Enum SandboxError 

pub enum SandboxError {
    NotCompiledIn,
    BodyTooLarge,
    Timeout,
    OutOfMemory,
    StackOverflow,
    PhaseDenied(String),
    NoBindings,
    PanicCaptured(String),
    ScriptError(String),
    RegexRejected(String),
    WallTimeExceeded(String),
}

Errors the runtime adapter can emit. Every variant is recoverable at the dispatch site — the parent flatten never aborts because of a sandbox error (S-17 fail-open).

Variants

NotCompiledIn

Cargo feature xfa-js-sandboxed not compiled in. Returned by the null::NullRuntime for every execute_script call.

BodyTooLarge

Script body exceeds the per-script size cap (S-11; default 64 KB).

Timeout

Per-script time budget exceeded (S-9; default 100 ms hard).

OutOfMemory

Per-document memory budget exceeded (S-10; default 32 MiB hard).

StackOverflow

Call stack depth exceeded the configured maximum (S-12; default 64).

PhaseDenied(String)

Activity not in the runtime allowlist for sandboxed dispatch (S-14). UI / submission activities skip the runtime entirely at the dispatch boundary and never reach this error path; this variant exists for explicit binding-level phase guards.

NoBindings

Phase B: no host bindings registered. Returned when a script attempts to read or write any xfa.* / field.* binding the adapter has not yet exposed.

PanicCaptured(String)

FFI panic captured via std::panic::catch_unwind. Used by the rquickjs backend to keep panics from crossing the FFI boundary into the Rust caller.

ScriptError(String)

Generic script-level error: parse, runtime, or thrown JS error.

RegexRejected(String)

W3-A — REDOS-01 mitigation: the script body contains a regex pattern shape known to cause catastrophic backtracking in QuickJS’s NFA-based engine (e.g. (a+)+$). The body is rejected before reaching the sandbox to bound CPU time. See crates/pdf-xfa/src/js_runtime/regex_guard.rs for the heuristic catalogue.

WallTimeExceeded(String)

QF1-E / SEC-01 — defence-in-depth wall-time fallback. The primary per-script time budget is enforced via the rquickjs interrupt handler that polls at JS opcode boundaries (see SandboxError::Timeout). When the interrupt callback fails to fire for an extended period — for example because execution is trapped inside a single C-level call (regex, JSON.parse on a pathological input, host binding routine) that does not yield opcode boundaries — the wall-clock can drift well beyond the configured budget. This variant is emitted when total elapsed time crossed the fallback threshold (WALLTIME_FALLBACK_MULTIPLIER_DEFAULT × the configured time budget). It is strictly a post-hoc classification: the primary interrupt path remains in charge of actually aborting script execution; this variant simply re-labels the error so observability can distinguish “clean stop at budget” from “stop dragged past 5×”. See crates/pdf-xfa/src/js_runtime/rquickjs_backend.rs and the QF1_E report under benchmarks/runs/xfa_enterprise_plan/quality_factory_v1/.

Trait Implementations

impl Clone for SandboxError

fn clone(&self) -> SandboxError

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for SandboxError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for SandboxError

impl Error for SandboxError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for SandboxError

fn eq(&self, other: &SandboxError) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for SandboxError