Worker Rule Injection Demo

S4 — Coordinated AngularJS version rewrite

Obfuscation is not patching. This rewrites observable version strings to 1.99.9. It does not upgrade AngularJS at the source.

Origin serves real TodoMVC on AngularJS 1.8.2. This host rewrites every HTML/JS response so scanners never see 1.8.2.

Key questions

Question

How do parallel HTML and JavaScript requests share one safe rewrite plan?

The hostname-keyed SQLite Durable Object is authoritative. Discovery is serialized, the complete plan is persisted before waiters are released, and JavaScript-first requests are held until it is ready. Failure returns 503 rather than original bytes.

Success criteria / proof

  1. Original version is hidden.Tested HTML and JavaScript responses contain no 1.8.2 and expose the replacement marker.
  2. One plan coordinates parallel requests.Cold HTML and five parallel JavaScript requests use the hostname coordinator without releasing unrewritten bytes.
  3. Ready plans apply consistently.A published plan is reused for later HTML and JavaScript responses with no-store response headers.
  4. Discovery failures fail closed.Core failure, timeout, or publish failure returns 503 instead of original AngularJS bytes.
  5. TodoMVC remains functional.The rewritten application supports add, edit, complete, and remove behavior.
Direct Origins4-origin.thecompany-lab.com
Capability Workers4.thecompany-lab.com
JavaScript sources
Rewritten angular.jsRewritten app.js

1. Browser verification

Run a read-only validation. Each row names the action, expected result, observed result, and status; no account or origin state is changed.

Not run yet.

2. Command-line verification (copy and run)

Step 1 — Capture the before document and core

The direct origin should expose AngularJS 1.8.2 in both HTML and JavaScript.

curl -sS https://s4-origin.thecompany-lab.com/ | grep -o 'ng-version="[^"]*"'
curl -sS https://s4-origin.thecompany-lab.com/angular.js | grep -o "full: '[^']*'" | head -1

Step 2 — Verify the after document and core

The capability should replace the observable version marker before delivery.

curl -sS https://s4.thecompany-lab.com/ | grep -c '1.8.2'          # expect 0
curl -sS https://s4.thecompany-lab.com/ | grep -o 'ng-version="[^"]*"'  # expect 1.99.9
curl -sS https://s4.thecompany-lab.com/angular.js | grep -c '1.8.2' # expect 0
curl -sS https://s4.thecompany-lab.com/angular.js | grep -o "full: '[^']*'" | head -1

Step 3 — Spot-check every JavaScript response

Parallel module responses should use the same published rewrite plan.

for p in module-a.js module-b.js module-c.js module-d.js app.js; do
  printf '%s: ' "$p"
  curl -sS "https://s4.thecompany-lab.com/$p" | grep -c '1.8.2'
done   # every count should be 0

Step 4 — Verify fail-closed response headers

Rewritten resources should not be cacheable as original-version content.

curl -sS -D - -o /dev/null https://s4.thecompany-lab.com/   | grep -iE '^(HTTP|cache-control|cache-tag|x-rs-plan-version)'