fix: adjust Node.js Polyfills and add Unicode Character Sanitization (#320)

* fix: export all zlib methods from unenv polyfill

* fix: add buffer polyfill with latin1Slice and utf8Slice methods

* feat: add Web Crypto API exports to crypto polyfill

* refactor: replace custom util polyfills with unenv implementation

* feat: add base64url encoding support to buffer polyfill

* feat: add Date.toString polyfill for proper Date object identification

* feat: add SanitizeWorker plugin to escape non-BMP Unicode characters in worker

- Added SanitizeWorker esbuild plugin to escape Unicode characters
outside the Basic Multilingual Plane
- Plugin processes output files and converts characters with
code points >= 0x10000 to escaped format
- Integrated plugin into bundler plugin system with AZ_ENABLE_SANITIZE_WORKER
environment variable control (experimental plugin)
- Added logging to report number of escaped characters per file

Author: jcbsfilho

packages/bundler/src/bundlers/esbuild/esbuild.ts

@@ -8,6 +8,7 @@ import AzionEsbuildConfig from './esbuild.config';
 import AzionPolyfillPlugin from './plugins/azion-polyfills';
 import OptionalChainingAssignmentPlugin from './plugins/babel-custom';
 import NodePolyfillPlugin from './plugins/node-polyfills';
+import SanitizeWorker from './plugins/sanitize-worker';
 
 // eslint-disable-next-line
 interface ESBuildConfig extends esbuild.BuildOptions {}
@@ -23,13 +24,15 @@ interface ESBuildPluginClasses {
   NodePolyfillsPlugin: (isProduction: boolean) => ESBuildPlugin;
   AzionPolyfillsPlugin: (isProduction: boolean) => ESBuildPlugin;
   OptionalChainingAssignmentPlugin: () => ESBuildPlugin;
+  SanitizeWorker: (sanitize: boolean, options?: { outfile?: string }) => ESBuildPlugin;
 }
 
 // Create esbuild-specific plugins
 const bundlerPlugins = createBundlerPlugins<ESBuildPluginClasses, ESBuildConfiguration>({
   NodePolyfillsPlugin: NodePolyfillPlugin,
   AzionPolyfillsPlugin: AzionPolyfillPlugin,
   OptionalChainingAssignmentPlugin: OptionalChainingAssignmentPlugin,
+  SanitizeWorker: SanitizeWorker,
 });
 
 /**

packages/bundler/src/bundlers/esbuild/plugins/sanitize-worker/index.ts

@@ -0,0 +1,3 @@
+import SanitizeWorker from './sanitize-worker';
+
+export default SanitizeWorker;

packages/bundler/src/bundlers/esbuild/plugins/sanitize-worker/sanitize-worker.ts

@@ -0,0 +1,56 @@
+import { Plugin, PluginBuild } from 'esbuild';
+import fs from 'fs';
+
+const SanitizeWorker = (sanitize: boolean, options?: { outfile?: string }): Plugin => {
+  const NAME = 'sanitize-worker';
+
+  const sanitizeUTF8 = (content: string) => {
+    let escapedCount = 0;
+    const chars = Array.from(content);
+    const result = chars
+      .map((char) => {
+        const codePoint = char.codePointAt(0)!;
+        // Escape caracteres fora do Basic Multilingual Plane (BMP)
+        if (codePoint >= 0x10000) {
+          escapedCount++;
+          return `\\u{${codePoint.toString(16)}}`;
+        }
+        return char;
+      })
+      .join('');
+    return { result, escapedCount };
+  };
+
+  const processFile = (filePath: string) => {
+    const content = fs.readFileSync(filePath, 'utf-8');
+    const { result, escapedCount } = sanitizeUTF8(content);
+
+    if (escapedCount > 0) {
+      console.log(`[sanitize-worker] Escaped ${escapedCount} Unicode character(s) in ${filePath}`);
+      fs.writeFileSync(filePath, result, 'utf-8');
+    }
+  };
+
+  return {
+    name: NAME,
+    setup(build: PluginBuild) {
+      build.onEnd(async (result) => {
+        if (!sanitize || result.errors.length > 0) {
+          return;
+        }
+        if (build.initialOptions.entryPoints) {
+          for (const filePath of Object.keys(build.initialOptions.entryPoints)) {
+            processFile(`${filePath}.js`);
+          }
+        } else {
+          const outfile = options?.outfile || build.initialOptions.outfile;
+          if (outfile) {
+            processFile(outfile);
+          }
+        }
+      });
+    },
+  };
+};
+
+export default SanitizeWorker;

