@geml/geml 1.7.0 → 1.7.1

package/codemap/build.mjs

@@ -36,7 +36,7 @@
 //
 // After building, run:  geml codemap verify <out-dir>
 import { writeFileSync, mkdirSync, existsSync, readFileSync, statSync } from "node:fs";
-import { join, resolve, basename, dirname, relative } from "node:path";
+import { join, resolve, basename, dirname, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { execFileSync, spawnSync } from "node:child_process";
 import { emit } from "./emit.mjs";
@@ -100,7 +100,7 @@ if (root && !inputs.length) {
   const { files, manifests, pkgs } = collectSourceFiles(rootAbs);
   const excluder = makeExcluder({
     root: rootAbs, globs: excludeGlobs0, gitignore: !args.includes("--no-gitignore"),
-    files: [...files, ...manifests, ...pkgs], exec: execFileSync,
+    files: [...files, ...manifests, ...pkgs], run: execFileSync,
   });
   const jobs = detectLanguages(rootAbs, { files, manifests, pkgs, excluder });
   detectedLanguages = [...new Set(jobs.map((j) => j.language))];
@@ -136,7 +136,10 @@ if (root && !inputs.length) {
   // PATH (npx / joern) whose .cmd/.bat shim uses %~dp0 breaks if the name is
   // quoted — cmd then resolves %~dp0 against the cwd, not the shim's dir. A
   // spaced launcher PATH is a full path, so quoting it keeps %~dp0 correct.
-  const q = (s) => (/[\s"]/.test(String(s)) ? `"${String(s).replace(/"/g, '\\"')}"` : String(s));
+  // WHEN it does quote, it defers to shq below: escaping only `"` left a
+  // trailing backslash (a path ending `...\`) escaping our own closing quote,
+  // which merges the next token into this one. Same CRT rules, one source.
+  const q = (s) => (/[\s"]/.test(String(s)) ? shq(s) : String(s));
   // Hardened quote for command ARGUMENTS on win32. Node does NOT escape args
   // under shell:true — it only concatenates them (Node DEP0190) — so an
   // unquoted argument such as a source directory named `a&calc` reaching the
@@ -378,7 +381,7 @@ const excluder = makeExcluder({
   globs: excludeGlobs,
   gitignore: !args.includes("--no-gitignore"),
   files: [...new Set(symbols.map((s) => s.file))],
-  exec: execFileSync,
+  run: execFileSync,
 });
 const kept = symbols.filter((s) => !excluder(s.file));
 const excludedCount = symbols.length - kept.length;
@@ -391,7 +394,7 @@ if (root && !recordRecipe && !entryHints.length) {
   const c = collectSourceFiles(rootAbs);
   const excl = makeExcluder({
     root: rootAbs, globs: excludeGlobs, gitignore: !args.includes("--no-gitignore"),
-    files: [...c.files, ...c.manifests, ...c.pkgs], exec: execFileSync,
+    files: [...c.files, ...c.manifests, ...c.pkgs], run: execFileSync,
   });
   entryHints = detectEntries(rootAbs, {
     files: c.files.filter((f) => !excl(f)),
@@ -420,7 +423,18 @@ try {
   const { edges: httpEdges, audit } = buildCrossStackOverlay({
     symbols,
     files: scanFiles,
-    readText: (rel) => { try { return readFileSync(join(rootAbs, ...rel.split("/")), "utf8"); } catch { return null; } },
+    // `rel` is indexer OUTPUT, not a path this build authored, so a `..`
+    // segment must not turn a source read into an escape from the scanned
+    // root. Same gate the document resolver uses: resolve first, then require
+    // the result to BE the root or sit under it — compared with the separator,
+    // so a sibling named `<root>-evil` is not mistaken for a child.
+    readText: (rel) => {
+      try {
+        const p = resolve(rootAbs, ...String(rel).split("/"));
+        if (p !== rootAbs && !p.startsWith(rootAbs + sep)) return null;
+        return readFileSync(p, "utf8");
+      } catch { return null; }
+    },
   });
   for (const e of httpEdges) edges.push(e);
   if (httpEdges.length) {

