diff --git a/dist/index.js b/dist/index.js index 06fe3a48..25c86c69 100644 --- a/dist/index.js +++ b/dist/index.js @@ -18963,6 +18963,26 @@ var EXPANSION_MAX = 100000 // characters) so legitimate input is unaffected. var EXPANSION_MAX_LENGTH = 4000000 +// `expand` recurses once per level of brace *nesting* - both when expanding a +// set's comma members and when re-wrapping a set whose body is a single part. +// The CVE-2026-14257 fix made the *tail* iterative (recursion on `m.post`, one +// level per chained group), which left nesting depth unbounded: about 3,100 +// levels of `{{{...a,b...}}}` - only ~6KB of input - exhausted the native stack +// and crashed the process. `EXPANSION_MAX_DEPTH` bounds how deep the parser +// will follow nesting. It sits far above any realistic pattern and well below +// the depth at which the stack runs out. +var EXPANSION_MAX_DEPTH = 1000 + +// Bash keeps a quirk where a brace group followed by a comma set still expands +// (`{a},b}`). The parser implements it by rewriting the string and restarting +// the scan, absorbing one `}` per pass. `n` trailing braces therefore cost `n` +// full passes over a string that itself grows by one `escClose` sentinel each +// time - quadratic in `n`, with a ~26x constant from the sentinel's length. +// 128KB of `'{a}' + '}'.repeat(n) + ',z}'` blocked the event loop for 27 +// seconds to produce two results. `EXPANSION_MAX_REWRITES` bounds how many +// times the scan may restart. Real `{a},b}` input needs a handful. +var EXPANSION_MAX_REWRITES = 1000 + function numeric(str) { return parseInt(str, 10) == str ? parseInt(str, 10) @@ -18986,34 +19006,54 @@ function unescapeBraces(str) { } +// Like `target.push(...items)` but doesn't overflow the stack +function pushAll(target, items) { + for (var i = 0; i < items.length; i++) { + target.push(items[i]); + } +} + // Basically just str.split(","), but handling cases // where we have nested braced sections, which should be // treated as individual members, like {a,{b,c},d} function parseCommaParts(str) { - if (!str) - return ['']; - var parts = []; - var m = balanced('{', '}', str); - if (!m) - return str.split(','); + // Walk the brace groups iteratively. Recursing on `post` once per group let a + // chain of them exhaust the stack - the parsing-side counterpart to + // the `expand` overflow fixed for CVE-2026-14257, and not something `max` or + // `maxLength` can bound, since it happens before expansion. + // + // The part the next chunk continues + var carry = ''; - var pre = m.pre; - var body = m.body; - var post = m.post; - var p = pre.split(','); + for (;;) { + var m = balanced('{', '}', str); - p[p.length-1] += '{' + body + '}'; - var postParts = parseCommaParts(post); - if (post.length) { - p[p.length-1] += postParts.shift(); - p.push.apply(p, postParts); - } + if (!m) { + var tail = str.split(','); + tail[0] = carry + tail[0]; + pushAll(parts, tail); + return parts; + } + + var pre = m.pre; + var body = m.body; + var post = m.post; + var p = pre.split(','); + + p[0] = carry + p[0]; + p[p.length-1] += '{' + body + '}'; - parts.push.apply(parts, p); + if (!post.length) { + pushAll(parts, p); + return parts; + } - return parts; + carry = p.pop(); + pushAll(parts, p); + str = post; + } } function expandTop(str, options) { @@ -19023,6 +19063,8 @@ function expandTop(str, options) { options = options || {}; var max = options.max == null ? EXPANSION_MAX : options.max; var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH : options.maxLength; + var maxDepth = options.maxDepth == null ? EXPANSION_MAX_DEPTH : options.maxDepth; + var maxRewrites = options.maxRewrites == null ? EXPANSION_MAX_REWRITES : options.maxRewrites; // I don't know why Bash 4.3 does this, but it does. // Anything starting with {} will have the first two bytes preserved @@ -19034,7 +19076,7 @@ function expandTop(str, options) { str = '\\{\\}' + str.substr(2); } - return expand(escapeBraces(str), max, maxLength, true).map(unescapeBraces); + return expand(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces); } function embrace(str) { @@ -19146,8 +19188,18 @@ function expand( str, max, maxLength, + maxDepth, + depth, + maxRewrites, isTop ) { + // Too deeply nested