Inline worker dispatch validation to satisfy CodeQL dynamic-call check

- worker.jsCryptoRunner performs the dynamic lookup, own-property checks (hasOwnProperty for both operationType and algorithm name), and the function-type check all locally, matching the pattern CodeQL's unvalidated-dynamic-method-call query recognizes as safe. Excludes inherited Object.prototype members and non-function values.
- Remove now-unused operations.get; operations.exists retained for subtleInterface validation
- Rebuild dist bundles

Author: ljoy913

dist/msrcrypto.js

@@ -67,12 +67,6 @@ operations.exists = function(operationType, algorithmName) {
         typeof op[algorithmName] === "function";
 };
 
-operations.get = function(operationType, algorithmName) {
-    return operations.exists(operationType, algorithmName)
-        ? operations[operationType][algorithmName]
-        : null;
-};
-
 var scriptUrl = (function() {
 
     if (typeof document !== "undefined") {
@@ -864,7 +858,18 @@ var msrcryptoWorker = (function() {
                 result,
                 p = e.data;
 
-            var func = operations.get(operation, algorithmName);
+            if (!Object.prototype.hasOwnProperty.call(operations, operation)) {
+                throw new Error("unregistered algorithm.");
+            }
+
+            var algorithmMap = operations[operation];
+
+            if (typeof algorithmMap !== "object" || algorithmMap === null ||
+                !Object.prototype.hasOwnProperty.call(algorithmMap, algorithmName)) {
+                throw new Error("unregistered algorithm.");
+            }
+
+            var func = algorithmMap[algorithmName];
 
             if (typeof func !== "function") {
                 throw new Error("unregistered algorithm.");

dist/msrcrypto.min.js

@@ -44,11 +44,3 @@ operations.exists = function(operationType, algorithmName) {
     return Object.prototype.hasOwnProperty.call(op, algorithmName) &&
         typeof op[algorithmName] === "function";
 };
-
-// Safe accessor: returns the registered function or null.
-// Never resolves to an inherited Object.prototype member.
-operations.get = function(operationType, algorithmName) {
-    return operations.exists(operationType, algorithmName)
-        ? operations[operationType][algorithmName]
-        : null;
-};

src/operations.js

@@ -46,11 +46,26 @@ var msrcryptoWorker = (function() {
                 result,
                 p = e.data;
 
-            var func = operations.get(operation, algorithmName);
+            // Resolve the registered handler with the dynamic lookup, the
+            // own-property checks, and the function-type check all performed
+            // locally. This matches the pattern CodeQL's "unvalidated dynamic
+            // method call" query recognizes as safe, and ensures a
+            // user-controlled operation/algorithm name can never dispatch to an
+            // inherited Object.prototype member (valueOf, hasOwnProperty, ...)
+            // or to a non-function value.
+            if (!Object.prototype.hasOwnProperty.call(operations, operation)) {
+                throw new Error("unregistered algorithm.");
+            }
+
+            var algorithmMap = operations[operation];
+
+            if (typeof algorithmMap !== "object" || algorithmMap === null ||
+                !Object.prototype.hasOwnProperty.call(algorithmMap, algorithmName)) {
+                throw new Error("unregistered algorithm.");
+            }
+
+            var func = algorithmMap[algorithmName];
 
-            // Explicit own-property + function-type validation at the call site
-            // so the dynamically resolved handler can never dispatch to an
-            // inherited Object.prototype member or a non-function value.
             if (typeof func !== "function") {
                 throw new Error("unregistered algorithm.");
             }