Overhaul OP whitelist

rscarson · rscarson · commit 13b9429d7c6c · 2025-08-17T14:43:02.000-04:00
diff --git a/.github/workflows/op_whitelist.yml b/.github/workflows/op_whitelist.yml
@@ -1,20 +1,19 @@
 name: Sandbox integrity checks
 on:
   push:
-    branches: [ master ]
+    branches: [master]
   pull_request:
-    branches: [ master ]
+    branches: [master]
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-    - name: Run whitelist check for default-feature provided ops
-      run: cargo test --lib -- test::check_op_whitelist --exact --show-output  
+      - name: Run whitelist check for default-feature provided ops
+        run: cargo run --example op_whitelist --features op_whitelist
diff --git a/Cargo.toml b/Cargo.toml
@@ -148,6 +148,10 @@ snapshot_builder = []
 # Enables the threaded worker API
 worker = []
 
+# Grants access to op_whitelist::get_whitelist
+# Used in CI to prevent vulnerabilities!
+op_whitelist = []
+
 #
 # End of feature definitions
 #
@@ -291,6 +295,10 @@ required-features = ["node_experimental"]
 name = "background_tasks"
 required-features = ["web"]
 
+[[example]]
+name = "op_whitelist"
+required-features = ["op_whitelist"]
+
 [[bench]]
 name = "runtime"
 harness = false
diff --git a/examples/async_eval.rs b/examples/async_eval.rs
@@ -1,7 +1,7 @@
-///
-/// This example shows how to use `Runtime::eval` to run async code
-/// Note that there is no support for top-level await but you can use `Promise` to work around this
-///
+//!
+//! This example shows how to use `Runtime::eval` to run async code
+//! Note that there is no support for top-level await but you can use `Promise` to work around this
+//!
 use rustyscript::{js_value::Promise, Error, Runtime};
 
 fn main() -> Result<(), Error> {
diff --git a/examples/async_javascript.rs b/examples/async_javascript.rs
@@ -1,13 +1,13 @@
-///
-/// This example shows the use of async functions in JS
-///
-/// Here we have a module with 4 async functions that resolve after a given time
-/// We call them in sequence and await the results
-///
-/// Notes:
-/// - When using the async variants of the functions it is important to complete the JS event loop with [Runtime::await_event_loop]
-/// - Async variants will wait for the function's return value to resolve, but will not wait for the event loop to complete
-///
+//!
+//! This example shows the use of async functions in JS
+//!
+//! Here we have a module with 4 async functions that resolve after a given time
+//! We call them in sequence and await the results
+//!
+//! Notes:
+//! - When using the async variants of the functions it is important to complete the JS event loop with [Runtime::await_event_loop]
+//! - Async variants will wait for the function's return value to resolve, but will not wait for the event loop to complete
+//!
 use rustyscript::{js_value::Promise, json_args, Error, Module, Runtime};
 
 fn main() -> Result<(), Error> {
diff --git a/examples/background_tasks.rs b/examples/background_tasks.rs
@@ -1,10 +1,10 @@
+//!
+//! This example the use of async module loading, and the handing of ongoing
+//! background tasks.
+//!
 use std::time::Duration;
 
 use deno_core::PollEventLoopOptions;
-///
-/// This example the use of async module loading, and the handing of ongoing
-/// background tasks.
-///
 use rustyscript::{Error, Module, ModuleHandle, Runtime, RuntimeOptions};
 
 fn main() -> Result<(), Error> {
diff --git a/examples/call_rust_from_js.rs b/examples/call_rust_from_js.rs
@@ -1,7 +1,7 @@
-///
-/// This example is meant to demonstrate the use of the runtime state, as well as the
-/// registration of rust functions that are callable from JS
-///
+//!
+//! This example is meant to demonstrate the use of the runtime state, as well as the
+//! registration of rust functions that are callable from JS
+//!
 use rustyscript::{async_callback, serde_json, sync_callback, Error, Module, Runtime};
 
