fix(runtime): harden marshaling, release logging and remote loading

Marshaling (both the classic and napi engines):
- A pointer comes only from an External, a BigInt or null. A Number or string `handle` or
  `__native_ptr` is refused, since JSON can carry those: `{"handle": 1094795585}` passed to
  an Object parameter used to be AddRef'd as a COM pointer.
- Interface and class parameters QueryInterface every pointer, boxed primitives included, and
  no longer fall back to the raw pointer when that fails, so a string passed as a Uri can't be
  called through the wrong vtable. Delegate parameters accept JS delegates the runtime made and
  QueryInterface anything else; GenericMethodCall fails instead of calling a slot on the wrong
  interface.
- Shapes the call layout can't express (non-byte arrays, received arrays, array returns,
  structs larger than the return buffer, JS delegates taking arrays) fail at construction
  instead of corrupting the libffi call.
- Struct buffers must cover the struct, serialized structs are padded to their ABI size, and
  IReference<T> struct fields are pointer-sized.
- Buffer arguments are rechecked before the call, since parsing a later argument can run JS
  that detaches or resizes them.
- Only two-field wrappers are read as a DeclarationFFI, and URL accessors check their receiver,
  so a URL passed to WinRT or `instanceof` is no longer read as the wrong type.

Release builds keep app console output out of the Windows Event Log and the on-disk trace log,
and the trace log no longer falls back to a hardcoded user directory.

Remote modules: allowlist entries match by origin and path boundary rather than string
prefix, the response's final URL must also pass the gate after redirects, the gate reads the
entry's package.json for script entries too, and NSWinRT.dynamicImport goes through the native
loader. WebSocket subprotocols must be HTTP tokens and a message is capped at 100 MiB.

Also: crypto.getRandomValues and crypto.randomUUID backed by the OS RNG, and NSWinRT.win32.bind
loads a bare DLL name from the app directory and System32 only.

Author: triniwiz

packages/test/security-check.js

@@ -0,0 +1,65 @@
+// Standalone-engine check that untrusted-shaped values can't reach native code as pointers or
+// mistyped objects, and that the safe-looking APIs handle views, NULs and randomness correctly:
+//   nativescript-windows packages/test/security-check.js
+// Prints "security-check: N passed, M failed"; throws (nonzero exit) on any failure.
+'use strict';
+
+var pass = 0, fail = 0;
+function check(name, ok) {
+  if (ok) { pass += 1; }
+  else { fail += 1; console.error('FAIL ' + name); }
+}
+function throws(fn) {
+  try { fn(); } catch (_) { return true; }
+  return false;
+}
+
+// JSON can carry numbers and strings, which must never be read as native pointers.
+var ps = new Windows.Foundation.Collections.PropertySet();
+ps.Insert('ok', 'a string boxes fine');
+check('string boxes', ps.Lookup('ok') === 'a string boxes fine');
+['{"handle": 1094795585}', '{"handle": "0x41414141"}', '{"__native_ptr": "0x4141414141"}',
+ '{"__native_ptr": 1094795585}'].forEach(function (json) {
+  check('rejects ' + json, throws(function () { ps.Insert('k', JSON.parse(json)); }));
+});
+
+// Interface parameters only take objects implementing the interface.
+var client = new Windows.Web.Http.HttpClient();
+client.GetStringAsync(new Windows.Foundation.Uri('https://example.invalid/')).Cancel();
+check('string is not a Uri', throws(function () { client.GetStringAsync('https://example.com'); }));
+check('number is not a Uri', throws(function () { client.GetStringAsync(42); }));
+check('PropertySet is not a Uri', throws(function () { client.GetStringAsync(new Windows.Foundation.Collections.PropertySet()); }));
+
+// Struct buffers must cover the struct.
+var PV = Windows.Foundation.PropertyValue;
+check('8-byte Point accepted', !throws(function () { PV.CreatePoint(new Float32Array([1, 2])); }));
+check('2-byte Point rejected', throws(function () { PV.CreatePoint(new Uint8Array(2)); }));
+
+// Delegate parameters only take delegates.
+var pool = Windows.System.Threading.ThreadPool;
+check('function delegate', !throws(function () { pool.RunAsync(function () {}); }));
+check('asDelegate handle', !throws(function () {
+  pool.RunAsync(NSWinRT.asDelegate('Windows.System.Threading.WorkItemHandler', function () {}));
+}));
+check('PropertySet is not a delegate', throws(function () { pool.RunAsync(new Windows.Foundation.Collections.PropertySet()); }));
+
+// A view's bytes start at its byteOffset.
+var CB = Windows.Security.Cryptography.CryptographicBuffer;
+var bytes = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
+var hex = CB.EncodeToHexString(CB.CreateFromByteArray(bytes.subarray(4)));
+check('view offset honored (' + hex + ')', hex === '05060708');
+
+// Strings keep embedded NULs.
+var withNul = Windows.Data.Json.JsonValue.CreateStringValue('a\u0000b').GetString();
+check('embedded NUL kept', withNul.length === 3);
+
+// Web Crypto randomness.
+var r1 = crypto.getRandomValues(new Uint8Array(32));
+var r2 = crypto.getRandomValues(new Uint8Array(32));
+check('random fills differ', r1.some(function (v, i) { return v !== r2[i]; }));
+check('float array rejected', throws(function () { crypto.getRandomValues(new Float32Array(2)); }));
+check('quota enforced', throws(function () { crypto.getRandomValues(new Uint8Array(65537)); }));
+check('randomUUID v4', /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(crypto.randomUUID()));
+
+console.log('security-check: ' + pass + ' passed, ' + fail + ' failed');
+if (fail) { throw new Error('security-check: ' + fail + ' failed'); }

