@blamejs/blamejs-shop 0.5.19 → 0.5.20

package/lib/site-redirects.js

@@ -240,18 +240,29 @@ function _epochMs(n, label) {
   return n;
 }
 
-// Refuse regex patterns that carry backreferences (`\1`..`\9`) or
-// lookahead/lookbehind (`(?=...)`, `(?!...)`, `(?<=...)`, `(?<!...)`).
-// These are the two regex-shape categories that drive catastrophic
-// backtracking under adversarial input. Operators wanting these
-// shapes register multiple `prefix` / `exact` rules instead — the
-// regex match_kind is for cheap path-translation, not arbitrary
-// pattern matching.
+// Compile an operator's redirect pattern, anchored with `^` and `$` so
+// `resolveForPath` answers an exact-path match rather than a substring one
+// (`/foo` must not find `/foo/bar`).
 //
-// `_compileRegex` walks the source for the forbidden tokens BEFORE
-// handing it to RegExp(), then anchors the compiled pattern with `^`
-// and `$` so `resolveForPath` answers an exact-path match (not a
-// substring match a la `/foo` finding `/foo/bar`).
+// The pattern is matched by b.regexLinear, which simulates every path through
+// it one character at a time, so the work cannot grow faster than the subject
+// times the pattern no matter what the operator wrote. That replaces the
+// screen this used to run — a walker for backreferences and lookaround, then
+// b.guardRegex for backtracking shapes.
+//
+// Screening was always an approximation in both directions: it refused
+// patterns that were perfectly linear, and it could not promise to catch every
+// shape that was not, so each shape it missed became another case to add. The
+// patterns it existed to stop — `(a+)+`, `(a|a)*` — are now simply run: on two
+// thousand characters they finish in about two milliseconds where the platform
+// engine takes the better part of a minute. An operator gets their pattern
+// accepted and the request path stays bounded, which is what the screen was
+// trying and failing to deliver.
+//
+// Three constructs still cannot be simulated this way and are refused by name:
+// a backreference, a lookaround, and a repetition whose body can match nothing.
+// Each is mapped below into this module's TypeError envelope so a caller sees
+// one error shape.
 function _compileRegex(source) {
   if (typeof source !== "string" || !source.length) {
     throw new TypeError("siteRedirects: source_path (regex) must be a non-empty string");
@@ -264,124 +275,36 @@ function _compileRegex(source) {
   if (CONTROL_BYTE_RE.test(source) || ZERO_WIDTH_RE.test(source)) {
     throw new TypeError("siteRedirects: regex source contains control / zero-width bytes");
   }
-  // Backreferences: \1 .. \9 outside a character class. The walker
-  // tracks character-class depth so `[\1]` (literal byte) doesn't
-  // trip the gate, but `(.)\1` (a real backreference) does.
-  var inClass = 0;
-  for (var i = 0; i < source.length; i += 1) {
-    var ch = source.charAt(i);
-    if (ch === "\\" && i + 1 < source.length) {
-      var nxt = source.charAt(i + 1);
-      if (inClass === 0 && nxt >= "1" && nxt <= "9") {
-        throw new TypeError(
-          "siteRedirects: regex backreferences (\\1..\\9) refused — operators register " +
-          "separate redirect rows for each variant instead"
-        );
-      }
-      i += 1;                                                          // skip escaped char
-      continue;
-    }
-    if (ch === "[") { inClass += 1; continue; }
-    if (ch === "]" && inClass > 0) { inClass -= 1; continue; }
-    if (inClass > 0) continue;
-    if (ch === "(" && i + 2 < source.length && source.charAt(i + 1) === "?") {
-      var third = source.charAt(i + 2);
-      if (third === "=" || third === "!" || third === "<") {
-        throw new TypeError(
-          "siteRedirects: regex lookahead / lookbehind (`(?=`, `(?!`, `(?<=`, `(?<!`) refused " +
-          "— catastrophic-backtracking surface; rewrite as `prefix` or split into multiple rows"
-        );
-      }
-    }
-  }
-  // Build the anchored form. RegExp() throws SyntaxError on a
-  // malformed source — re-shape that into the primitive's TypeError
-  // envelope so callers can match on the consistent error shape.
   var anchored = "^(?:" + source + ")$";
-  var compiled;
   try {
-    compiled = new RegExp(anchored);
+    return b.regexLinear.compile(anchored);
   } catch (e) {
+    var code = (e && e.code) || "";
+    if (code === "regex/unsupported-backreference") {
+      throw new TypeError(
