fix(web): omit importer integrity for the trusted resolver stub (#8693)

* fix(web): omit importer integrity for the trusted resolver stub

Import-map integrity that covers the selected importer was applied to REA's
replacement resolver script. Strip only those integrity entries from the
installed map so native resolution can proceed while preserving dependency
integrity and the caller-selected map identity.

Fixes #8544

* fix(web): keep __proto__ import-map integrity keys on a null prototype

src/browser/modules/NativeModuleResolver.ts

@@ -33,6 +33,7 @@ import type {
 } from "../../domain/webModuleTrace.js";
 import { webModuleResolutionSchema } from "../../domain/webModuleTrace.js";
 import { ProviderStartupDeadline } from "../../process/ProviderDeadline.js";
+import { importMapForTrustedResolver } from "./importMapForTrustedResolver.js";
 
 const OPERATION = "trace_web_module_imports";
 const TIMEOUT_MS = 20000;
@@ -367,7 +368,7 @@ const resolveInBrowser = async (
         await route.fulfill({
           status: 200,
           contentType: "text/html",
-          body: `<!doctype html>${input.importMap === null ? "" : `<base href="${htmlAttribute(new URL(input.importMap.baseUrl).href)}"><script type="importmap">${scriptJson(input.importMap.value)}</script>`}`,
+          body: `<!doctype html>${input.importMap === null ? "" : `<base href="${htmlAttribute(new URL(input.importMap.baseUrl).href)}"><script type="importmap">${scriptJson(importMapForTrustedResolver(input.importMap.value, importerUrl, input.importMap.baseUrl))}</script>`}`,
         });
       } else if (
         !stubSent &&

src/browser/modules/importMapForTrustedResolver.test.ts

@@ -0,0 +1,98 @@
+import { describe, expect, it } from "vitest";
+import { importMapForTrustedResolver } from "./importMapForTrustedResolver.js";
+
+describe("importMapForTrustedResolver", () => {
+  const baseUrl = "https://app.test/index.html";
+  const importerUrl = "https://app.test/main.js";
+
+  it("omits integrity that covers the selected importer URL", () => {
+    const map = {
+      imports: { dep: "/dep.js" },
+      integrity: {
+        "https://app.test/main.js": "sha256-importer",
+        "https://app.test/dep.js": "sha256-dep",
+      },
+    };
+    expect(importMapForTrustedResolver(map, importerUrl, baseUrl)).toEqual({
+      imports: { dep: "/dep.js" },
+      integrity: { "https://app.test/dep.js": "sha256-dep" },
+    });
+  });
+
+  it("resolves relative integrity keys against the import-map base URL", () => {
+    const map = {
+      imports: { dep: "./dep.js" },
+      integrity: {
+        "./main.js": "sha256-importer",
+        "./dep.js": "sha256-dep",
+      },
+    };
+    expect(
+      importMapForTrustedResolver(map, "https://app.test/main.js", baseUrl),
+    ).toEqual({
+      imports: { dep: "./dep.js" },
+      integrity: { "./dep.js": "sha256-dep" },
+    });
+  });
+
+  it("matches importer integrity across query and fragment differences", () => {
+    const map = {
+      imports: { dep: "/dep.js" },
+      integrity: {
+        "https://app.test/main.js": "sha256-importer",
+        "https://app.test/dep.js": "sha256-dep",
+      },
+    };
+    expect(
+      importMapForTrustedResolver(
+        map,
+        "https://app.test/main.js?build=1#entry",
+        baseUrl,
+      ),
+    ).toEqual({
+      imports: { dep: "/dep.js" },
+      integrity: { "https://app.test/dep.js": "sha256-dep" },
+    });
+  });
+
+  it("drops an empty integrity member after removing the importer entry", () => {
+    const map = {
+      imports: { dep: "/dep.js" },
+      integrity: { "https://app.test/main.js": "sha256-importer" },
+    };
+    expect(importMapForTrustedResolver(map, importerUrl, baseUrl)).toEqual({
+      imports: { dep: "/dep.js" },
+    });
+  });
+
+  it("preserves maps without integrity and dependency-only integrity", () => {
+    const without = { imports: { dep: "/dep.js" } };
+    expect(importMapForTrustedResolver(without, importerUrl, baseUrl)).toBe(
+      without,
+    );
+    const dependencyOnly = {
+      imports: { dep: "/dep.js" },
+      integrity: { "https://app.test/dep.js": "sha256-dep" },
+    };
+    expect(
+      importMapForTrustedResolver(dependencyOnly, importerUrl, baseUrl),
+    ).toBe(dependencyOnly);
+  });
+
+  it("preserves a dependency integrity key named __proto__ without prototype pollution", () => {
+    const integrity = Object.assign(Object.create(null), {
+      "https://app.test/main.js": "sha256-importer",
+      "https://app.test/dep.js": "sha256-dep",
+    });
+    integrity["__proto__"] = "sha256-proto-dep";
+    const map = { imports: { dep: "/dep.js" }, integrity };
+    const next = importMapForTrustedResolver(map, importerUrl, baseUrl);
+    const nextIntegrity = next.integrity as { readonly [key: string]: string };
+    expect(nextIntegrity["https://app.test/dep.js"]).toBe("sha256-dep");
+    expect(
+      Object.getOwnPropertyDescriptor(nextIntegrity, "__proto__")?.value,
+    ).toBe("sha256-proto-dep");
+    expect(Object.getPrototypeOf(nextIntegrity)).toBe(null);
+    expect(Object.prototype.hasOwnProperty.call({}, "__proto__")).toBe(false);
+  });
+});