packages/bundler/src/helpers/bundler-utils.ts

@@ -45,6 +45,18 @@ export const createBundlerPlugins = <
           ? // eslint-disable-next-line @typescript-eslint/no-explicit-any
             [(pluginsClasses as any).OptionalChainingAssignmentPlugin()]
           : []),
+        // Add sanitize worker plugin if available (esbuild only)
+        ...('SanitizeWorker' in pluginsClasses
+          ? [
+              // eslint-disable-next-line @typescript-eslint/no-explicit-any
+              (pluginsClasses as any).SanitizeWorker(process.env.AZ_ENABLE_SANITIZE_WORKER ?? false, {
+                options: {
+                  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                  outfile: (config as any).outfile,
+                },
+              }),
+            ]
+          : []),
       ] as unknown as typeof config.plugins;
       return config;
     };

packages/bundler/src/polyfills/crypto/context/crypto.context.js

@@ -1,5 +1,6 @@
 import * as crypto from 'node:crypto';
 
+export default crypto;
 export var { Cipher } = crypto;
 export var { Decipher } = crypto;
 export var { DiffieHellman } = crypto;
@@ -35,39 +36,8 @@ export var { getRandomValues } = crypto;
 export var { randomUUID } = crypto;
 export var { generateKeyPair } = crypto;
 
-export default {
-  Cipher,
-  Decipher,
-  DiffieHellman,
-  DiffieHellmanGroup,
-  Hash,
-  Hmac,
-  Sign,
-  Verify,
-  constants,
-  createCipheriv,
-  createDecipheriv,
-  createDiffieHellman,
-  createDiffieHellmanGroup,
-  createECDH,
-  createHash,
-  createHmac,
-  createSign,
-  createVerify,
-  getCiphers,
-  getDiffieHellman,
-  getHashes,
-  pbkdf2,
-  pbkdf2Sync,
-  privateDecrypt,
-  privateEncrypt,
-  pseudoRandomBytes,
-  publicDecrypt,
-  publicEncrypt,
-  randomBytes,
-  randomFill,
-  randomFillSync,
-  getRandomValues,
-  randomUUID,
-  generateKeyPair,
-};
+// Export Web Crypto API from globalThis.crypto (edge runtime)
+export var webcrypto = (typeof globalThis !== 'undefined' && globalThis.crypto) || crypto.webcrypto;
+export var subtle = webcrypto?.subtle;
+export var CryptoKey = (typeof globalThis !== 'undefined' && globalThis.CryptoKey) || crypto.CryptoKey;
+export var KeyObject = crypto.KeyObject;

packages/bundler/src/polyfills/crypto/crypto.polyfills.js

@@ -39,6 +39,10 @@ export var { randomFillSync } = CRYPTO_CONTEXT.cryptoContext;
 export var { getRandomValues } = CRYPTO_CONTEXT.cryptoContext;
 export var { randomUUID } = CRYPTO_CONTEXT.cryptoContext;
 export var { generateKeyPair } = CRYPTO_CONTEXT.cryptoContext;
+export var { CryptoKey } = CRYPTO_CONTEXT.cryptoContext;
+export var { KeyObject } = CRYPTO_CONTEXT.cryptoContext;
+export var { webcrypto } = CRYPTO_CONTEXT.cryptoContext;
+export var { subtle } = CRYPTO_CONTEXT.cryptoContext;
 
 export default {
   Cipher,
@@ -75,4 +79,8 @@ export default {
   getRandomValues,
   randomUUID,
   generateKeyPair,
+  CryptoKey,
+  KeyObject,
+  subtle,
+  webcrypto,
 };

packages/unenv-preset/src/index.ts

@@ -17,6 +17,7 @@ export default {
     clearInterval: `${polyfillsPath}/node/globals/clear-interval.js`,
     console: `${polyfillsPath}/node/globals/console.js`,
     asyncStorage: `${polyfillsPath}/node/globals/async-storage.js`,
+    dateToString: `${polyfillsPath}/node/globals/date-to-string.js`,
   },
   alias: {
     'azion/utils': 'azion/utils',
@@ -25,6 +26,7 @@ export default {
     '@fastly/http-compute-js': '@fastly/http-compute-js',
     accepts: 'accepts',
     assert: 'assert-browserify',
+    buffer: `${polyfillsPath}/node/buffer.js`,
     https: `${polyfillsPath}/node/https.js`,
     module: `${polyfillsPath}/node/module.js`,
     string_decoder: 'string_decoder/lib/string_decoder.js',