package/codemap/exclude.mjs

@@ -15,17 +15,17 @@ import { execFileSync as _execFileSync } from "node:child_process";
 // Minimal gitignore-flavoured glob: `**` spans path separators, `*` stays
 // within a segment, everything else is literal. Anchored to the whole path.
 export function globToRegExp(glob) {
+  // The glob comes from a `--exclude` argument, so nothing in it may reach the
+  // compiled pattern as *syntax*. Split on the wildcards, keeping them (the
+  // capture group), which leaves the array strictly alternating: even indices
+  // are literal text, odd indices are `*`, `**` or `**/`. Literals go through a
+  // total regex-metacharacter escape; wildcards map to fixed patterns. Neither
+  // path can carry an unescaped metacharacter through.
+  const parts = String(glob).split(/(\*\*\/?|\*)/);
   let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") { re += ".*"; i++; if (glob[i + 1] === "/") i++; }
-      else re += "[^/]*";
-    } else if ("\\^$+?.()|{}[]".includes(c)) {
-      re += "\\" + c;
-    } else {
-      re += c;
-    }
+  for (let i = 0; i < parts.length; i++) {
+    if (i % 2 === 0) re += parts[i].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    else re += parts[i] === "*" ? "[^/]*" : ".*"; // `**` and `**/` span separators
   }
   return new RegExp("^" + re + "$");
 }
@@ -33,10 +33,14 @@ export function globToRegExp(glob) {
 // Ask git which of `files` it ignores. Returns a Set of the ignored paths.
 // check-ignore exits 1 when nothing matches and 128 when git is unavailable /
 // the dir is not a repo — both mean "ignore nothing", not a build failure.
-export function gitIgnored(root, files, exec = _execFileSync) {
+// The injected runner is named `run`, not `exec`: it is always an execFile-shaped
+// (program, args[]) call that spawns NO shell, whereas a callback named `exec`
+// reads — to a human skimming, and to a static analyser — as the shell-string
+// child_process API. The name should not imply the dangerous one.
+export function gitIgnored(root, files, run = _execFileSync) {
   if (!files.length) return new Set();
   try {
-    const out = exec("git", ["-C", root, "check-ignore", "--stdin"], { input: files.join("\n"), encoding: "utf8" });
+    const out = run("git", ["-C", root, "check-ignore", "--stdin"], { input: files.join("\n"), encoding: "utf8" });
     return new Set(out.split(/\r?\n/).filter(Boolean));
   } catch (e) {
     const out = e && e.stdout ? String(e.stdout) : "";
@@ -45,8 +49,8 @@ export function gitIgnored(root, files, exec = _execFileSync) {
 }
 
 // Build a predicate (file) => shouldExclude.
-export function makeExcluder({ root, globs = [], gitignore = true, files = [], exec } = {}) {
+export function makeExcluder({ root, globs = [], gitignore = true, files = [], run } = {}) {
   const res = globs.map(globToRegExp);
-  const ignored = gitignore ? gitIgnored(root, files, exec) : new Set();
+  const ignored = gitignore ? gitIgnored(root, files, run) : new Set();
   return (file) => ignored.has(file) || res.some((r) => r.test(file));
 }

package/codemap/refresh.mjs

@@ -95,7 +95,10 @@ let trusted = isRecipeTrusted(fingerprint);
 //     full path is quoted), every argument via shq (ALWAYS double-quoted, so
 //     cmd.exe treats & | < > ( ) ^ and whitespace as literal). An injected
 //     metachar inside a dir-name argument is therefore inert.
-const q = (s) => (/[\s"]/.test(String(s)) ? `"${String(s).replace(/"/g, '\\"')}"` : String(s));
+// q quotes only when it must; WHEN it does it defers to shq, so a program path
+// ending in a backslash cannot escape our own closing quote and swallow the
+// next token. One set of CRT rules, in one place.
+const q = (s) => (/[\s"]/.test(String(s)) ? shq(s) : String(s));
 const shq = (s) => `"${String(s).replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, '$1$1')}"`;
 // Human-readable render of a step for the log / refusal message — DISPLAY ONLY,
 // never executed. Falls back to String() for a stale (non-structured) step.