runtime/src/esm_http.rs

@@ -258,13 +258,27 @@ pub(crate) fn mark_keys_for_cache_bust(keys: &[String]) {
 
 /// Remote-module gate: debug hosts (`set_debug_build`) always allow; release builds need
 /// `security.allowRemoteModules` in the app's package.json, then an allowlist match
-/// (`security.remoteModuleAllowlist` URL prefixes; empty allows every URL).
+/// (`security.remoteModuleAllowlist` URLs; empty allows every URL).
 pub(crate) fn remote_url_allowed(url: &str) -> bool {
     if DEBUG_BUILD.load(std::sync::atomic::Ordering::Relaxed) || cfg!(test) {
         return true;
     }
     let (allowed, allowlist) = SECURITY.get().cloned().unwrap_or((false, Vec::new()));
-    allowed && (allowlist.is_empty() || allowlist.iter().any(|p| url.starts_with(p.as_str())))
+    allowed && (allowlist.is_empty() || allowlist.iter().any(|entry| allowlist_matches(url, entry)))
+}
+
+/// An allowlist entry admits URLs with its scheme, host and port whose path is the entry's path
+/// or lies under it, so `https://cdn.example.com` doesn't admit `https://cdn.example.com.evil`.
+pub(crate) fn allowlist_matches(url: &str, entry: &str) -> bool {
+    let (Ok(url), Ok(entry)) = (url::Url::parse(url), url::Url::parse(entry)) else {
+        return false;
+    };
+    if url.origin() != entry.origin() {
+        return false;
+    }
+    let prefix = entry.path().trim_end_matches('/');
+    let path = url.path();
+    path == prefix || (path.starts_with(prefix) && path[prefix.len()..].starts_with('/'))
 }
 
 static SECURITY: OnceLock<(bool, Vec<String>)> = OnceLock::new();
@@ -277,6 +291,11 @@ pub fn set_debug_build(debug: bool) {
     DEBUG_BUILD.store(debug, std::sync::atomic::Ordering::Relaxed);
 }
 