 fn main() -> Result<(), Error> {
diff --git a/examples/create_snapshot.rs b/examples/create_snapshot.rs
@@ -1,12 +1,13 @@
-///
-/// This example demonstrates how to create a snapshot from a module and save it to a file.
-/// Snapshots can be used to massively decrease the startup time of a Runtime instance (15ms -> 3ms) by pre-loading
-/// extensions and modules into the runtime state before it is created. A snapshot can be used on any runtime with
-/// the same set of extensions and options as the runtime that created it.
-///
-use rustyscript::{Error, Module, SnapshotBuilder};
+//!
+//! This example demonstrates how to create a snapshot from a module and save it to a file.
+//! Snapshots can be used to massively decrease the startup time of a Runtime instance (15ms -> 3ms) by pre-loading
+//! extensions and modules into the runtime state before it is created. A snapshot can be used on any runtime with
+//! the same set of extensions and options as the runtime that created it.
+//!
 use std::fs;
 
+use rustyscript::{Error, Module, SnapshotBuilder};
+
 fn main() -> Result<(), Error> {
     // A module we want pre-loaded into the snapshot
     let module = Module::new(
diff --git a/examples/custom_runtimes.rs b/examples/custom_runtimes.rs
@@ -1,16 +1,16 @@
-///
-/// This example demonstrates extending Runtime to inline your own extensions and modules
-/// as well as enforce values for the Runtime's options
-///
-/// This example creates a runtime which will timeout after 0.5s, imports an exension,
-/// And ensures that a preset module is always available for import.
-///
-/// Extensions like the one being used (see examples/ext/example_extension.rs)
-/// allow you to call rust code from within JS
-///
-/// Extensions consist of a set of #[op2] functions, an extension! macro,
-/// and one or more optional JS modules.
-///
+//!
+//! This example demonstrates extending Runtime to inline your own extensions and modules
+//! as well as enforce values for the Runtime's options
+//!
+//! This example creates a runtime which will timeout after 0.5s, imports an exension,
+//! And ensures that a preset module is always available for import.
+//!
+//! Extensions like the one being used (see examples/ext/example_extension.rs)
+//! allow you to call rust code from within JS
+//!
+//! Extensions consist of a set of #[op2] functions, an extension! macro,
+//! and one or more optional JS modules.
+//!
 use rustyscript::{module, Error, Module, ModuleHandle, Runtime, RuntimeOptions};
 use std::time::Duration;
 
diff --git a/examples/custom_threaded_worker.rs b/examples/custom_threaded_worker.rs
@@ -1,8 +1,8 @@
+//!
+//! This example shows how to use the threaded worker feature using a custom implementation of a worker
+//! We will create a basic worker implementation able to execute snippets of non-emca JS
+//!
 use deno_core::serde_json;
-///
-/// This example shows how to use the threaded worker feature using a custom implementation of a worker
-/// We will create a basic worker implementation able to execute snippets of non-emca JS
-///
 use rustyscript::{
     worker::{InnerWorker, Worker},
     Error, Runtime,
diff --git a/examples/default_threaded_worker.rs b/examples/default_threaded_worker.rs
@@ -1,7 +1,7 @@
-///
-/// This example shows how to use the threaded worker feature using the default worker implementation
-/// In this example we load a module, and execute a function from it
-///
+//!
+//! This example shows how to use the threaded worker feature using the default worker implementation
+//! In this example we load a module, and execute a function from it
+//!
 use rustyscript::{worker::DefaultWorker, Error, Module};
 
 fn main() -> Result<(), Error> {
diff --git a/examples/entrypoint_functions.rs b/examples/entrypoint_functions.rs
@@ -1,13 +1,13 @@
-///
-/// This example is meant to demonstrate the basic usage of entrypoint functions
-///
-/// A module can optionally have an entrypoint function (that can return a value and accept args)
-/// which can be called from rust on load.
-///
-/// The same effect can be achieved by calling a function later, so they are optional
-/// They are most useful in the context of Runtime::execute_module, which can be seen
-/// in the 'hello_world' example.
-///
+//!
+//! This example is meant to demonstrate the basic usage of entrypoint functions
+//!
+//! A module can optionally have an entrypoint function (that can return a value and accept args)
+//! which can be called from rust on load.
+//!
+//! The same effect can be achieved by calling a function later, so they are optional
+//! They are most useful in the context of Runtime::execute_module, which can be seen
+//! in the 'hello_world' example.
+//!
 use rustyscript::{json_args, Error, Module, Runtime, RuntimeOptions, Undefined};
 