+        "siteRedirects: regex backreferences (\\1..\\9) refused — a backreference " +
+        "cannot be matched in linear time; register a separate redirect row for " +
+        "each variant instead"
+      );
+    }
+    if (code === "regex/unsupported-lookaround") {
+      throw new TypeError(
+        "siteRedirects: regex lookahead / lookbehind (`(?=`, `(?!`, `(?<=`, `(?<!`) " +
+        "refused — lookaround cannot be matched in linear time; rewrite as `prefix` " +
+        "or split into multiple rows"
+      );
+    }
+    if (code === "regex/nullable-repetition") {
+      throw new TypeError(
+        "siteRedirects: a repetition whose body can match nothing (`(a*)*`) is " +
+        "refused — it matches exactly what its body matches, so write that instead"
+      );
+    }
     throw new TypeError(
       "siteRedirects: regex source did not compile — " +
       (e && e.message ? e.message : "invalid pattern")
     );
   }
-  // Extend the backreference / lookaround screen above with the last
-  // catastrophic-backtracking class it doesn't cover: a nested unbounded
-  // quantifier ((a+)+, (a*)*, (?:a+)+, (.+)+ …). This regex runs against the
-  // request path in `resolveForPath`, so a super-linear pattern is a DoS on
-  // every matching request. (The framework's b.guardRegex screen is not used
-  // here because its text scan misreads the `?` in a `(?:…)` group prefix and
-  // a bounded trailing `?` as quantifiers, rejecting linear patterns like
-  // `/blog(?:/page/\d+)?` — filed upstream; this walker allows them.)
-  if (_hasNestedUnboundedQuantifier(source)) {
-    throw new TypeError(
-      "siteRedirects: regex source rejected — nested unbounded quantifier " +
-      "(catastrophic-backtracking / ReDoS) surface; rewrite as `prefix` / " +
-      "`exact`, or split into multiple rows"
-    );
-  }
-  return compiled;
-}
-
-// Detect the nested-unbounded-quantifier ReDoS class: a group whose body
-// contains an unbounded quantifier (`+`, `*`, `{n,}`) and is itself repeated
-// by an unbounded quantifier — `(a+)+`, `(a*)*`, `(?:a+)+`, `(.+)+`,
-// `((ab)+)+` at any depth. A single optional / linearly-repeated group
-// (`(?:foo)?`, `(?:bar)*`, `/products/.+`) is safe and MUST be allowed. The
-// walk mirrors the backreference/lookaround walk: char-by-char, honoring
-// escapes, character classes, and the `(?:` / `(?<name>` group prefixes whose
-// `?` is group syntax, not a quantifier. Lookaround is already refused before
-// this runs, so only `(?:` reaches here.
-function _hasNestedUnboundedQuantifier(source) {
-  var stack = [];            // open groups: { bodyUnbounded: bool }
-  var inClass = false;
-  var i = 0;
-  var n = source.length;
-  function outerUnboundedAt(idx) {
-    var c = source.charAt(idx);
-    if (c === "*" || c === "+") return true;
-    if (c === "{") { return /^\{\d*,\}/.test(source.slice(idx)); }   // {n,} — no upper bound
-    return false;
-  }
-  while (i < n) {
-    var ch = source.charAt(i);
-    if (ch === "\\") { i += 2; continue; }                            // escaped atom
-    if (inClass) { if (ch === "]") { inClass = false; } i += 1; continue; }
-    if (ch === "[") { inClass = true; i += 1; continue; }
-    if (ch === "(") {
-      if (source.charAt(i + 1) === "?") {                             // group prefix — not a quantifier
-        i += 2;
-        if (source.charAt(i) === ":") { i += 1; }
-        else if (source.charAt(i) === "<") { while (i < n && source.charAt(i) !== ">") { i += 1; } if (i < n) { i += 1; } }
-      } else { i += 1; }
-      stack.push({ bodyUnbounded: false });
-      continue;
-    }
-    if (ch === ")") {
-      var g = stack.pop() || { bodyUnbounded: false };
-      var outer = outerUnboundedAt(i + 1);
-      if (g.bodyUnbounded && outer) { return true; }                 // nested unbounded quantifier
-      // A group repeated by an unbounded quantifier is itself an unbounded
-      // atom for its parent.
-      if (outer && stack.length) { stack[stack.length - 1].bodyUnbounded = true; }
-      i += 1;
-      continue;
-    }
-    if (ch === "*" || ch === "+") {
-      if (stack.length) { stack[stack.length - 1].bodyUnbounded = true; }
-      i += 1;
-      continue;
-    }
-    if (ch === "{" && /^\{\d*,\}/.test(source.slice(i))) {
-      if (stack.length) { stack[stack.length - 1].bodyUnbounded = true; }
-      i += 1;
-      continue;
-    }
-    i += 1;
-  }
-  return false;
 }
 
