kumavis

LavaMoat

js tooling to help prevent attacks from evil dependencies.

read more here

lavamoat-webpack

webpack plugin for creating bundles protected by the LavaMoat kernel.

kumavis

const { makeStringTransform } = require('browserify-transform-tools')


module.exports = makeStringTransform('lavamoat-browserify-workarounds', { excludeExtension: ['.json'] }, (content, _, cb) => {
  const result = content
    // fix html comments
    .split('-->').join('-- >')
    // fix direct eval
    .split(' eval(').join(' (eval)(')
    .split('\neval(').join('\n(eval)(')

kumavis

> x = 'hello'
'hello'
> x.toString = () => 'ayy'
[Function]
> x.valueOf = () => 'yoo'
[Function]
> x
'hello'
> x+''
'hello'

kumavis

_then = Promise.prototype.then
// [Function: then]

Promise.prototype.then = function(){ console.log('then!'); return _then.apply(this, arguments);  }
// [Function (anonymous)]

p = new Promise(resolve => resolve())
// Promise { undefined }

kumavis

const provider = polyfillJsonRpcBatchAsBatchTx(inpageProvider)


function polyfillJsonRpcBatchAsBatchTx (oldProvider) {
  const newProvider = { sendAsync }
  return newProvider

  function sendAsync (req, cb) {
    if (Array.isArray(req)) {

kumavis

"use strict"

const { Membrane } = require('es-membrane')


// create raw object to be protected by membrane
const rawObj = { secure: true }

// create membrane to manage interaction
const membrane = new Membrane()

kumavis

const { Membrane } = require('es-membrane')

const { defineModule, getRawModule } = createModuleSystem()

//
// define modules
//

// module X
defineModule('x', (require) => {

kumavis

// // Called when the user clicks on the browser action.
// chrome.action.onClicked.addListener(function(tab) {
//   // No tabs or host permissions needed!
//   console.log('Turning ' + tab.url + ' red!');
//   // chrome.tabs.executeScript({
//   //   code: 'document.body.style.backgroundColor="red"'
//   // });
// });

kumavis

const test = require('tape-promise').default(require('tape'))

const SES = require('../lib/ses.umd.js')

const realm = SES.makeSESRootRealm()

test(async t => {
  const globalStore = {}

  runModuleA()

kumavis

test details

contentRouting.findProviders

real browser dht network network size 60 kbucket 20 maxPeers 40 randomWalk off visible connection churn due to maxPeers