 fn main() -> Result<(), Error> {
diff --git a/examples/functions_and_values.rs b/examples/functions_and_values.rs
@@ -1,10 +1,10 @@
-///
-/// This example demonstrates how to extract values, and call functions
-/// from rust into JS
-///
-/// The sample below extracts a value which is deserialized to a custom struct
-/// as well as calling a function in JS from rust
-///
+//!
+//! This example demonstrates how to extract values, and call functions
+//! from rust into JS
+//!
+//! The sample below extracts a value which is deserialized to a custom struct
+//! as well as calling a function in JS from rust
+//!
 use rustyscript::{deno_core::serde::Deserialize, json_args, Error, Module, Runtime};
 
 #[derive(PartialEq, Debug, Deserialize)]
diff --git a/examples/hello_world.rs b/examples/hello_world.rs
@@ -1,18 +1,18 @@
-///
-/// This example shows a basic usage of the runtime
-///
-/// The call to Runtime::execute_module is a one liner which:
-/// - Creates a new runtime with the given options
-/// - Loads the modules passed in
-/// - Calls the module's entrypoint function
-///     - Either a default passed as an option
-///     - Or the module's default export
-///     - Or a call in JS to rustyscript.register_entrypoint
-/// - Returns the result
-///
-/// Instead of just vec![], one could pass in other JS modules
-/// which could be imported using `import './filename.js';`
-///
+//!
+//! This example shows a basic usage of the runtime
+//!
+//! The call to Runtime::execute_module is a one liner which:
+//! - Creates a new runtime with the given options
+//! - Loads the modules passed in
+//! - Calls the module's entrypoint function
+//!     - Either a default passed as an option
+//!     - Or the module's default export
+//!     - Or a call in JS to rustyscript.register_entrypoint
+//! - Returns the result
+//!
+//! Instead of just vec![], one could pass in other JS modules
+//! which could be imported using `import './filename.js';`
+//!
 use rustyscript::{json_args, Error, Module, Runtime};
 
 fn main() -> Result<(), Error> {
diff --git a/examples/interactive_prompt.rs b/examples/interactive_prompt.rs
@@ -1,3 +1,6 @@
+//!
+//! This example demonstrates an interactive prompt for evaluating JavaScript expressions
+//!
 use rustyscript::{Runtime, RuntimeOptions};
 
 fn main() {
diff --git a/examples/max_heap_size.rs b/examples/max_heap_size.rs
@@ -1,8 +1,8 @@
-///
-/// This example shows how to set the maximum heap size for the V8 isolate.
-/// This is useful when you want to limit the amount of memory a script can consume.
-/// A `HeapExhausted` error will be returned if the script exceeds the limit.
-///
+//!
+//! This example shows how to set the maximum heap size for the V8 isolate.
+//! This is useful when you want to limit the amount of memory a script can consume.
+//! A `HeapExhausted` error will be returned if the script exceeds the limit.
+//!
 use rustyscript::{Error, Module, Runtime, RuntimeOptions};
 
 fn main() -> Result<(), Error> {
diff --git a/examples/module_import.rs b/examples/module_import.rs
@@ -1,10 +1,10 @@
-///
-/// This example is meant to demonstrate the use of the import utility
-///
-/// It acts as a wrapper around a runtime with a single loaded module
-/// and is meant to simplify usecases where multiple JS sources isn't
-/// needed
-///
+//!
+//! This example is meant to demonstrate the use of the import utility
+//!
+//! It acts as a wrapper around a runtime with a single loaded module
+//! and is meant to simplify usecases where multiple JS sources isn't
+//! needed
+//!
 use rustyscript::{js_value::Function, json_args, Error, Undefined};
 
 fn main() -> Result<(), Error> {
diff --git a/examples/multiple_modules.rs b/examples/multiple_modules.rs
@@ -1,3 +1,6 @@
+//!
+//! This example demonstrates the use of multiple modules in rustyscript, in a single runtime
+//!
 use rustyscript::{json_args, module, Error, Module, Runtime, RuntimeOptions, Undefined};
 
