Buffer the bounded R2 runtime artifact

Author: chubes4

packages/runtime-cloudflare/src/wordpress-runtime-artifact.ts

@@ -3,8 +3,8 @@ import { isWordPressRuntimeFile } from "./wordpress-runtime-corpus.js"
 
 export const WORDPRESS_RUNTIME_ARTIFACT_SCHEMA = "wp-codebox/wordpress-runtime-artifact/v1"
 export const WORDPRESS_RUNTIME_MAX_FILES = 2_000
-export const WORDPRESS_RUNTIME_MAX_UNCOMPRESSED_BYTES = 32 * 1024 * 1024
-export const WORDPRESS_RUNTIME_MAX_ARCHIVE_BYTES = 32 * 1024 * 1024
+export const WORDPRESS_RUNTIME_MAX_UNCOMPRESSED_BYTES = 24 * 1024 * 1024
+export const WORDPRESS_RUNTIME_MAX_ARCHIVE_BYTES = 8 * 1024 * 1024
 export const WORDPRESS_RUNTIME_MAX_FILE_BYTES = 8 * 1024 * 1024
 
 export interface WordPressRuntimeArtifactManifest {
@@ -46,14 +46,16 @@ export async function materializeWordPressRuntimeArtifact(php: RuntimeMemfs, buc
   validateWordPressRuntimeArtifactManifest(manifest)
   const object = await bucket.get(manifest.key)
   if (!object) throw new Error(`WordPress runtime artifact is unavailable: ${manifest.key}`)
+  if (object.size > WORDPRESS_RUNTIME_MAX_ARCHIVE_BYTES) throw new Error("WordPress runtime artifact archive exceeds its size budget.")
   if (object.size !== manifest.archive.size) throw new Error("WordPress runtime artifact size does not match its manifest.")
 
-  const [hashBody, zipBody] = object.body.tee()
-  const archiveHash = sha256ReadableStream(hashBody)
+  // The archive and expanded corpus caps leave most of the 128 MiB isolate for PHP-WASM and runtime overhead.
+  const archiveBytes = new Uint8Array(await object.arrayBuffer())
+  if (await sha256Hex(archiveBytes) !== manifest.archive.sha256) throw new Error("WordPress runtime artifact archive hash does not match its manifest.")
   const expected = new Map(manifest.files.map((file) => [file.path, file]))
   let materializedFiles = 0
   let materializedBytes = 0
-  for await (const entry of decodeZip(zipBody)) {
+  for await (const entry of decodeZip(new Blob([archiveBytes]).stream())) {
     const file = expected.get(entry.name)
     if (!file) throw new Error(`WordPress runtime artifact contains an unexpected file: ${entry.name}`)
     const bytes = new Uint8Array(await entry.arrayBuffer())
@@ -66,7 +68,6 @@ export async function materializeWordPressRuntimeArtifact(php: RuntimeMemfs, buc
     php.writeFile(destination, bytes)
     expected.delete(entry.name)
   }
-  if (await archiveHash !== manifest.archive.sha256) throw new Error("WordPress runtime artifact archive hash does not match its manifest.")
   if (expected.size) throw new Error("WordPress runtime artifact is missing manifest files.")
   return { materializedFiles, materializedBytes }
 }
@@ -75,23 +76,6 @@ function isSafeRuntimePath(path: string): boolean {
   return path.startsWith("wordpress/") && !path.includes("\\") && !path.split("/").some((segment) => !segment || segment === "." || segment === "..")
 }
 
-async function sha256ReadableStream(stream: ReadableStream): Promise<string> {
-  const chunks: Uint8Array[] = []
-  let size = 0
-  for await (const chunk of stream as AsyncIterable<Uint8Array>) {
-    size += chunk.byteLength
-    if (size > WORDPRESS_RUNTIME_MAX_ARCHIVE_BYTES) throw new Error("WordPress runtime artifact archive exceeds its size budget.")
-    chunks.push(chunk)
-  }
-  const bytes = new Uint8Array(size)
-  let offset = 0
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset)
-    offset += chunk.byteLength
-  }
-  return sha256Hex(bytes)
-}
-
 async function sha256Hex(bytes: Uint8Array): Promise<string> {
   const digest = await crypto.subtle.digest("SHA-256", Uint8Array.from(bytes).buffer)
   return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")

tests/cloudflare-runtime.test.ts

@@ -221,14 +221,26 @@ test("WordPress runtime artifacts are content-addressed and reject unavailable o
   }
   const writes = new Map<string, Uint8Array>()
   const php = { mkdir: () => {}, writeFile: (path: string, bytes: Uint8Array) => writes.set(path, bytes) }
-  const bucket = (bytes: Uint8Array | null) => ({ get: async () => bytes === null ? null : { size: bytes.byteLength, body: new Blob([bytes]).stream() } })
+  let arrayBufferReads = 0
+  const bucket = (bytes: Uint8Array | null) => ({ get: async () => bytes === null ? null : {
+    size: bytes.byteLength,
+    // R2 supplies both helpers. Reading body would fail this production-shaped mock.
+    body: new ReadableStream({ pull: (controller) => controller.error(new Error("R2 body stream should not be read directly.")) }),
+    arrayBuffer: async () => {
+      arrayBufferReads++
+      return new Blob([bytes]).arrayBuffer()
+    },
+  } })
 
   await assert.rejects(materializeWordPressRuntimeArtifact(php, bucket(null) as never, manifest), /unavailable/)
   await assert.rejects(materializeWordPressRuntimeArtifact(php, bucket(new Uint8Array([...archive, 0])) as never, manifest), /size does not match/)
-  const corrupted = archive.slice()
-  corrupted[100] ^= 1
-  await assert.rejects(materializeWordPressRuntimeArtifact(php, bucket(corrupted) as never, manifest), /validation failed|archive hash/)
+  const oversized = { get: async () => ({ size: 33 * 1024 * 1024, body: new ReadableStream(), arrayBuffer: async () => { throw new Error("oversized archive must not be read") } }) }
+  await assert.rejects(materializeWordPressRuntimeArtifact(php, oversized as never, manifest), /exceeds its size budget/)
+  const hashCorruptManifest = { ...manifest, key: wordpressRuntimeArtifactKey("a".repeat(64)), archive: { ...manifest.archive, sha256: "a".repeat(64) } }
+  await assert.rejects(materializeWordPressRuntimeArtifact(php, bucket(archive) as never, hashCorruptManifest), /archive hash does not match/)
+  assert.equal(writes.size, 0, "hash-corrupt archives fail before extraction")
   const evidence = await materializeWordPressRuntimeArtifact(php, bucket(archive) as never, manifest)
+  assert.equal(arrayBufferReads, 2, "valid and hash-corrupt archives use R2 arrayBuffer()")
   assert.deepEqual(evidence, { materializedFiles: 1, materializedBytes: source.byteLength })
   assert.deepEqual(writes.get("/wordpress/wp-includes/version.php"), source)
 })
@@ -253,7 +265,7 @@ test("WordPress runtime corpus generator keeps the ZIP outside the Worker bundle
   assert.match(generator, /encodeZip\(selected\)/)
   assert.match(generator, /lastModified: 0/)
   assert.match(generator, /artifacts\/cloudflare-wordpress-runtime-corpus\.zip/)
-  assert.match(artifact, /decodeZip\(zipBody\)/)
+  assert.match(artifact, /decodeZip\(new Blob\(\[archiveBytes\]\)\.stream\(\)\)/)
   assert.equal(manifest.key, wordpressRuntimeArtifactKey(manifest.archive.sha256))
   assert.ok(manifest.files.length > 0)
 })