fix(playground): authenticate, confine, and byte-bound npm archives

[samchon]

Problem

The Playground's browser-side npm installer trusts downloaded archive bytes and entry paths too early.

It does not verify registry dist.integrity or dist.shasum, accepts tar entries that escape the canonical package root, and buffers compressed and decompressed archives without byte limits. maxPackages bounds dependency count but does not bound network or memory consumption per package.

This is the trust boundary that feeds the wasm compiler MemFS, Monaco declarations, and the Execute runtime pack.

Evidence

Real npm install metadata for typia@13.2.0 includes:

• a SHA-512 SRI dist.integrity;
• a SHA-1 dist.shasum;
• the tarball URL.

INpmVersionMetadata.dist currently retains only tarball. downloadTarball returns response.arrayBuffer(), and unpackNpmTarball immediately decompresses it.

A controlled registry response with deliberately false integrity and shasum values still installed successfully.

Tar extraction uses stripTarRoot, which removes the first component without validating the remaining segments. A regular entry named:

package/../../outside.js

produced these mounted keys:

node_modules/fixture/../../outside.js
fixture/../../outside.js

The compiler MemFS handoff later filters .., but the returned install result, Execute runtime pack, editor map, package file counts, and intermediate maps already contain the unconfined key.

The download and decompression paths also have no byte counters:

• response.arrayBuffer() buffers the complete compressed response;
• new Response(decompressionStream).arrayBuffer() buffers the complete expanded archive;
• tar entry sizes are trusted without a safe bounds check.

An authenticated package can still be malicious or compromised, so integrity verification does not replace resource and path confinement.

Consequence surface

• Corrupt or substituted tarballs can be executed after a successful metadata request.
• Parent, absolute, drive-prefixed, backslash, PAX, and GNU long-path entries can escape the intended package key space.
• Highly compressed or simply oversized packages can exhaust a browser tab before the package-count cap applies.
• Optional dependencies must not silently convert an integrity or archive-format failure into a skip. Only registry absence retains optional semantics.
• Normal npm package/ archives, Unicode PAX paths, long paths, JSON, declarations, and runtime JavaScript must continue to install.
• Aborted installs must stop download, verification, decompression, and parsing promptly.

Approach

Treat registry metadata and archive bytes as one authenticated, bounded handoff:

1. Preserve dist.integrity and dist.shasum.
2. After download and before decompression, verify the strongest supported SRI algorithm. Use shasum only when SRI is absent.
3. Stream the response and decompression output through configurable compressed and expanded byte budgets with conservative browser-safe defaults.
4. Validate tar sizes and record bounds before slicing.
5. Require regular files to live below the canonical package/ root after slash normalization. Reject empty, absolute, drive-prefixed, dot, parent, and other escaping segments. Apply the same rule to header, PAX, and GNU long paths.
6. Mount files only after the complete archive passes.

Errors must identify the package and version at the installer boundary without logging archive contents.

Acceptance and verification

• A tarball matching SHA-512 SRI installs.
• A changed byte, malformed SRI, or mismatched strongest digest fails before decompression.
• SHA-1 shasum is used only when integrity is absent.
• A package with neither field follows an explicit compatibility policy covered by a test.
• Compressed and decompressed limits fail deterministically, including when Content-Length is absent or false.
• Truncated, overflowing, or out-of-bounds tar entries fail.
• Header, PAX, and GNU long paths containing absolute or parent traversal fail without mounting any file.
• Normal Unicode PAX and long-path archives retain coverage.
• Abort behavior and optional dependency semantics remain stable.
• Public documentation describes authenticity and size controls.
• Run:

pnpm --filter @ttsc/playground build
pnpm --filter @ttsc/test-playground start -- --include=npm
pnpm --filter @ttsc/test-playground start

Coordination

The package-target issue begins after a valid runtime pack is mounted. This issue owns the earlier registry metadata, download, decompression, tar parsing, and mount-key boundary. They can share one campaign pull request but require separate acceptance evidence.

[samchon]

One documentation boundary needs to be explicit alongside the archive fix.

dist.integrity proves that the downloaded bytes match the registry metadata. It does not prove that the package is benign. createSandboxRequire restricts module lookup over an in-memory pack, but it is not an origin, process, or capability isolation boundary. The package README deliberately leaves execution to the host and currently demonstrates an in-page new Function; the hosted website also evaluates only after the user clicks Execute.

The implementation documentation should therefore state:

• integrity authenticates package bytes but does not establish trust in package code;
• createSandboxRequire is a CommonJS resolver/evaluator, not a security sandbox;
• embedders that accept untrusted code or packages must supply an isolated executeBundle policy appropriate to their site;
• the compressed and expanded byte limits protect availability during installation, not runtime behavior such as loops, timers, network access, or global access chosen by the host executor.

This does not change the archive owner or add an iframe/Worker API to this issue. It prevents the new integrity guarantee from being read as a broader execution-safety guarantee.

[samchon]

Implemented in #980 and published in @ttsc/playground@0.21.0.

The npm install path now treats registry metadata, response bytes, decompression, tar parsing, and mount selection as one authenticated and bounded handoff:

• dist.integrity and dist.shasum are retained from metadata;
• the strongest supported SRI digest is verified before decompression;
• SHA-1 shasum is used only when SRI is absent;
• the explicit compatibility case with neither field remains supported and tested;
• compressed bytes are streamed under a 16 MiB default limit;
• expanded tar bytes are streamed under a 64 MiB default limit;
• maxTarballBytes and maxUnpackedBytes are public per-install overrides;
• tar header sizes, record bounds, truncation, and overflow are validated before slicing;
• selected regular files must share one safe archive root and every normalized segment must remain confined below it; and
• no file is mounted until the complete archive has passed.

The root rule accepts one consistent nonstandard root for compatibility while rejecting mixed roots, absolute paths, drive-prefixed paths, parent segments, backslash escapes, and unsafe PAX or GNU long-path replacements. This avoids hard-coding only the usual package/ spelling while preserving the confinement invariant.

Cancellation is preserved across the complete asynchronous surface: registry fetch, metadata JSON, metadata response handoff, archive fetch, archive response handoff, stream reads, bodyless fallback, digest calculation, decompression, parsing, and the installer error handoff. Unused responses and readers are cancelled. Optional dependencies may still ignore an actual registry absence, but integrity, format, confinement, and resource-limit failures are not silently converted into an optional skip.

The controls include authenticated live metadata for typia@13.2.0 and @types/node@26.1.1, strongest-digest selection, changed bytes, malformed metadata, legacy shasum, unsigned compatibility, false or absent Content-Length, compressed and expanded limits, truncated and overflowing records, unsafe headers/PAX/GNU paths, Unicode/long-path compatibility, optional dependencies, and deterministic cancellation races.

As documented, integrity proves that bytes match registry metadata; it does not establish that package code is benign. createSandboxRequire is a CommonJS resolver/evaluator, not a process or origin security boundary. Embedders accepting untrusted code must still provide an isolated execution policy.

The complete Playground suite passed all 35 features, and the release workflow successfully published and smoke-tested 0.21.0.

Release: https://github.com/samchon/ttsc/releases/tag/v0.21.0