 // ---- row hydration ------------------------------------------------------

package/lib/storefront.js

@@ -15928,28 +15928,26 @@ function mount(router, deps) {
         // is built from the validated UUID order id alone (hex + hyphens),
         // carrying no quote/CRLF that could break out of the header.
         var safeId = String(o.id).replace(/[^A-Za-z0-9._-]/g, "");
-        res.status(200);
-        if (res.setHeader) {
-          res.setHeader("content-type", "text/html; charset=utf-8");
-          res.setHeader("content-disposition", "attachment; filename=\"receipt-" + safeId + ".html\"");
-          res.setHeader("x-content-type-options", "nosniff");
-          // The receipt carries the buyer's name + address + line items —
-          // keep it out of any shared/proxy cache.
-          res.setHeader("cache-control", "no-store");
-        }
         // One chunk per batch as the source yields it — bounded memory
-        // regardless of document size. A response without an incremental
-        // write() (a JSON test stub) falls back to buffering.
-        if (typeof res.write === "function" && typeof res.end === "function") {
-          for await (var chunk of _streamReceiptDocument(doc)) {
-            if (chunk) res.write(chunk);
-          }
-          res.end();
-        } else {
-          var buffered = "";
-          for await (var c2 of _streamReceiptDocument(doc)) buffered += c2;
-          if (res.end) res.end(buffered); else res.send(buffered);
-        }
+        // regardless of document size. render.stream awaits backpressure so a
+        // slow client cannot queue the whole document in the socket buffer,
+        // stops when the peer disconnects, and signals a mid-stream failure as
+        // a broken transfer rather than ending a truncated body as a clean 200.
+        //
+        // Headers go in the call, not via setHeader beforehand: render.stream
+        // writes its own defaults with the first chunk, and its default
+        // Content-Type would replace one set earlier. Cache-Control is set
+        // explicitly because the receipt carries the buyer's name, address and
+        // line items and must stay out of any shared or proxy cache.
+        await b.render.stream(res, _streamReceiptDocument(doc), {
+          status:  200,
+          headers: {
+            "Content-Type":           "text/html; charset=utf-8",
+            "Content-Disposition":    "attachment; filename=\"receipt-" + safeId + ".html\"",
+            "X-Content-Type-Options": "nosniff",
+            "Cache-Control":          "no-store",
+          },
+        });
       });
     }