 // This time we will embed this module into the executable directly.
diff --git a/examples/op_whitelist.rs b/examples/op_whitelist.rs
@@ -0,0 +1,23 @@
+//!
+//! This example shows the `op_whitelist` feature; a security mechanism allowing CI to catch sandbox-breaking OPs before releases
+//!
+use rustyscript::{op_whitelist::get_whitelist, Error, Runtime, RuntimeOptions};
+
+fn main() -> Result<(), Error> {
+    let mut runtime = Runtime::new(RuntimeOptions::default())?;
+    let whitelist = get_whitelist();
+
+    let unsafe_ops = whitelist.unsafe_ops(&mut runtime);
+    if !unsafe_ops.is_empty() {
+        eprintln!("Found {} unsafe ops:", unsafe_ops.len());
+        for op in unsafe_ops {
+            eprintln!(" - {}", op);
+        }
+
+        eprintln!("Please review and stub or whitelist this above!");
+        std::process::exit(1);
+    }
+
+    println!("No unsafe ops found!");
+    Ok(())
+}
diff --git a/examples/runtime_extensions.rs b/examples/runtime_extensions.rs
@@ -1,12 +1,12 @@
-///
-/// This example shows how to add deno_core extensions into the runtime.
-///
-/// Extensions like the one being used (see examples/ext/example_extension.rs)
-/// allow you to call rust code from within JS
-///
-/// Extensions consist of a set of #[op2] functions, an extension! macro,
-/// and one or more optional JS modules.
-///
+//!
+//! This example shows how to add deno_core extensions into the runtime.
+//!
+//! Extensions like the one being used (see examples/ext/example_extension.rs)
+//! allow you to call rust code from within JS
+//!
+//! Extensions consist of a set of #[op2] functions, an extension! macro,
+//! and one or more optional JS modules.
+//!
 use rustyscript::{Error, Module, Runtime, RuntimeOptions};
 use std::collections::HashSet;
 
diff --git a/examples/serialized_types.rs b/examples/serialized_types.rs
@@ -1,7 +1,7 @@
-///
-/// This example is meant to demonstrate sending and receiving custom types
-/// between JS and rust
-///
+//!
+//! This example is meant to demonstrate sending and receiving custom types
+//! between JS and rust
+//!
 use rustyscript::{module, Error, Module, ModuleWrapper};
 use serde::{Deserialize, Serialize};
 
diff --git a/examples/thread_safety.rs b/examples/thread_safety.rs
@@ -1,11 +1,11 @@
-///
-/// rustyscript is not thread-safe
-/// This is due to a limitation of the underlying engine, deno_core
-/// However, rustyscript provides a mechanism to safely use it in a static context
-///
-/// See `examples/default_threaded_worker` and `examples/custom_threaded_worker`
-/// for a more flexible way to run rustyscript in a threaded environment
-///
+//!
+//! rustyscript is not thread-safe
+//! This is due to a limitation of the underlying engine, deno_core
+//! However, rustyscript provides a mechanism to safely use it in a static context
+//!
+//! See `examples/default_threaded_worker` and `examples/custom_threaded_worker`
+//! for a more flexible way to run rustyscript in a threaded environment
+//!
 use rustyscript::{module, static_runtime, Error, Module, RuntimeOptions};
 use std::time::Duration;
 
diff --git a/examples/typescript_modules.rs b/examples/typescript_modules.rs
diff --git a/examples/url_import.rs b/examples/url_import.rs
diff --git a/examples/web_features.rs b/examples/web_features.rs
diff --git a/examples/websocket.rs b/examples/websocket.rs
diff --git a/examples/worker_pool.rs b/examples/worker_pool.rs
diff --git a/src/lib.rs b/src/lib.rs
diff --git a/src/op_whitelist.js b/src/op_whitelist.js
diff --git a/src/op_whitelist.rs b/src/op_whitelist.rs