+/// Whether the host marked itself as a debug build via [`set_debug_build`].
+pub(crate) fn is_debug_build() -> bool {
+    DEBUG_BUILD.load(std::sync::atomic::Ordering::Relaxed)
+}
+
 /// Read the release-build security settings from the app's package.json, once.
 pub(crate) fn init_security_from_app_dir(app_dir: &std::path::Path) {
     let _ = SECURITY.get_or_init(|| {
@@ -340,6 +359,13 @@ pub(crate) fn fetch_module(url: &str, key: &str) -> Result<FetchedModule, String
     }
     let response = fetch_once(url, key).or_else(|_| fetch_once(url, key))
         .map_err(|e| format!("HTTP import failed: {url} ({e})"))?;
+    // WinHTTP follows redirects, so the gate must also admit where the response came from.
+    if !remote_url_allowed(&response.final_url) {
+        return Err(format!(
+            "HTTP import blocked: {url} redirected to {}, which is not allowed",
+            response.final_url
+        ));
+    }
     let status = response.status;
     if status == 204 || status == 205 {
         return Err(format!("HTTP import failed: {url} (status={status}, no content)"));
@@ -403,6 +429,32 @@ pub(crate) fn json_module_source(body: &str) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn allowlist_matches_origin_and_path_boundary() {
+        let cdn = "https://cdn.example.com";
+        assert!(allowlist_matches("https://cdn.example.com/a.js", cdn));
+        assert!(allowlist_matches("https://cdn.example.com:443/a.js", cdn));
+        assert!(!allowlist_matches("https://cdn.example.com.evil.net/a.js", cdn));
+        assert!(!allowlist_matches("https://cdn.example.com@evil.net/a.js", cdn));
+        assert!(!allowlist_matches("http://cdn.example.com/a.js", cdn));
+        assert!(!allowlist_matches("https://cdn.example.com:8443/a.js", cdn));
+        let lib = "https://cdn.example.com/lib/";
+        assert!(allowlist_matches("https://cdn.example.com/lib/a.js", lib));
+        assert!(allowlist_matches("https://cdn.example.com/lib", lib));
+        assert!(!allowlist_matches("https://cdn.example.com/library.js", "https://cdn.example.com/lib"));
+        assert!(!allowlist_matches("https://cdn.example.com/lib/../evil.js", lib));
+        assert!(!allowlist_matches("", lib));
+    }
+
+    #[test]
+    fn websocket_subprotocols_must_be_tokens() {
+        assert!(crate::winhttp::is_http_token("graphql-ws"));
+        assert!(crate::winhttp::is_http_token("v1.chat"));
+        assert!(!crate::winhttp::is_http_token(""));
+        assert!(!crate::winhttp::is_http_token("a\r\nX-Injected: 1"));
+        assert!(!crate::winhttp::is_http_token("a, b"));
+    }
+
     #[test]
     fn canonical_keys_follow_the_configured_vocabulary() {
         clear_thread_vocabulary();

runtime/src/esm_http_test.rs

@@ -294,3 +294,19 @@ fn native_websocket_round_trip() {
     );
     assert_eq!(refused, "ok:1006:false");
 }
+
+#[test]
+fn legacy_dynamic_import_uses_the_module_loader() {
+    let server = TestServer::start();
+    let o = server.origin.clone();
+    server.route("/remote/mod.js", "text/javascript", "export default 'remote'; export const n = 2;");
+    server.route("/remote/style.css", "text/css", "body{}");
+
+    let mut runtime = Runtime::new(".");
+    runtime.register_delegate_isolate_ptr();
+    let got = await_js(&mut runtime, &format!("NSWinRT.dynamicImport('{o}/remote/mod.js').then(m => m.default + m.n)"));
+    assert_eq!(got, "ok:remote2");
+    // The loader's MIME check applies too.
+    let css = await_js(&mut runtime, &format!("NSWinRT.dynamicImport('{o}/remote/style.css')"));
+    assert!(css.starts_with("err:"), "{css}");
+}

runtime/src/generic_method_call.rs

@@ -44,9 +44,14 @@ pub struct GenericMethodCall {
     /// Pre-computed interface IIDs for pointer-typed parameters (one per parse param, None if no QI needed).
     parameter_arg_iids: Vec<Option<GUID>>,
     /// Scratch buffer for value-type returns (same role as in MethodCall).
-    return_value_buf: [u8; 128],
+    return_value_buf: [u8; crate::helpers::RETURN_BUFFER_SIZE],
+    /// Set when the call can't be made safely; `call` then fails without touching the vtable.
+    init_error: Option<HRESULT>,
 }
 
+const E_NOINTERFACE: HRESULT = HRESULT(0x8000_4002u32 as i32);
+const E_NOTIMPL: HRESULT = HRESULT(0x8000_4001u32 as i32);
+
 #[inline]
 fn call_failure() -> HRESULT {
     // E_FAIL
@@ -93,9 +98,12 @@ impl GenericMethodCall {
             )
         };
 
-        // Generic interface QI is best-effort: fall back to the original interface
-        // when the object doesn't implement the expected instantiation.
+        // Without the interface the vtable slot belongs to some other method, so the call fails.
         let qi_ok = result.is_ok() && !interface_ptr.is_null();
+        let mut init_error = (!qi_ok).then_some(E_NOINTERFACE);
+        if !crate::helpers::return_layout_supported(&return_type) {
+            init_error = Some(E_NOTIMPL);
+        }
 
         let is_composition = !is_sealed;
 
