@blamejs/core 0.18.35 → 0.18.37

package/lib/parsers/safe-ini.js

@@ -41,6 +41,7 @@ var C = require("../constants");
 var pick = require("../pick");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
+var codepointClass = require("../codepoint-class");
 var { defineClass } = require("../framework-error");
 
 var IniSafeError = defineClass("IniSafeError", { alwaysPermanent: true });
@@ -69,7 +70,7 @@ function _stripComment(line) {
     if (c === "\"" && !inSingle) { inDouble = !inDouble; continue; }
     if (c === "'"  && !inDouble) { inSingle = !inSingle; continue; }
     if (!inSingle && !inDouble && (c === ";" || c === "#")) {
-      if (i === 0 || /\s/.test(line.charAt(i - 1))) {
+      if (i === 0 || codepointClass.inRanges(line.charCodeAt(i - 1), codepointClass.WHITESPACE_RANGES)) {
         return line.slice(0, i);
       }
     }
@@ -110,6 +111,113 @@ function _unquote(raw) {
   return s;
 }
 
+// Lexical shape tests for the value forms INI coerces. Each replaces an
+// anchored pattern and walks the string once, so the cost is its length —
+// values arrive from a file an operator may not control, and a screen whose
+// cost depends on the arrangement of the characters is what this family avoids.
+//
+// `\d` in the patterns these replace is ASCII-only, so isAsciiDigit matches it
+// exactly; a walk using a Unicode digit test would accept more than the pattern
+// did and silently widen what parses as a number.
+
+// `/^0x[0-9a-f]+$/i` — the prefix, then at least one hex digit, nothing else.
+function _isHexInteger(s) {
+  if (s.length < 3) return false;
+  if (s.charAt(0) !== "0") return false;
+  var x = s.charAt(1);
+  if (x !== "x" && x !== "X") return false;
+  return codepointClass.isRunOf(s.slice(2), codepointClass.ASCII_HEX);
+}
+
+// Digits from `from` to the end, at least one. The shared tail of every shape
+// below, and the reason none of them needs a quantifier.
+function _digitsToEnd(s, from) {
+  if (from >= s.length) return false;
+  return codepointClass.isRunOf(s.slice(from), codepointClass.ASCII_DIGITS);
+}
+
+function _digitRunEnd(s, from) {
+  var i = from;
+  while (i < s.length && codepointClass.isAsciiDigit(s.charCodeAt(i))) i += 1;
+  return i;                                        // === from when no digits
+}
+
+// `/^-?\d+$/`
+function _isDecimalInteger(s) {
+  return _digitsToEnd(s, s.charAt(0) === "-" ? 1 : 0);
+}
+
+// `/^-?\d+\.\d+([eE][+-]?\d+)?$/` or `/^-?\d+[eE][+-]?\d+$/` — a float needs
+// either a fractional part, an exponent, or both, which is what keeps a bare
+// integer out of this branch and in the one above it.
+function _isDecimalFloat(s) {
+  var i = s.charAt(0) === "-" ? 1 : 0;
+  var afterInt = _digitRunEnd(s, i);
+  if (afterInt === i) return false;                // no integer part
+  i = afterInt;
+  var sawFraction = false;
+  if (s.charAt(i) === ".") {
+    var afterFrac = _digitRunEnd(s, i + 1);
+    if (afterFrac === i + 1) return false;         // `1.` is not a float here
+    i = afterFrac;
+    sawFraction = true;
+  }
+  var e = s.charAt(i);
+  if (e === "e" || e === "E") {
+    var j = i + 1;
+    var sign = s.charAt(j);
+    if (sign === "+" || sign === "-") j += 1;
+    if (!_digitsToEnd(s, j)) return false;
+    return true;                                   // exponent consumed the rest
+  }
+  return sawFraction && i === s.length;
+}
+
+// `[name "subsection"]` — the git-config form. Replaces
+// `/^([A-Za-z0-9._-]+)\s+"([^"\\]*(?:\\.[^"\\]*)*)"$/`, whose inner group is the
+// unrolled-loop idiom for a quoted string; walking it is both clearer and free
+// of the backtracking that idiom exists to avoid.
+//
+// Two details of the pattern are load-bearing and preserved here. The value is
+// captured VERBATIM, escapes included — `_unquote` does the unescaping later, so
+// consuming the backslash here would double-unescape. And `\\.` cannot match a
+// line terminator, so a backslash before one is not an escape and the whole
+// header fails to match rather than swallowing the break.
+var _SECTION_NAME_CHARS = codepointClass.ASCII_ALNUM + "._-";
+
+function _isDotAtom(ch) {
+  // The characters `.` does NOT match without the `s` flag.
+  return ch !== "\n" && ch !== "\r" && ch !== "\u2028" && ch !== "\u2029";
+}
+
+function _parseQuotedSectionHeader(inner) {
+  var i = 0;
+  while (i < inner.length && _SECTION_NAME_CHARS.indexOf(inner.charAt(i)) !== -1) i += 1;
+  if (i === 0) return null;                             // name needs one char
+  var name = inner.slice(0, i);
+  var afterName = i;
+  while (i < inner.length &&
+         codepointClass.inRanges(inner.charCodeAt(i), codepointClass.WHITESPACE_RANGES)) i += 1;
+  if (i === afterName) return null;                     // `\s+` needs one
+  if (inner.charAt(i) !== "\"") return null;
+  i += 1;
+  var value = "";
+  while (i < inner.length) {
+    var ch = inner.charAt(i);
+    if (ch === "\\") {
+      var next = inner.charAt(i + 1);
+      if (i + 1 >= inner.length || !_isDotAtom(next)) return null;
+      value += ch + next;
+      i += 2;
+      continue;
+    }
+    if (ch === "\"") return i === inner.length - 1 ? [name, value] : null;
+    value += ch;
+    i += 1;
+  }
+  return null;                                          // unterminated quote
+}
+
 function _coerceValue(raw) {
   if (raw.length === 0) return raw;
   var first = raw.charAt(0);
@@ -117,21 +225,21 @@ function _coerceValue(raw) {
   var lower = raw.toLowerCase();
   if (TRUE_VALUES.has(lower))  return true;
   if (FALSE_VALUES.has(lower)) return false;
-  if (/^0x[0-9a-f]+$/i.test(raw)) {
+  if (_isHexInteger(raw)) {
     var hex = parseInt(raw, RADIX_HEX);
     if (!Number.isSafeInteger(hex)) {
       throw _err("ini/value-out-of-range", "hex integer exceeds safe-integer range: " + raw);
     }
     return hex;
   }
-  if (/^-?\d+$/.test(raw)) {
+  if (_isDecimalInteger(raw)) {
     var n = Number(raw);
     if (!Number.isSafeInteger(n)) {
       throw _err("ini/value-out-of-range", "integer exceeds safe-integer range: " + raw);
     }
     return n;
   }
-  if (/^-?\d+\.\d+([eE][+-]?\d+)?$/.test(raw) || /^-?\d+[eE][+-]?\d+$/.test(raw)) {
+  if (_isDecimalFloat(raw)) {
     var f = Number(raw);
     // Float overflow (e.g. 1e999) coerces to ±Infinity — the same
     // never-silently-coerce refusal the integer/hex branches enforce with
@@ -178,10 +286,8 @@ function _parseSectionHeader(line) {
   if (inner.length === 0) {
     throw _err("ini/empty-section", "section header [] has no name");
   }
-  var quotedMatch = /^([A-Za-z0-9._-]+)\s+"([^"\\]*(?:\\.[^"\\]*)*)"$/.exec(inner);
-  if (quotedMatch) {
-    return [quotedMatch[1], quotedMatch[2]];
-  }
+  var quoted = _parseQuotedSectionHeader(inner);
+  if (quoted) return quoted;
   var parts = inner.split(".");
   for (var i = 0; i < parts.length; i++) {
     if (parts[i].length === 0) {
@@ -240,7 +346,7 @@ function parse(input, opts) {
   var sectionCount = 0;
   var keysInCurrentSection = 0;
 
