@c9up/transit 0.1.2 → 0.1.4

package/src/xml.ts

@@ -74,13 +74,48 @@ class XmlError extends Error {
 	}
 }
 
+/**
+ * What a document is allowed to cost.
+ *
+ * A SAML response is parsed BEFORE its signature is checked — it has to be,
+ * since the signature is inside it — so every one of these bounds applies to
+ * bytes an unauthenticated caller chose. Without them a single POST could
+ * exhaust the heap, or nest deeply enough to overflow the stack in `#element`,
+ * which recurses once per level.
+ */
+export interface XmlLimits {
+	/** Characters in the document. Default 1 MiB — a large SAML response is tens of KiB. */
+	maxLength?: number;
+	/** Nesting levels. Default 100; the recursion is one frame per level. */
+	maxDepth?: number;
+	/** Elements, text runs, comments and instructions, together. Default 50 000. */
+	maxNodes?: number;
+	/** Attributes on one element. Default 256. */
+	maxAttributes?: number;
+}
+
+const DEFAULT_LIMITS: Required<XmlLimits> = {
+	maxLength: 1024 * 1024,
+	maxDepth: 100,
+	maxNodes: 50_000,
+	maxAttributes: 256,
+};
+
 /** Parse a document and return its root element. */
-export function parseXml(source: string): XmlElement {
+export function parseXml(source: string, limits?: XmlLimits): XmlElement {
+	const resolved = { ...DEFAULT_LIMITS, ...limits };
+	// Checked before the copy below, not after: normalising duplicates the whole
+	// string, so a 300 MB body cost 600 MB before anything looked at its size.
+	if (source.length > resolved.maxLength) {
+		throw new XmlError(
+			`the document is ${source.length} characters, over the ${resolved.maxLength} allowed`,
+		);
+	}
 	// Line endings are normalised before parsing, as the canonicalization
 	// specification requires — otherwise the same document signed on one
 	// platform digests differently on another.
 	const input = source.replace(/\r\n?/g, "\n");
-	const parser = new Parser(input);
+	const parser = new Parser(input, resolved);
 	return parser.document();
 }
 
@@ -151,7 +186,22 @@ export function textOf(element: XmlElement): string {
 
 class Parser {
 	#at = 0;
-	constructor(private readonly source: string) {}
+	/** Nodes built so far, across the whole document. */
+	#nodes = 0;
+	constructor(
+		private readonly source: string,
+		private readonly limits: Required<XmlLimits>,
+	) {}
+
+	/** Count one node, and refuse a document that keeps producing them. */
+	#node(): void {
+		this.#nodes += 1;
+		if (this.#nodes > this.limits.maxNodes) {
+			throw new XmlError(
+				`the document has more than ${this.limits.maxNodes} nodes`,
+			);
+		}
+	}
 
 	document(): XmlElement {
 		let root: XmlElement | undefined;
@@ -184,7 +234,17 @@ class Parser {
 		return root;
 	}
 
-	#element(parent: XmlElement | undefined): XmlElement {
+	#element(parent: XmlElement | undefined, depth = 0): XmlElement {
+		// Checked on the way IN: `#element` recurses once per level, so a
+		// document nested deeply enough overflowed the stack before any of this
+		// ran — and the stack it overflows is the one holding the signature check
+		// that has not happened yet.
+		if (depth > this.limits.maxDepth) {
+			throw new XmlError(
+				`the document nests deeper than ${this.limits.maxDepth}`,
+			);
+		}
+		this.#node();
 		this.#expect("<");
 		const qname = this.#name();
 		const element: XmlElement = {
@@ -210,6 +270,11 @@ class Parser {
 			this.#expect("=");
 			this.#skipSpace();
 			raw.push({ qname: name, value: this.#attributeValue() });
+			if (raw.length > this.limits.maxAttributes) {
+				throw new XmlError(
+					`element <${qname}> carries more than ${this.limits.maxAttributes} attributes`,
+				);
+			}
 		}
 
 		for (const { qname: name, value } of raw) {
@@ -289,6 +354,7 @@ class Parser {
 			if (this.#peek("<!--")) {
 				const end = this.source.indexOf("-->", this.#at);
 				if (end === -1) throw new XmlError("a comment is never closed");
+				this.#node();
 				element.children.push({
 					type: "comment",
 					value: this.source.slice(this.#at + 4, end),
@@ -299,6 +365,7 @@ class Parser {
 			if (this.#peek("<![CDATA[")) {
 				const end = this.source.indexOf("]]>", this.#at);
 				if (end === -1) throw new XmlError("a CDATA section is never closed");
+				this.#node();
 				element.children.push({
 					type: "text",
 					value: this.source.slice(this.#at + 9, end),
@@ -315,6 +382,7 @@ class Parser {
 					throw new XmlError("a processing instruction is never closed");
 				const body = this.source.slice(this.#at + 2, end);
 				const space = body.search(/\s/);
+				this.#node();
 				element.children.push({
 					type: "instruction",
 					target: space === -1 ? body : body.slice(0, space),
@@ -324,11 +392,12 @@ class Parser {
 				continue;
 			}
 			if (this.#peek("<")) {
-				element.children.push(this.#element(element));
+				element.children.push(this.#element(element, depth + 1));
 				continue;
 			}
 			const next = this.source.indexOf("<", this.#at);
 			const end = next === -1 ? this.source.length : next;
+			this.#node();
 			element.children.push({
 				type: "text",
 				value: resolveEntities(this.source.slice(this.#at, end)),

package/dist/nodeEnv.d.ts

@@ -1,17 +0,0 @@
-/**
- * Reading `NODE_ENV`, with the aliases people actually set.
- *
- * `NODE_ENV=prod` is ordinary in a Dockerfile or a platform dashboard. Read
- * verbatim it answers "not production" — and here that means the in-process
- * SAML replay store is accepted on a production deployment, where it bounds
- * replay within one replica and not beyond it.
- *
- * Duplicated rather than imported: transit depends on no other package in this
- * workspace, and a security decision that only holds when an optional peer is
- * installed is not a decision.
- */
-/** The canonical name for whatever `NODE_ENV` holds. */
-export declare function normalizeNodeEnv(value: string | undefined): string;
-/** Whether this process is running in production, under any spelling. */
-export declare function inProduction(): boolean;
-//# sourceMappingURL=nodeEnv.d.ts.map

package/dist/nodeEnv.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"nodeEnv.d.ts","sourceRoot":"","sources":["../src/nodeEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAOlE;AAED,yEAAyE;AACzE,wBAAgB,YAAY,IAAI,OAAO,CAEtC"}

package/dist/nodeEnv.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"nodeEnv.js","sourceRoot":"","sources":["../src/nodeEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACzC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAEtC,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IACjD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3C,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY;IAC3B,OAAO,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC;AAChE,CAAC"}