@@ -126,6 +134,9 @@ impl GenericMethodCall {
             let metadata = parameter.metadata().unwrap();
 
             let signature = Signature::to_string(metadata, &type_);
+            if !crate::helpers::parameter_layout_supported(&signature) {
+                init_error = Some(E_NOTIMPL);
+            }
 
             let parse_native_type = NativeType::try_from(signature.as_str());
             assert!(parse_native_type.is_ok());
@@ -207,19 +218,26 @@ impl GenericMethodCall {
             .iter()
             .cloned()
             .map(libffi::middle::Type::try_from)
-            .collect::<std::result::Result<Vec<Type>, AnyError>>();
+            .collect::<std::result::Result<Vec<Type>, AnyError>>()
+            .unwrap_or_else(|_| {
+                init_error = Some(E_NOTIMPL);
+                Vec::new()
+            });
 
-        assert!(params.is_ok());
-
-        let cif = Cif::new(params.unwrap(), Type::i32());
+        let cif = Cif::new(params, Type::i32());
 
         let effective_interface = if qi_ok {
             unsafe { IUnknown::from_raw(interface_ptr) }
         } else {
             interface.clone()
         };
-        let vtable: *mut *mut c_void = unsafe { std::mem::transmute(effective_interface.vtable()) };
-        let func = unsafe { *vtable.offset(index as isize) };
+        let func = if qi_ok {
+            let vtable: *mut *mut c_void =
+                unsafe { std::mem::transmute(effective_interface.vtable()) };
+            unsafe { *vtable.offset(index as isize) }
+        } else {
+            std::ptr::null_mut()
+        };
 
         Self {
             cif,
@@ -237,7 +255,8 @@ impl GenericMethodCall {
             parameters: method.parameters().to_vec(),
             return_type,
             parameter_arg_iids,
-            return_value_buf: [0u8; 128],
+            return_value_buf: [0u8; crate::helpers::RETURN_BUFFER_SIZE],
+            init_error,
         }
     }
 
@@ -246,6 +265,9 @@ impl GenericMethodCall {
         scope: &mut v8::PinScope<'s, '_>,
         args: &v8::FunctionCallbackArguments,
     ) -> (HRESULT, *mut c_void, Vec<v8::Local<'s, v8::Value>>) {
+        if let Some(hr) = self.init_error {
+            return (hr, std::ptr::null_mut(), Vec::new());
+        }
         let number_of_abi_parameters = self.number_of_abi_parameters;
         let mut arguments: Vec<NativeValue> = Vec::with_capacity(number_of_abi_parameters);
         // Track parse-level types for each ABI argument slot.
@@ -267,6 +289,7 @@ impl GenericMethodCall {
         });
         argument_parse_types.push(None);
 
+        let mut buffer_args = Vec::new();
         for (i, native_type) in self.parse_parameter_types.iter().enumerate() {
             let parameter = &self.parameters[i];
             let param_sig_opt = parameter
@@ -340,7 +363,7 @@ impl GenericMethodCall {
                                 Ok(pointer)
                             }
                             Ok((pointer, None)) => Ok(pointer),
-                            Err(_) => ffi_parse_pointer_arg(scope, value),
+                            Err(error) => Err(error),
                         }
                     } else {
                         ffi_parse_pointer_arg(scope, value)
@@ -352,6 +375,7 @@ impl GenericMethodCall {
                         Ok(value) => value,
                         Err(_) => return (call_failure(), std::ptr::null_mut(), Vec::new()),
                     };
+                    buffer_args.push((value, unsafe { buffer_value.pointer }, byte_length));
 
                     arguments.push(NativeValue {
                         u32_value: byte_length,
@@ -362,7 +386,7 @@ impl GenericMethodCall {
                     continue;
                 }
                 NativeType::Function => ffi_parse_function_arg(scope, value),
-                NativeType::Struct(_) => ffi_parse_struct_arg(scope, value),
+                NativeType::Struct(_) => ffi_parse_struct_arg(scope, value, native_type.size()),
                 NativeType::String => ffi_parse_string_arg(scope, value),
             };
 
@@ -430,6 +454,10 @@ impl GenericMethodCall {
             }
         }
 
+        if !crate::value::buffers_unchanged(scope, &buffer_args) {
+            return (call_failure(), std::ptr::null_mut(), Vec::new());
+        }
+
         let prep = match crate::ffi::prepare_string_storage(
             &arguments,
             &self.parameter_types,