to keep following: treat the rest as literal, the same + // way a group that cannot expand is already handled. Truncating rather than + // throwing keeps expansion total, matching `max` and `maxLength`. + if (depth > maxDepth) { + return [str]; + } + // Consume the string's top-level brace groups left to right, threading a // running set of combined prefixes (`acc`). Expanding the tail iteratively - // rather than recursing on `m.post` once per group - keeps the native stack @@ -19160,6 +19212,9 @@ function expand( // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop // is on the final strings, so it is applied to whichever `combine` produces // them (the one with no brace set left in the tail). + // How many times the `{a},b}` rewrite below has restarted the scan. Each pass + // re-reads the whole string, so leaving this unbounded is quadratic. + var rewrites = 0 var dropEmpties = false var firstGroup = true @@ -19195,7 +19250,8 @@ function expand( var isOptions = m.body.indexOf(',') >= 0; if (!isSequence && !isOptions) { // {a},b} - if (m.post.match(/,(?!,).*\}/)) { + if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) { + rewrites++; str = m.pre + '{' + m.body + escClose + m.post; isTop = true; continue; @@ -19223,7 +19279,7 @@ function expand( var n = parseCommaParts(m.body); if (n.length === 1 && n[0] !== undefined) { // x{{a,b}}y ==> x{a}y x{b}y - n = expand(n[0], max, maxLength, false).map(embrace); + n = expand(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace); //XXX is this necessary? Can't seem to hit it in tests. /* c8 ignore start */ if (n.length === 1) { @@ -19257,7 +19313,7 @@ function expand( values = [] var valuesLength = 0 outer: for (var j = 0; j < n.length; j++) { - var expanded = expand(n[j], max, maxLength, false) + var expanded = expand(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false) for (var k = 0; k < expanded.length; k++) { var v = expanded[k] if (dropsEmpties && !v) continue @@ -67291,6 +67347,26 @@ var EXPANSION_MAX = 100000 // characters) so legitimate input is unaffected. var EXPANSION_MAX_LENGTH = 4000000 +// `expand` recurses once per level of brace *nesting* - both when expanding a +// set's comma members and when re-wrapping a set whose body is a single part. +// The CVE-2026-14257 fix made the *tail* iterative (recursion on `m.post`, one +// level per chained group), which left nesting depth unbounded: about 3,100 +// levels of `{{{...a,b...}}}` - only ~6KB of input - exhausted the native stack +// and crashed the process. `EXPANSION_MAX_DEPTH` bounds how deep the parser +// will follow nesting. It sits far above any realistic pattern and well below +// the depth at which the stack runs out. +var EXPANSION_MAX_DEPTH = 1000 + +// Bash keeps a quirk where a brace group followed by a comma set still expands +// (`{a},b}`). The parser implements it by rewriting the string and restarting +// the scan, absorbing one `}` per pass. `n` trailing braces therefore cost `n` +// full passes over a string that itself grows by one `escClose` sentinel each +// time - quadratic in `n`, with a ~26x constant from the sentinel's length. +// 128KB of `'{a}' + '}'.repeat(n) + ',z}'` blocked the event loop for 27 +// seconds to produce two results. `EXPANSION_MAX_REWRITES` bounds how many +// times the scan may restart. Real `{a},b}` input needs a handful. +var EXPANSION_MAX_REWRITES = 1000 + function numeric(str) { return parseInt(str, 10) == str ? parseInt(str, 10) @@ -67314,34 +67390,54 @@ function unescapeBraces(str) { } +// Like `target.push(...items)` but doesn't overflow the stack +function pushAll(target, items) { + for (var i = 0; i < items.length; i++) { + target.push(items[i]); + } +} + // Basically just str.split(","), but handling cases // where we have nested braced sections, which should be // treated as individual members, like {a,{b,c},d} function parseCommaParts(str) { - if (!str) - return ['']; - var parts = []; - var m = balanced('{', '}', str); - if (!m) - return str.split(','); + // Walk the brace groups iteratively. Recursing on `post` once per group let a + // chain of them exhaust the stack - the parsing-side counterpart to + // the `expand` overflow fixed for CVE-2026-14257, and not