Skip to content

Commit 94c2f33

Browse files
committed
working witness proxy
1 parent 35401da commit 94c2f33

File tree

5 files changed

+27
-12
lines changed

5 files changed

+27
-12
lines changed

package-lock.json

+7-8
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@zkp2p/reclaim-witness-sdk",
3-
"version": "0.0.3-rc1",
3+
"version": "4.0.0-rc1",
44
"description": "",
55
"main": "lib/index",
66
"scripts": {

provider-schemas/http/parameters.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,11 @@ properties:
9898
description: >-
9999
Inverses the matching logic.
100100
Fail when match is found and proceed otherwise
101+
unsafeHash:
102+
type: boolean
103+
description: >-
104+
If true, the hash will be computed using a simple keccak256 hash which does not
105+
use the OPRF protocol. This may be rainbow table attack vulnerable.
101106
additionalProperties: false
102107
responseRedactions:
103108
type: array

src/providers/http/index.ts

+8-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import { concatenateUint8Arrays, strToUint8Array, TLSConnectionOptions } from '@reclaimprotocol/tls'
2+
import { utils } from 'ethers'
23
import { base64 } from 'ethers/lib/utils'
34
import { DEFAULT_HTTPS_PORT, RECLAIM_USER_AGENT } from 'src/config'
45
import {
@@ -329,7 +330,8 @@ const HTTP_PROVIDER: Provider<'http'> = {
329330
}
330331

331332

332-
for(const { type, value, invert } of params.responseMatches || []) {
333+
for(const { type, value, invert, unsafeHash } of params.responseMatches || []) {
334+
const convertedUnsafeHash = Boolean(unsafeHash)
333335
const inv = Boolean(invert) // explicitly cast to boolean
334336

335337
switch (type) {
@@ -353,7 +355,11 @@ const HTTP_PROVIDER: Provider<'http'> = {
353355
throw new Error(`Duplicate parameter ${paramName}`)
354356
}
355357

356-
extractedParams[paramName] = groups[paramName]
358+
if(convertedUnsafeHash) {
359+
extractedParams[paramName] = utils.keccak256(strToUint8Array(groups[paramName]))
360+
} else {
361+
extractedParams[paramName] = groups[paramName]
362+
}
357363
}
358364

359365
break

src/types/providers.gen.ts

+6-1
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,11 @@ export interface HttpProviderParameters {
5555
* Inverses the matching logic. Fail when match is found and proceed otherwise
5656
*/
5757
invert?: boolean;
58+
/**
59+
* If true, the hash will be computed using a simple keccak256 hash which does not
60+
* use the OPRF protocol. This may be rainbow table attack vulnerable.
61+
*/
62+
unsafeHash?: boolean;
5863
}[];
5964
/**
6065
* which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. "HTTP/1.1 200 OK") * To disable any redactions, pass an empty array
@@ -87,7 +92,7 @@ export interface HttpProviderParameters {
8792
};
8893
}
8994