-  var lines = input.split(/\r?\n/);
+  var lines = codepointClass.splitLines(input);
   for (var li = 0; li < lines.length; li++) {
     var raw = lines[li];
     var stripped = _stripComment(raw).trim();

package/lib/parsers/safe-toml.js

@@ -71,6 +71,61 @@ var RADIX_BIN     = 0x2;
 var RADIX_OCTAL   = 0x8;
 var RADIX_HEX     = 0x10;
 
+// Character sets and fixed-width shapes, as walks. TOML's grammar is all
+// fixed-width date and time fields and single-character classes, so every one of
+// these replaces a pattern with an index comparison — nothing here needs a
+// search, and the parser's cost stays the length of the document.
+var _OCTAL_DIGITS  = "01234567";
+var _BINARY_DIGITS = "01";
+var _BARE_KEY_TAIL = codepointClass.ASCII_ALNUM + "_";
+var _NUMBER_LEADS  = codepointClass.ASCII_DIGITS + "+-i n";     // `inf`, `nan`, sign, space
+
+function _isDigit(ch)      { return ch.length === 1 && codepointClass.ASCII_DIGITS.indexOf(ch) !== -1; }
+function _isHexDigit(ch)   { return ch.length === 1 && codepointClass.ASCII_HEX.indexOf(ch) !== -1; }
+function _isOctalDigit(ch) { return ch.length === 1 && _OCTAL_DIGITS.indexOf(ch) !== -1; }
+function _isBinaryDigit(ch){ return ch.length === 1 && _BINARY_DIGITS.indexOf(ch) !== -1; }
+
+// `charAt` past the end returns "", and `"".indexOf` is 0 on every string, so
+// each of these guards its length before asking. Without it an out-of-range read
+// answers "yes" and the shape checks accept a truncated document.
+function _isBareKeyChar(ch) { return ch.length === 1 && _BARE_KEY_TAIL.indexOf(ch) !== -1; }
+function _isNumberLead(ch)  { return ch.length === 1 && _NUMBER_LEADS.indexOf(ch) !== -1; }
+
+function _digitsAt(text, from, count) {
+  if (from + count > text.length) return false;
+  for (var i = 0; i < count; i += 1) {
+    if (!_isDigit(text.charAt(from + i))) return false;
+  }
+  return true;
+}
+
+// `\d{4}-\d{2}-\d{2}` anchored at the start of `text`.
+function _looksLikeDate(text) {
+  return _digitsAt(text, 0, 4) && text.charAt(4) === "-" &&
+         _digitsAt(text, 5, 2) && text.charAt(7) === "-" &&
+         _digitsAt(text, 8, 2);
+}
+
+// `\d{2}:\d{2}:\d{2}` anchored at the start of `text`.
+function _looksLikeTime(text) {
+  return _digitsAt(text, 0, 2) && text.charAt(2) === ":" &&
+         _digitsAt(text, 3, 2) && text.charAt(5) === ":" &&
+         _digitsAt(text, 6, 2);
+}
+
+// `^[+-]\d{2}:\d{2}$` — a whole numeric UTC offset, nothing after it.
+function _isNumericOffset(text) {
+  if (text.length !== 6) return false;
+  var sign = text.charAt(0);
+  if (sign !== "+" && sign !== "-") return false;
+  return _digitsAt(text, 1, 2) && text.charAt(3) === ":" && _digitsAt(text, 4, 2);
+}
+
+// Strip the `_` digit separators TOML allows inside numbers.
+function _stripUnderscores(text) {
+  return text.indexOf("_") === -1 ? text : codepointClass.stripRanges(text, [0x5F]);
+}
+
 // Date-time literal character widths (per TOML / RFC 3339).
 var TIME_CHARS    = 0x8;    // "HH:MM:SS"
 var OFFSET_CHARS  = 0x6;    // "+HH:MM"
@@ -285,7 +340,7 @@ function parse(input, opts) {
       case "U": {
         var hexLen = 0x8;
         var hex8 = input.substring(pos, pos + hexLen);
-        if (hex8.length < hexLen || !/^[0-9a-fA-F]{8}$/.test(hex8)) {
+        if (hex8.length < hexLen || hex8.length !== 8 || !codepointClass.isRunOf(hex8, codepointClass.ASCII_HEX)) {
           throw _err("bad \\U escape", "toml/bad-escape");
         }
         _advance(hexLen);
@@ -404,19 +459,19 @@ function parse(input, opts) {
   // current position doesn't start a date-time literal.
   function _tryParseDateTime() {
     // Date-time form: YYYY-MM-DD followed by 'T'/' ' followed by time
-    if (pos + 10 <= len && /^\d{4}-\d{2}-\d{2}/.test(input.substr(pos, 10))) {
+    if (pos + 10 <= len && _looksLikeDate(input.substr(pos, 10))) {