package/codemap/verify.mjs

@@ -37,7 +37,10 @@ if (!cli) cli = existsSync(localParser) ? localParser : "geml";
 // `.geml` filename containing & | ( ) would otherwise break out and inject.
 // cmd.exe treats those metacharacters and whitespace as literal inside quotes;
 // CRT rules for embedded " / trailing \.
-const q = (s) => (/[\s"]/.test(String(s)) ? `"${String(s).replace(/"/g, '\\"')}"` : String(s));
+// q quotes only when it must; WHEN it does it defers to shq, so a program path
+// ending in a backslash cannot escape our own closing quote and swallow the
+// next token. One set of CRT rules, in one place.
+const q = (s) => (/[\s"]/.test(String(s)) ? shq(s) : String(s));
 const shq = (s) => `"${String(s).replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, '$1$1')}"`;
 // A codemap document's `src=` routes are written relative to the indexed
 // SOURCE root (`geml-parser/src/attrs.ts` from a document two levels down), so

package/dist/from-md.js

@@ -55,7 +55,12 @@ function metaLine(line) {
     if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))
         v = v.slice(1, -1);
     const bareSafe = /^[^\s"]+$/.test(v);
-    return bareSafe ? `${m[1]}=${v}` : `${m[1]}="${v.replace(/"/g, '\\"')}"`;
+    // No backslash escape here — a `data` block value is read by `coerce`, which
+    // simply strips the outer quotes (§4); GEML defines no `\"` escape at all.
+    // Emitting one wrote the backslash into the parsed value, so `a"b` came back
+    // as `a\"b`. Quoting the value verbatim round-trips instead: coerce keeps
+    // everything between the first and last quote, embedded quotes included.
+    return bareSafe ? `${m[1]}=${v}` : `${m[1]}="${v}"`;
 }
 // Rewrite Markdown autolinks `<https://…>` / `<mailto:…>` into GEML links
 // `[url](url)` (GEML has no autolink syntax). Inline code spans are left intact.

package/dist/geml.js

@@ -909,6 +909,12 @@ function validateProjections(children, ctx, opts) {
 function relJoinPath(base, target) {
     if (base === "" || target === "" || target.startsWith("/") || /^[a-z][a-z0-9+.-]*:/i.test(target))
         return target;
+    // A POSIX-absolute base must stay absolute. The segment loop below drops empty
+    // segments, and the leading "" of "/tmp/x" IS the root — dropping it silently
+    // turned `/tmp/x/part.geml` into the relative `tmp/x/part.geml`, which then
+    // resolved against the wrong directory. Windows never showed it: a `C:\…` base
+    // has no "/", so relDirPath returns "" and the early return above takes over.
+    const rooted = base.startsWith("/");
     const out = [];
     for (const s of (base + "/" + target).split("/")) {
         if (s === "" || s === ".")
@@ -918,7 +924,7 @@ function relJoinPath(base, target) {
         else
             out.push(s);
     }
-    return out.join("/");
+    return (rooted ? "/" : "") + out.join("/");
 }
 function relDirPath(p) {
     const i = p.lastIndexOf("/");