90-
export const HttpProviderParametersJson = {"title":"HttpProviderParameters","type":"object","required":["url","method","responseMatches"],"properties":{"url":{"type":"string","format":"url","description":"which URL does the request have to be made to Has to be a valid https URL for eg. https://amazon.in/orders?q=abcd"},"method":{"type":"string","enum":["GET","POST","PUT","PATCH"]},"geoLocation":{"type":"string","nullable":true,"pattern":"^[A-Za-z]{0,2}$","description":"Specify the geographical location from where to proxy the request. 2-letter ISO country code"},"headers":{"type":"object","description":"Any additional headers to be sent with the request Note: these will be revealed to the attestor & won't be redacted from the transcript. To add hidden headers, use 'secretParams.headers' instead","additionalProperties":{"type":"string"}},"body":{"description":"Body of the HTTP request","oneOf":[{"type":"string","format":"binary"},{"type":"string"}]},"writeRedactionMode":{"type":"string","description":"If the API doesn't perform well with the \"key-update\" method of redaction, you can switch to \"zk\" mode by setting this to \"zk\"","enum":["zk","key-update"]},"additionalClientOptions":{"type":"object","description":"Apply TLS configuration when creating the tunnel to the attestor.","nullable":true,"properties":{"supportedProtocolVersions":{"type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string","enum":["TLS1_2","TLS1_3"]}}}},"responseMatches":{"type":"array","minItems":1,"uniqueItems":true,"description":"The attestor will use this list to check that the redacted response does indeed match all the provided strings/regexes","items":{"type":"object","required":["value","type"],"properties":{"value":{"type":"string","description":"\"regex\": the response must match the regex \"contains\": the response must contain the provided\n string exactly"},"type":{"type":"string","description":"The string/regex to match against","enum":["regex","contains"]},"invert":{"type":"boolean","description":"Inverses the matching logic. Fail when match is found and proceed otherwise"}},"additionalProperties":false}},"responseRedactions":{"type":"array","uniqueItems":true,"description":"which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. \"HTTP/1.1 200 OK\") * To disable any redactions, pass an empty array","items":{"type":"object","properties":{"xPath":{"type":"string","nullable":true,"description":"expect an HTML response, and to contain a certain xpath for eg. \"/html/body/div.a1/div.a2/span.a5\""},"jsonPath":{"type":"string","nullable":true,"description":"expect a JSON response, retrieve the item at this path using dot notation for e.g. 'email.addresses.0'"},"regex":{"type":"string","nullable":true,"description":"select a regex match from the response"},"hash":{"type":"string","description":"If provided, the value inside will be hashed instead of being redacted. Useful for cases where the data inside is an identifiying piece of information that you don't want to reveal to the attestor, eg. an email address.\nIf the hash function produces more bytes than the original value, the hash will be truncated.\nEg. if hash is enabled, the original value is \"hello\", and hashed is \"a1b2c\", then the attestor will only see \"a1b2c\".","enum":["oprf"]}},"additionalProperties":false}},"paramValues":{"type":"object","description":"A map of parameter values which are user in form of {{param}} in URL, responseMatches, responseRedactions, body, geolocation. Those in URL, responseMatches & geo will be put into context and signed This value will NOT be included in provider hash","additionalProperties":{"type":"string"}}},"additionalProperties":false}
95+
export const HttpProviderParametersJson = {"title":"HttpProviderParameters","type":"object","required":["url","method","responseMatches"],"properties":{"url":{"type":"string","format":"url","description":"which URL does the request have to be made to Has to be a valid https URL for eg. https://amazon.in/orders?q=abcd"},"method":{"type":"string","enum":["GET","POST","PUT","PATCH"]},"geoLocation":{"type":"string","nullable":true,"pattern":"^[A-Za-z]{0,2}$","description":"Specify the geographical location from where to proxy the request. 2-letter ISO country code"},"headers":{"type":"object","description":"Any additional headers to be sent with the request Note: these will be revealed to the attestor & won't be redacted from the transcript. To add hidden headers, use 'secretParams.headers' instead","additionalProperties":{"type":"string"}},"body":{"description":"Body of the HTTP request","oneOf":[{"type":"string","format":"binary"},{"type":"string"}]},"writeRedactionMode":{"type":"string","description":"If the API doesn't perform well with the \"key-update\" method of redaction, you can switch to \"zk\" mode by setting this to \"zk\"","enum":["zk","key-update"]},"additionalClientOptions":{"type":"object","description":"Apply TLS configuration when creating the tunnel to the attestor.","nullable":true,"properties":{"supportedProtocolVersions":{"type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string","enum":["TLS1_2","TLS1_3"]}}}},"responseMatches":{"type":"array","minItems":1,"uniqueItems":true,"description":"The attestor will use this list to check that the redacted response does indeed match all the provided strings/regexes","items":{"type":"object","required":["value","type"],"properties":{"value":{"type":"string","description":"\"regex\": the response must match the regex \"contains\": the response must contain the provided\n string exactly"},"type":{"type":"string","description":"The string/regex to match against","enum":["regex","contains"]},"invert":{"type":"boolean","description":"Inverses the matching logic. Fail when match is found and proceed otherwise"}, "unsafeHash":{"type":"boolean","description":"Hashes the value using keccak256"}},"additionalProperties":false}},"responseRedactions":{"type":"array","uniqueItems":true,"description":"which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. \"HTTP/1.1 200 OK\") * To disable any redactions, pass an empty array","items":{"type":"object","properties":{"xPath":{"type":"string","nullable":true,"description":"expect an HTML response, and to contain a certain xpath for eg. \"/html/body/div.a1/div.a2/span.a5\""},"jsonPath":{"type":"string","nullable":true,"description":"expect a JSON response, retrieve the item at this path using dot notation for e.g. 'email.addresses.0'"},"regex":{"type":"string","nullable":true,"description":"select a regex match from the response"},"hash":{"type":"string","description":"If provided, the value inside will be hashed instead of being redacted. Useful for cases where the data inside is an identifiying piece of information that you don't want to reveal to the attestor, eg. an email address.\nIf the hash function produces more bytes than the original value, the hash will be truncated.\nEg. if hash is enabled, the original value is \"hello\", and hashed is \"a1b2c\", then the attestor will only see \"a1b2c\".","enum":["oprf"]}},"additionalProperties":false}},"paramValues":{"type":"object","description":"A map of parameter values which are user in form of {{param}} in URL, responseMatches, responseRedactions, body, geolocation. Those in URL, responseMatches & geo will be put into context and signed This value will NOT be included in provider hash","additionalProperties":{"type":"string"}}},"additionalProperties":false}
9196
/**
9297
* Secret parameters to be used with HTTP provider. None of the values in this object will be shown to the attestor
9398
*/

0 commit comments

Comments
 (0)