Parent: #1
Problem
The structured-clone wire format currently serializes a retained SharedBufferStorage address as a raw u64. deserialize() and releaseSerialized() convert that field back to a pointer and dereference it without proving that the stream actually minted and owns a retained reference.
The normal Worker path only consumes engine-produced streams, but these helpers are public and malformed or replayed bytes must fail closed. A forged address can become an invalid pointer dereference; a replayed legitimate address can consume a reference more than once. Deserialization also accepts trailing bytes, which can hide unconsumed retained references.
Goal
Replace raw SAB addresses in structured-clone streams with opaque, unguessable, single-use transfer tokens backed by a thread-safe registry. Consuming or releasing a token must atomically remove it before returning the retained storage reference.
Acceptance criteria
- Serialized SAB payloads contain no process pointer.
- Arbitrary, unknown, and replayed tokens fail closed without dereferencing attacker-controlled addresses.
- Successful deserialization consumes exactly one retained reference and transfers it to the wrapper.
releaseSerialized()consumes and releases each valid token at most once.- Wrapper-construction failure releases a token that was already consumed.
- Deserialization rejects trailing bytes and does not silently strand valid trailing SAB tokens.
- Focused tests cover valid transfer, forged token, replay, release, trailing bytes, and concurrent token consumption.
- The structured-clone and thread security docs describe the opaque-token contract.