policy: fix cascade getting scope

PR-URL: #37298
Reviewed-By: Vladimir de Turckheim <vlad2t@hotmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Co-authored-by: James M Snell <jasnell@gmail.com>

Author: 2 people

lib/internal/policy/manifest.js

@@ -41,8 +41,10 @@ const shouldAbortOnUncaughtException =
 getOptionValue('--abort-on-uncaught-exception');
 const{ abort, exit, _rawDebug }=process;
 
+constkTerminate=()=>null;
+
 // From https://url.spec.whatwg.org/#special-scheme
-constSPECIAL_SCHEMES=newSafeSet([
+constkSpecialSchemes=newSafeSet([
 'file:',
 'ftp:',
 'http:',
@@ -76,7 +78,7 @@ function REACTION_LOG(error) {
 
 classManifest{
 /**
- * @type {Map<string, DependencyMapper>}
+ * @type {Map<string | null | undefined, DependencyMapper>}
  *
  * Used to compare a resource to the content body at the resource.
  * `true` is used to signify that all integrities are allowed, otherwise,
@@ -139,6 +141,8 @@ class Manifest {
  */
 constructor(obj,manifestURL){
 constscopes=this.#scopeDependencies;
+scopes.set(null,kTerminate);
+scopes.set(undefined,kTerminate);
 constintegrities=this.#resourceIntegrities;
 constdependencies=this.#resourceDependencies;
 letreaction=REACTION_THROW;
@@ -205,18 +209,20 @@ class Manifest {
 return(toSpecifier,conditions)=>{
 if(toSpecifierindependencyMap!==true){
 if(cascade===true){
-letscopeHREF;
+/** @type {string | null} */
+letscopeHREF=resourceHREF;
 if(typeofparentDeps==='undefined'){
 do{
-scopeHREF=this.#findScopeHREF(resourceHREF);
+scopeHREF=this.#findScopeHREF(scopeHREF);
+if(scopeHREF===resourceHREF){
+scopeHREF=null;
+}
+if(scopes.has(scopeHREF)){
+break;
+}
 }while(
-scopeHREF!==null&&
-scopes.has(scopeHREF)!==true
+scopeHREF!==null
 );
-}
-if(scopeHREF===null){
-parentDeps=()=>null;
-}else{
 parentDeps=scopes.get(scopeHREF);
 }
 returnparentDeps(toSpecifier);
@@ -416,7 +422,7 @@ class Manifest {
 protocol=currentURL.protocol;
 }
 // Only a few schemes are hierarchical
-if(SPECIAL_SCHEMES.has(currentURL.protocol)){
+if(kSpecialSchemes.has(currentURL.protocol)){
 // Make first '..' act like '.'
 if(currentURL.pathname.slice(-1)!=='/'){
 currentURL.pathname+='/';

test/fixtures/policy/dependencies/dependencies-scopes-and-resources-policy.json

@@ -0,0 +1,14 @@
+{
+"resources": {
+"../multi-deps.js": {
+"integrity": true,
+"cascade": true
+ }
+ },
+"scopes": {
+"../": {
+"integrity": true,
+"dependencies": true
+ }
+ }
+}

test/fixtures/policy/multi-deps.js

@@ -0,0 +1,3 @@
+'use strict';
+require('fs');
+require('process');

test/parallel/test-policy-scopes.js

@@ -10,8 +10,8 @@ const fixtures = require('../common/fixtures');
 constassert=require('assert');
 const{ spawnSync }=require('child_process');
 
-constdep=fixtures.path('policy','main.mjs');
 {
+constdep=fixtures.path('policy','main.mjs');
 constdepPolicy=fixtures.path(
 'policy',
 'dependencies',
@@ -24,3 +24,17 @@ const dep = fixtures.path('policy', 'main.mjs');
 );
 assert.strictEqual(status,0);
 }
+{
+constdep=fixtures.path('policy','multi-deps.js');
+constdepPolicy=fixtures.path(
+'policy',
+'dependencies',
+'dependencies-scopes-and-resources-policy.json');
+const{ status }=spawnSync(
+process.execPath,
+[
+'--experimental-policy',depPolicy,dep,
+]
+);
+assert.strictEqual(status,0);
+}