package/dist/render.js

@@ -1990,7 +1990,24 @@ export function codeGraphRuntime(root) {
             // Rendered pages sit next to their codemap documents: a live mount
             // (viewer/playground) carries data-src, a CLI embed carries the src
             // path in data.start — either directory anchors doc-relative links.
-            var navBase = String(mount.getAttribute("data-src") || data.start || "").replace(/[^\/]*$/, "");
+            // navBase prefixes EVERY url this view reaches for — the breadcrumb's
+            // `location.href`, the search-index `<script src>`, a hit's jump target.
+            // Both of its inputs are page data (a DOM attribute, the embedded graph
+            // JSON), so a document that carried `data-src="javascript:…"` would turn
+            // a breadcrumb click into script execution, and a `//host/` or
+            // `https://host/` value would pull the search index off another origin.
+            // A base is a doc-relative DIRECTORY and nothing else: anything bearing a
+            // scheme or a network-path prefix is refused outright and links resolve
+            // against the current page instead.
+            // Everything this view navigates to or loads is built from page data, so
+            // every such string is filtered here first: keep it if it is a
+            // document-RELATIVE path, drop it to "" if it carries a scheme
+            // (`javascript:`, `data:`) or a `//host` network-path prefix.
+            function relOnly(u) {
+                var s = String(u == null ? "" : u);
+                return /^[a-zA-Z][a-zA-Z0-9+.\-]*:/.test(s) || s.slice(0, 2) === "//" ? "" : s;
+            }
+            var navBase = relOnly(String(mount.getAttribute("data-src") || data.start || "").replace(/[^\/]*$/, ""));
             // A live mount (viewer/playground/served page) navigates IN PLACE over
             // the geml documents through this loader; only truly static pages fall
             // back to their pre-rendered sibling .html pages. Read LAZILY on every
@@ -2028,7 +2045,16 @@ export function codeGraphRuntime(root) {
                 }
                 catch (e) { /* stub */ }
             }
-            function openDoc(rel, gpath) {
+            function openDoc(rel0, gpath) {
+                // The target can come from a node's own data (a `data-k` key), not just
+                // from a breadcrumb we built — so it goes through the same relative-path
+                // filter as navBase. An absolute or scheme-bearing target says why it
+                // was refused rather than navigating.
+                var rel = relOnly(rel0);
+                if (!rel) {
+                    flash("refusing to open " + String(rel0) + " — not a document-relative path");
+                    return;
+                }
                 var lv = live();
                 if (lv) {
                     Promise.resolve(lv({ doc: rel })).then(function (nd) {
@@ -2340,8 +2366,15 @@ export function codeGraphRuntime(root) {
                         });
                     }
                 }
-                function gotoHit(doc, id, locate) {
+                function gotoHit(doc0, id, locate) {
                     searchMenu.hidden = true;
+                    // `doc` is a row from the loaded search index — page data, same as any
+                    // other target, so it gets the same relative-path filter.
+                    var doc = relOnly(doc0);
+                    if (!doc) {
+                        flash("refusing to open " + String(doc0) + " — not a document-relative path");
+                        return;
+                    }
                     if (live() && !locate) {
                         showCallees(doc + "#" + id);
                         return;

package/dist/to-md.js

@@ -48,10 +48,32 @@ function inline(n) {
 function seq(ns) {
     return ns.map(inline).join("");
 }
+// Escape a `|` so GFM keeps it inside the cell instead of splitting the row.
+// GFM resolves backslash escapes in a row BEFORE it splits on `|`, so a
+// backslash run sitting right in front of our escape would eat it: a code span
+// holding `a\|b` became `a\\|b`, which reads as a literal backslash followed by
+// an UNescaped pipe — a spurious cell break. Double any such run first, then
+// escape the pipe. Runs already produced by escText (`\\` for a literal
+// backslash) survive this unchanged, so pre-rendered Markdown stays intact.
+//
+// The backslash run is matched as `\\+\|?` — one ATOMIC token, run and pipe
+// together — not as `(\\*)\|`. The latter is quadratic: on a cell holding a
+// long run of backslashes and no pipe, the engine matches the run from every
+// index in it and fails at the required `|` each time. Here the greedy `\\+`
+// takes the whole run in one match and the trailing `\|?` is optional, so
+// nothing backtracks and each character is visited once.
+function escPipe(s) {
+    return s.replace(/\\+\|?|\|/g, (m) => {
+        if (m.charAt(m.length - 1) !== "|")
+            return m; // a run with no pipe after it
+        const bs = m.slice(0, -1); // the run that would otherwise eat our escape
+        return bs + bs + "\\|";
+    });
+}
 // Inline text for a table cell: render inlines, then neutralise the two bytes
 // that would break a GFM cell.
 function cellText(c) {
-    return seq(c.inlines).replace(/\|/g, "\\|").replace(/\n/g, " ");
+    return escPipe(seq(c.inlines)).replace(/\n/g, " ");
 }
 // ---------------------------------------------------------------------------
 // Tables
@@ -72,7 +94,7 @@ function tableToMd(t, notes) {
     const lines = [];
     if (t.caption)
         lines.push(`*${t.caption}*`, "");
-    lines.push(`| ${cols.map((c) => c.replace(/\|/g, "\\|")).join(" | ")} |`);
+    lines.push(`| ${cols.map(escPipe).join(" | ")} |`);
     lines.push(`| ${cols.map((_, i) => sep(t.align[i])).join(" | ")} |`);
     const pad = (cells) => {
         while (cells.length < cols.length)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geml/geml",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "mcpName": "io.github.geml-spec/geml",
   "publishConfig": {
     "access": "public"