orb_template 0.1.3 → 0.2.2

data/lib/orb/tokenizer2.rb

@@ -18,6 +18,12 @@ module ORB
     # Tags that should be ignored
     IGNORED_BODY_TAGS = %w[script style].freeze
 
+    # Maximum allowed brace nesting depth to prevent memory exhaustion
+    MAX_BRACE_DEPTH = 100
+
+    # Maximum allowed template source size in bytes (2MB)
+    MAX_TEMPLATE_SIZE = 2 * 1024 * 1024
+
     # Tags that are self-closing by HTML5 spec
     VOID_ELEMENTS     = %w[area base br col command embed hr img input keygen link meta param source track wbr].freeze
 
@@ -28,7 +34,6 @@ module ORB
       @raise_errors = options.fetch(:raise_errors, true)
 
       # Streaming Tokenizer State
-      @cursor = 0
       @column = 1
       @line = 1
       @errors = []
@@ -36,11 +41,15 @@ module ORB
       @attributes = []
       @braces = []
       @state = :initial
-      @buffer = StringIO.new
+      @buffer = +''
     end
 
     # Main Entry
     def tokenize
+      if @source.string.bytesize > MAX_TEMPLATE_SIZE
+        raise ORB::SyntaxError.new("Template exceeds maximum size (#{MAX_TEMPLATE_SIZE} bytes)", 0)
+      end
+
       next_token until @source.eos?
 
       # Consume remaining buffer
@@ -56,11 +65,6 @@ module ORB
 
     # Dispatcher based on current state
     def next_token
-      # Detect infinite loop
-      # if @previous_cursor == @cursor && @previous_state == @state
-      #   raise "Internal Error: detected infinite loop in :#{@state}"
-      # end
-
       # Dispatch to state handler
       send(:"next_in_#{@state}")
     end
@@ -114,7 +118,7 @@ module ORB
         add_token(:tag_open, nil)
         move_by_matched
         transition_to(:tag_open)
-      elsif @source.scan(OTHER)
+      elsif @source.scan(INITIAL_TEXT) || @source.scan(OTHER)
         buffer_matched
         move_by_matched
       else
@@ -233,7 +237,7 @@ module ORB
         current_attribute[2] = attribute_value
         move_by_matched
         transition_to(:tag_open_content)
-      elsif @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(BLANK) || @source.scan(OTHER)
+      elsif @source.scan(SINGLE_QUOTED_TEXT) || @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(OTHER)
         buffer_matched
         move_by_matched
       else
@@ -249,7 +253,7 @@ module ORB
         current_attribute[2] = attribute_value
         move_by_matched
         transition_to(:tag_open_content)
-      elsif @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(BLANK) || @source.scan(OTHER)
+      elsif @source.scan(DOUBLE_QUOTED_TEXT) || @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(OTHER)
         buffer_matched
         move_by_matched
       else
@@ -260,7 +264,7 @@ module ORB
     # Read next token in :attribute_value_expression state
     def next_in_attribute_value_expression
       if @source.scan(BRACE_OPEN)
-        @braces << "{"
+        push_brace
         buffer_matched
         move_by_matched
       elsif @source.scan(BRACE_CLOSE)
@@ -275,7 +279,7 @@ module ORB
           move_by_matched
           transition_to(:tag_open_content)
         end
-      elsif @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(BLANK) || @source.scan(OTHER)
+      elsif @source.scan(EXPRESSION_TEXT) || @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(OTHER)
         buffer_matched
         move_by_matched
       else
@@ -286,7 +290,7 @@ module ORB
     # Read next token in :splat_attribute_expression state
     def next_in_splat_attribute_expression
       if @source.scan(BRACE_OPEN)
-        @braces << "{"
+        push_brace
         buffer_matched
         move_by_matched
       elsif @source.scan(BRACE_CLOSE)
@@ -301,7 +305,7 @@ module ORB
           clear_braces
           transition_to(:tag_open_content)
         end
-      elsif @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(BLANK) || @source.scan(OTHER)
+      elsif @source.scan(EXPRESSION_TEXT) || @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(OTHER)
         buffer_matched
         move_by_matched
       else
@@ -346,7 +350,7 @@ module ORB
         update_current_token(text)
         move_by_matched
         transition_to(:initial)
-      elsif @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(BLANK) || @source.scan(OTHER)
+      elsif @source.scan(COMMENT_TEXT) || @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(OTHER)
         buffer_matched
         move_by_matched
       else
@@ -361,7 +365,7 @@ module ORB
         update_current_token(text)
         move_by_matched
         transition_to(:initial)
-      elsif @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(BLANK) || @source.scan(OTHER)
+      elsif @source.scan(COMMENT_TEXT) || @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(OTHER)
         buffer_matched
         move_by_matched
       else
@@ -385,7 +389,7 @@ module ORB
     # Read block expression until closing brace
     def next_in_block_open_content
       if @source.scan(BRACE_OPEN)
-        @braces << "{"
+        push_brace
         buffer_matched
         move_by_matched
       elsif @source.scan(BRACE_CLOSE)
@@ -399,7 +403,7 @@ module ORB
           buffer_matched
           move_by_matched
         end
-      elsif @source.scan(BLANK) || @source.scan(OTHER)
+      elsif @source.scan(BLOCK_CONTENT_TEXT) || @source.scan(OTHER)
         buffer_matched
         move_by_matched
       end
@@ -437,7 +441,7 @@ module ORB
         move_by_matched
         transition_to(:initial)
       elsif @source.scan(BRACE_OPEN)
-        @braces << "{"
+        push_brace
         buffer_matched
         move_by_matched
       elsif @source.scan(BRACE_CLOSE)
@@ -462,7 +466,7 @@ module ORB
         move_by_matched
         transition_to(:initial)
       elsif @source.scan(BRACE_OPEN)
-        @braces << "{"
+        push_brace
         buffer_matched
         move_by_matched
       elsif @source.scan(BRACE_CLOSE)
@@ -498,7 +502,7 @@ module ORB
           buffer(tmp)
           move_by(tmp)
         end
-      elsif @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(BLANK) || @source.scan(OTHER)
+      elsif @source.scan(VERBATIM_TEXT) || @source.scan(NEWLINE) || @source.scan(CRLF) || @source.scan(OTHER)
         buffer_matched
         move_by_matched
       end
@@ -537,20 +541,29 @@ module ORB
       @braces = []
     end
 