packages/unenv-preset/src/polyfills/node/buffer.js

@@ -0,0 +1,109 @@
+import * as base64 from 'base64-js';
+import * as originalBuffer from 'unenv/node/buffer';
+
+if (!originalBuffer.Buffer.prototype.latin1Slice) {
+  originalBuffer.Buffer.prototype.latin1Slice = function (start, end) {
+    return originalBuffer.Buffer.from(this).toString('latin1', start, end);
+  };
+}
+if (!originalBuffer.Buffer.prototype.utf8Slice) {
+  originalBuffer.Buffer.prototype.utf8Slice = function (start, end) {
+    return originalBuffer.Buffer.from(this).toString('utf8', start, end);
+  };
+}
+
+// Store original methods
+const originalToString = originalBuffer.Buffer.prototype.toString;
+const originalWrite = originalBuffer.Buffer.prototype.write;
+const originalIsEncoding = originalBuffer.Buffer.prototype.isEncoding;
+
+// Helper functions for base64url conversion
+const INVALID_BASE64_RE = /[^+/0-9A-Za-z-_]/g;
+const BASE64_CHAR_62 = '+';
+const BASE64_CHAR_63 = '/';
+const BASE64URL_CHAR_62 = '-';
+const BASE64URL_CHAR_63 = '_';
+
+function base64urlFromBase64(str) {
+  return str.replaceAll(BASE64_CHAR_62, BASE64URL_CHAR_62).replaceAll(BASE64_CHAR_63, BASE64URL_CHAR_63);
+}
+
+function base64urlToBase64(str) {
+  return str.replaceAll(BASE64URL_CHAR_62, BASE64_CHAR_62).replaceAll(BASE64URL_CHAR_63, BASE64_CHAR_63);
+}
+
+// Override toString to support base64url encoding
+originalBuffer.Buffer.prototype.toString = function toString(encoding, start, end) {
+  if (encoding === 'base64url') {
+    return base64Slice(this, start, end, encoding);
+  }
+  if (encoding === 'base64') {
+    return base64Slice(this, start, end, encoding);
+  }
+  return originalToString.call(this, encoding, start, end);
+};
+
+function blitBuffer(src, dst, offset, length) {
+  let i;
+  for (i = 0; i < length; ++i) {
+    if (i + offset >= dst.length || i >= src.length) break;
+    dst[i + offset] = src[i];
+  }
+  return i;
+}
+
+function base64clean(str) {
+  // Node takes equal signs as end of the Base64 encoding
+  str = str.split('=')[0];
+  // Node strips out invalid characters like \n and \t from the string, base64-js does not
+  str = str.trim().replace(INVALID_BASE64_RE, '');
+  // Node converts strings with length < 2 to ''
+  if (str.length < 2) return '';
+  // Node allows for non-padded base64 strings (missing trailing ===), base64-js does not
+  while (str.length % 4 !== 0) {
+    str = str + '=';
+  }
+  return str;
+}
+
+function base64ToBytes(str) {
+  return base64.toByteArray(base64clean(str));
+}
+
+function base64Write(buf, string, offset, length, encoding) {
+  const b64 = encoding === 'base64url' ? base64urlToBase64(string) : string;
+  return blitBuffer(base64ToBytes(b64), buf, offset, length);
+}
+
+function base64Slice(buf, start, end, encoding) {
+  let b64;
+  if (start === 0 && end === buf.length) {
+    b64 = base64.fromByteArray(buf);
+  } else {
+    b64 = base64.fromByteArray(buf.slice(start, end));
+  }
+  return encoding === 'base64url' ? base64urlFromBase64(b64) : b64;
+}
+
+originalBuffer.Buffer.prototype.write = function write(string, offset, length, encoding) {
+  if (encoding === 'base64') {
+    return base64Write(this, string, offset, length, encoding);
+  }
+  return originalWrite.call(this, string, offset, length, encoding);
+};
+
+originalBuffer.Buffer.prototype.isEncoding = function isEncoding(encoding) {
+  if (String(encoding).toLowerCase() === 'base64url') {
+    return true;
+  }
+  return originalIsEncoding.call(this, encoding);
+};
+
+export * from 'unenv/node/buffer';
+
+export const Buffer = originalBuffer.Buffer;
+
+export default {
+  ...originalBuffer.default,
+  Buffer,
+};

packages/unenv-preset/src/polyfills/node/globals/date-to-string.js

@@ -0,0 +1,14 @@
+// TODO: fix temp, move to runtime
+const originalToString = Object.prototype.toString;
+
+// Override Object.prototype.toString to properly identify Date objects
+Object.prototype.toString = function () {
+  // Check if this is a Date instance
+  if (this instanceof Date || (this && typeof this.getTime === 'function' && typeof this.toISOString === 'function')) {
+    return '[object Date]';
+  }
+  // Fall back to original toString for other objects
+  return originalToString.call(this);
+};
+
+export default Object.prototype.toString;