fix(runtime): unwrap Proxy receivers and arguments before native dispatch - #485

Walkthrough

The runtime unwraps proxies during native value conversion, receiver dispatch, wrapper lookup, and native counterpart release. It adds fallback context lookup for objects and callbacks. New tests cover proxied native receivers and arguments, revoked proxies, invalid targets, and proxy traps.

Changes

Proxy Runtime Handling

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant JavaScriptCaller
  participant MethodCallback
  participant ResolveProxyReceiver
  participant NativeMethod
  JavaScriptCaller->>MethodCallback: invoke method through proxy
  MethodCallback->>ResolveProxyReceiver: resolve receiver
  ResolveProxyReceiver-->>MethodCallback: return target or throw TypeError
  MethodCallback->>NativeMethod: invoke with resolved receiver

Suggested reviewers: nathanwalker

Security Blast Radius

• inferred — The demonstrated boundary surface is JavaScript execution with access to native wrappers or registered native callbacks in the hosting application. Aggregate return corruption could affect native consumers within that process. No inspected evidence establishes additional tenant, service, credential, or environment authority.

Security Findings and Attack Paths

• inferred — A JavaScript callback supplying a revoked Proxy can complete successfully, be normalized to empty, and return after only one ABI word is cleared. A native caller expecting a larger struct can receive untouched trailing bytes. Stale-data disclosure is a potential consequence, not a demonstrated exploit; null and undefined already exposed the underlying clearing defect at the PR base.

Trust Boundaries and Controls

• inferred — Receiver unwrapping aliases an already-held native wrapper rather than granting native identity to an arbitrary target. Callback context fallback stays within the supplied isolate and its cache; runtime initialization and worker creation provide counterevidence to cross-worker authority transfer. Authority equivalence for additional embedding-created contexts remains unestablished.

Resilience and Maintainability Implications

• observed — Returned native block and function-pointer V8 callbacks invoke argument conversion without a local NativeScriptException catch. The new revoked-argument helper throws that exception type. Other conversion throws already existed at the base, so incomplete containment is not established as a wholly new security condition; complete outer recovery remains unresolved.

Hardening Proposals

• proposed — Make revoked and nil callback recovery type-aware and initialize the complete ABI return storage for aggregate types. Validate successful revoked-result recovery with a struct larger than ffi_arg, including repetition after a nonzero prior result.
• proposed — Establish a local exception-to-JavaScript boundary for returned native callables, covering revoked arguments and existing conversion errors before native invocation. Validate that rejection remains catchable and that neither native execution nor unsupported unwinding occurs.

❌ Failed checks (1 warning)

• X
• Mastodon
• Reddit
• LinkedIn