       var sep = _peek(10);
       if (sep === "T" || sep === "t" || sep === " ") {
         // Look ahead for time portion (HH:MM:SS = 8 chars)
         var timeStart = pos + 11;
         var timeChars = TIME_CHARS;
-        if (/^\d{2}:\d{2}:\d{2}/.test(input.substr(timeStart, timeChars))) {
+        if (_looksLikeTime(input.substr(timeStart, timeChars))) {
           var datePart = input.substr(pos, 10);
           var timeEnd = timeStart + timeChars;
           // Optional fractional
           if (_peek(timeEnd - pos) === ".") {
             timeEnd += 1;
-            while (timeEnd < len && /\d/.test(input.charAt(timeEnd))) timeEnd += 1;
+            while (timeEnd < len && _isDigit(input.charAt(timeEnd))) timeEnd += 1;
           }
           var timePart = input.substring(timeStart, timeEnd);
           // Optional offset
@@ -427,7 +482,7 @@ function parse(input, opts) {
             // Expect ±HH:MM (6 chars)
             var offsetChars = OFFSET_CHARS;
             var off = input.substr(timeEnd, offsetChars);
-            if (/^[+-]\d{2}:\d{2}$/.test(off)) {
+            if (_isNumericOffset(off)) {
               offsetStr = off;
               timeEnd += offsetChars;
             }
@@ -445,7 +500,7 @@ function parse(input, opts) {
       }
       // Date-only — but only if followed by something OTHER than digit/colon
       var after = _peek(10);
-      if (!after || !/[0-9:.]/.test(after)) {
+      if (!after || !(_isDigit(after) || after === ":" || after === ".")) {
         var ds = input.substr(pos, 10);
         _advance(10);
         return { kind: "local-date", value: ds };
@@ -453,11 +508,11 @@ function parse(input, opts) {
     }
     // Time-only: HH:MM:SS (8 chars)
     var timeOnlyChars = TIME_CHARS;
-    if (pos + timeOnlyChars <= len && /^\d{2}:\d{2}:\d{2}/.test(input.substr(pos, timeOnlyChars))) {
+    if (pos + timeOnlyChars <= len && _looksLikeTime(input.substr(pos, timeOnlyChars))) {
       var teEnd = pos + timeOnlyChars;
       if (input.charAt(teEnd) === ".") {
         teEnd += 1;
-        while (teEnd < len && /\d/.test(input.charAt(teEnd))) teEnd += 1;
+        while (teEnd < len && _isDigit(input.charAt(teEnd))) teEnd += 1;
       }
       var ts = input.substring(pos, teEnd);
       _advance(teEnd - pos);
@@ -496,12 +551,12 @@ function parse(input, opts) {
         while (!_eof()) {
           var ch = _peek();
           if (ch === "_") { _advance(); continue; }
-          if (radix === RADIX_HEX   && /[0-9a-fA-F]/.test(ch)) { _advance(); continue; }
-          if (radix === RADIX_OCTAL && /[0-7]/.test(ch))       { _advance(); continue; }
-          if (radix === RADIX_BIN   && /[01]/.test(ch))        { _advance(); continue; }
+          if (radix === RADIX_HEX   && _isHexDigit(ch))    { _advance(); continue; }
+          if (radix === RADIX_OCTAL && _isOctalDigit(ch))  { _advance(); continue; }
+          if (radix === RADIX_BIN   && _isBinaryDigit(ch)) { _advance(); continue; }
           break;
         }
-        var digits = input.substring(digitsStart, pos).replace(/_/g, "");
+        var digits = _stripUnderscores(input.substring(digitsStart, pos));
         if (digits.length === 0) throw _err("expected digits after radix prefix", "toml/bad-number");
         var n = parseInt(digits, radix);
         if (!Number.isSafeInteger(n)) {
@@ -527,7 +582,7 @@ function parse(input, opts) {
       }
       break;
     }
-    var raw = input.substring(startPos, pos).replace(/_/g, "");
+    var raw = _stripUnderscores(input.substring(startPos, pos));
     if (raw === "" || raw === "-" || raw === "+") {
       throw new SafeTomlError("invalid number", "toml/bad-number", startLine, startCol);
     }
@@ -560,17 +615,17 @@ function parse(input, opts) {
     if (c === "[") return _parseArray(depth + 1);
     if (c === "{") return _parseInlineTable(depth + 1);
 