src/browser/modules/importMapForTrustedResolver.ts

@@ -0,0 +1,75 @@
+import type { JsonValue } from "../../domain/jsonValue.js";
+
+/**
+ * Build the import map installed for REA's trusted resolver stub.
+ *
+ * Chromium applies import-map `integrity` to the module script URL. The
+ * resolver fulfills that URL with REA's replacement bytes, so integrity that
+ * covers the selected importer must not be installed. Dependency integrity and
+ * the caller-selected map identity remain unchanged in Evidence.
+ */
+export const importMapForTrustedResolver = (
+  map: { readonly [key: string]: JsonValue },
+  importerUrl: string,
+  baseUrl: string,
+): { readonly [key: string]: JsonValue } => {
+  const integrity = map.integrity;
+  if (
+    integrity === null ||
+    typeof integrity !== "object" ||
+    Array.isArray(integrity)
+  )
+    return map;
+  const importer = importerModuleIdentity(importerUrl, baseUrl);
+  const nextIntegrity: { [key: string]: JsonValue } = Object.create(null);
+  let removed = false;
+  for (const [key, value] of Object.entries(integrity)) {
+    if (integrityKeyMatchesImporter(key, baseUrl, importer)) {
+      removed = true;
+      continue;
+    }
+    nextIntegrity[key] = value;
+  }
+  if (!removed) return map;
+  if (Object.keys(nextIntegrity).length === 0) {
+    const { integrity: _omit, ...rest } = map;
+    return rest;
+  }
+  return { ...map, integrity: nextIntegrity };
+};
+
+const importerModuleIdentity = (
+  importerUrl: string,
+  baseUrl: string,
+): { readonly hrefs: ReadonlySet<string>; readonly moduleKey: string } => {
+  const absolute = new URL(importerUrl, baseUrl);
+  const withoutHash = new URL(absolute.href);
+  withoutHash.hash = "";
+  return {
+    hrefs: new Set([absolute.href, withoutHash.href]),
+    // Chromium's integrity lookup reports the module URL without search/hash.
+    moduleKey: `${absolute.origin}${absolute.pathname}`,
+  };
+};
+
+const integrityKeyMatchesImporter = (
+  key: string,
+  baseUrl: string,
+  importer: {
+    readonly hrefs: ReadonlySet<string>;
+    readonly moduleKey: string;
+  },
+): boolean => {
+  try {
+    const resolved = new URL(key, baseUrl);
+    const withoutHash = new URL(resolved.href);
+    withoutHash.hash = "";
+    return (
+      importer.hrefs.has(resolved.href) ||
+      importer.hrefs.has(withoutHash.href) ||
+      `${resolved.origin}${resolved.pathname}` === importer.moduleKey
+    );
+  } catch {
+    return false;
+  }
+};