Harden Windows DLP enforcement and Electron runtime packaging

apps/browser/inspect-text-representations.cjs

@@ -0,0 +1,31 @@
+'use strict';
+let variants;
+// Inspect decoded text independently; concatenating it could dilute a semantic match.
+async function inspectTextRepresentations({bytes,policy,inspectLocal,inspectEnterprise,isCurrent,traceOperation=(_name,_facts,fn)=>fn()}){
+ const block=ruleId=>({decision:'block',ruleId});
+ let values;
+ try{const text=new TextDecoder('utf-8',{fatal:true}).decode(bytes);variants??=import('../../packages/core/text-variants.mjs');values=(await variants).inspectionTextVariants(text,policy.dlp.maxBytes);}
+ catch{return block('normalization-uninspectable');}
+ const current=()=>{try{return isCurrent()===true;}catch{return false;}};
+ if(policy.enterprise?.icap?.enabled&&policy.enterprise.icap.scanUploads!==false&&typeof inspectEnterprise!=='function')return block('icap-unavailable');
+ for(let index=0;index<values.length;index++){
+  if(!current())return block('inspection-context-changed');
+  const data=Buffer.from(values[index]);
+  try{
+   if(policy.dlp.semantic.enabled||policy.security.yara.enabled){
+    if(typeof inspectLocal!=='function')return block('inspector-unavailable');
+    const local=await traceOperation('text.local',{bytes:data.length,index,count:values.length},()=>inspectLocal(data,policy));
+    if(!current())return block('inspection-context-changed');
+    if(local?.decision!=='allow')return local?.decision==='block'?local:block('inspection-failed');
+    if(local.coverage?.complete!==true)return block('inspection-incomplete');
+   }
+   if(typeof inspectEnterprise==='function'){
+    const external=await traceOperation('text.enterprise',{bytes:data.length,index,count:values.length},()=>inspectEnterprise(data,policy));
+    if(!current())return block('inspection-context-changed');
+    if(external?.decision!=='allow'||external.coverage?.complete!==true)return external?.decision==='block'?external:block('inspection-incomplete');
+   }
+  }finally{data.fill(0);}
+ }
+ return current()?{decision:'allow',ruleId:null}:block('inspection-context-changed');
+}
+module.exports={inspectTextRepresentations};