-    if (input.substr(pos, 4) === "true" && !/[A-Za-z0-9_]/.test(input.charAt(pos + 4) || "")) {
+    if (input.substr(pos, 4) === "true" && !_isBareKeyChar(input.charAt(pos + 4))) {
       _advance(4); return true;
     }
-    if (input.substr(pos, 5) === "false" && !/[A-Za-z0-9_]/.test(input.charAt(pos + 5) || "")) {
+    if (input.substr(pos, 5) === "false" && !_isBareKeyChar(input.charAt(pos + 5))) {
       _advance(5); return false;
     }
 
     var dt = _tryParseDateTime();
     if (dt !== null) return dt.value;
 
-    if (/[0-9+\-i n]/.test(c)) return _parseNumber(c);
+    if (_isNumberLead(c)) return _parseNumber(c);
 
     throw _err("unexpected character '" + c + "'", "toml/expected-value");
   }

package/lib/parsers/safe-xml.js

@@ -53,6 +53,7 @@ var C = require("../constants");
 var pick = require("../pick");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
+var codepointClass = require("../codepoint-class");
 var { FrameworkError } = require("../framework-error");
 
 class SafeXmlError extends FrameworkError {
@@ -405,7 +406,12 @@ function parse(input, opts) {
       }
     }
     Object.assign(obj, grouped);
-    var combinedText = textParts.join("").replace(/\s+/g, " ").trim();
+    // Collapse whitespace runs to a single space and trim, by walking rather
+    // than matching: the text came off the wire and a screen whose cost depends
+    // on the shape of the input is the thing this family does not do.
+    // splitOnWhitespace drops empty segments, so joining restores exactly the
+    // collapsed-and-trimmed form.
+    var combinedText = codepointClass.splitOnWhitespace(textParts.join("")).join(" ");
     if (combinedText.length > 0) obj["#text"] = combinedText;
     return _make(name, obj);
   }