+    def push_brace
+      if @braces.length >= MAX_BRACE_DEPTH
+        raise ORB::SyntaxError.new("Maximum brace nesting depth (#{MAX_BRACE_DEPTH}) exceeded", @line)
+      end
+
+      @braces << "{"
+    end
+
     # Moves the cursor
     def move(line, column)
       @line = line
       @column = column
     end
 
+    # Update line/column tracking from a matched string.
+    # Uses String#count and String#rindex instead of re-scanning with StringScanner.
     def move_by(str)
-      scan = StringScanner.new(str)
-      until scan.eos?
-        if scan.scan(NEWLINE) || scan.scan(CRLF)
-          move(@line + 1, 1)
-        elsif scan.scan(OTHER)
-          move(@line, @column + scan.matched.size)
-        end
+      newlines = str.count("\n")
+      if newlines.positive?
+        @line += newlines
+        @column = str.length - str.rindex("\n")
+      else
+        @column += str.length
       end
     end
 
@@ -565,7 +578,11 @@ module ORB
 
     # Create a new token
     def create_token(type, value, meta = {})
-      Token.new(type, value, meta.merge(line: @line, column: @column) { |_k, v1, _v2| v1 })
+      if meta.empty?
+        Token.new(type, value, { line: @line, column: @column })
+      else
+        Token.new(type, value, { line: @line, column: @column }.merge!(meta))
+      end
     end
 
     # Create a token and add it to the token list
@@ -586,18 +603,18 @@ module ORB
 
     # Read the buffer to a string
     def read_buffer
-      @buffer.string.clone
+      @buffer.dup
     end
 
     # Clear the buffer
     def clear_buffer
-      @buffer = StringIO.new
+      @buffer = +''
     end
 
     # Read the buffer to a string and clear it
     def consume_buffer
-      str = read_buffer
-      clear_buffer
+      str = @buffer
+      @buffer = +''
       str
     end
 

data/lib/orb/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ORB
-  VERSION = "0.1.3"
+  VERSION = "0.2.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: orb_template
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.2.2
 platform: ruby
 authors:
 - KUY.io Inc.
@@ -39,6 +39,7 @@ files:
 - Makefile
 - README.md
 - Rakefile
+- docs/2026-03-12-security-analysis.md
 - lib/orb.rb
 - lib/orb/ast.rb
 - lib/orb/ast/abstract_node.rb
@@ -98,7 +99,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.6
 specification_version: 4
 summary: The ORB template language for Ruby.
 test_files: []