) {
     // User has provided an invalid function
     return modify_response(
       ctx,