something `max` or + // `maxLength` can bound, since it happens before expansion. + // + // The part the next chunk continues + var carry = ''; - var pre = m.pre; - var body = m.body; - var post = m.post; - var p = pre.split(','); + for (;;) { + var m = balanced('{', '}', str); - p[p.length-1] += '{' + body + '}'; - var postParts = parseCommaParts(post); - if (post.length) { - p[p.length-1] += postParts.shift(); - p.push.apply(p, postParts); - } + if (!m) { + var tail = str.split(','); + tail[0] = carry + tail[0]; + pushAll(parts, tail); + return parts; + } + + var pre = m.pre; + var body = m.body; + var post = m.post; + var p = pre.split(','); + + p[0] = carry + p[0]; + p[p.length-1] += '{' + body + '}'; - parts.push.apply(parts, p); + if (!post.length) { + pushAll(parts, p); + return parts; + } - return parts; + carry = p.pop(); + pushAll(parts, p); + str = post; + } } function expandTop(str, options) { @@ -67351,6 +67447,8 @@ function expandTop(str, options) { options = options || {}; var max = options.max == null ? EXPANSION_MAX : options.max; var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH : options.maxLength; + var maxDepth = options.maxDepth == null ? EXPANSION_MAX_DEPTH : options.maxDepth; + var maxRewrites = options.maxRewrites == null ? EXPANSION_MAX_REWRITES : options.maxRewrites; // I don't know why Bash 4.3 does this, but it does. // Anything starting with {} will have the first two bytes preserved @@ -67362,7 +67460,7 @@ function expandTop(str, options) { str = '\\{\\}' + str.substr(2); } - return expand(escapeBraces(str), max, maxLength, true).map(unescapeBraces); + return expand(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces); } function embrace(str) { @@ -67474,8 +67572,18 @@ function expand( str, max, maxLength, + maxDepth, + depth, + maxRewrites, isTop ) { + // Too deeply nested to keep following: treat the rest as literal, the same + // way a group that cannot expand is already handled. Truncating rather than + // throwing keeps expansion total, matching `max` and `maxLength`. + if (depth > maxDepth) { + return [str]; + } + // Consume the string's top-level brace groups left to right, threading a // running set of combined prefixes (`acc`). Expanding the tail iteratively - // rather than recursing on `m.post` once per group - keeps the native stack @@ -67488,6 +67596,9 @@ function expand( // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop // is on the final strings, so it is applied to whichever `combine` produces // them (the one with no brace set left in the tail). + // How many times the `{a},b}` rewrite below has restarted the scan. Each pass + // re-reads the whole string, so leaving this unbounded is quadratic. + var rewrites = 0 var dropEmpties = false var firstGroup = true @@ -67523,7 +67634,8 @@ function expand( var isOptions = m.body.indexOf(',') >= 0; if (!isSequence && !isOptions) { // {a},b} - if (m.post.match(/,(?!,).*\}/)) { + if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) { + rewrites++; str = m.pre + '{' + m.body + escClose + m.post; isTop = true; continue; @@ -67551,7 +67663,7 @@ function expand( var n = parseCommaParts(m.body); if (n.length === 1 && n[0] !== undefined) { // x{{a,b}}y ==> x{a}y x{b}y - n = expand(n[0], max, maxLength, false).map(embrace); + n = expand(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace); //XXX is this necessary? Can't seem to hit it in tests. /* c8 ignore start */ if (n.length === 1) { @@ -67585,7 +67697,7 @@ function expand( values = [] var valuesLength = 0 outer: for (var j = 0; j < n.length; j++) { - var expanded = expand(n[j], max, maxLength, false) + var expanded = expand(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false) for (var k = 0; k < expanded.length; k++) { var v = expanded[k] if (dropsEmpties && !v) continue diff --git a/package-lock.json b/package-lock.json index 26004b7e..9d3423e8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3064,9 +3064,9 @@ } }, "node_modules/archiver-utils/node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -3377,9 +3377,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -4662,9 +4662,9 @@ } }, "node_modules/readdir-glob/node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0"