Palmer’s Law: tracking down retardation in the NaCl library

Previously: Palmer’s Law

About a year ago, I was writing a browser extension crypto wallet. To actually call the cryptography routines, I needed to use the TweetNaCl library (which is pretty good all things considered; definitely recommend it if you have to call cryptography routines from JS). For some reason, the calls my extension was making into NaCl weren’t working at all. I kept notes as I went to hunt down the source of the issue. I think (in particular) newer programmers would find the notes educational, as it illustrates what the process for hunting down weird heisenbugs is actually like. So here they are:

NACL is mentally disabled and can’t be loaded as an ES6 module. That
is, it can’t be “imported” using

import * as nacl from './path/to/nacl.js';

Instead you have to include it in a page. So we have a page called
background.html.

I naively tried this

<script src="dist/jex_include/local-nacl-1.0.3/nacl.js"></script>

That of course didn’t work because we live in hell.

ok so the problem is not an invalid hash, it’s something specific to
nacl

to have an inline script, its hash must be specified in
manifest.json

example (integrity key is not necessary, it is there purely for
comment purposes)

 beginning of line
V
|        <script integrity="sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=">console.log('bg-test-inline.js line 1!');
|</script>

newline is there for hash purposes

this works if and only if
‘sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=’ is included in the
manifest.json

example (top level key):

 "content_security_policy" : "script-src 'self' 'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw='; object-src 'self'",

Absent that explicit allow, I get this error from Firefox:

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).

Refs: 1.
https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy
2.
https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy#inline_javascript

If I include the same script as a file,

<script src="bg-test-inline.js"></script>

this works irrespective of if I specify it as allowable in the
manifest

nacl is just refusing to load

Loading failed for the <script> with source “moz-extension://eafd6a74-b75b-4312-9a34-8087b68395e7/dist/jex_include/local-nacl-1.0.3/nacl.js”.

I initially thought it was a hash problem, but it is not

TweetNaCL doesn’t work as an ES6 module, it works by destructively
updating the window namespace. This I think was necessary before ES6,
and that behavior is retained either because of laziness or because of
backward compatibility reasons.

hmm

so this just plainly doesn’t work and i cannot figure out why

<script src="dist/jex_include/local-nacl-1.0.3/nacl.js"></script>

I think it works if I do it in the popup window instead. Let’s
try

oh no

no

oh my god

i am so stupid

the problem was that i typed the url wrong

the package is “tweetnacl” not “nacl”, and i also need /dist/ too

<script src="dist/jex_include/local-tweetnacl-1.0.3/dist/nacl.js"></script>

that works

all this time i thought that it was the browser that was mentally
disabled

it turned out the mental disability was inside me all along

alright well I discovered a potential future pitfall at least

(Source)