@manifest-configuration-language/browser 0.1.5 → 0.1.6

package/dist/mcl.wasm

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/mcl.wasm
-size: 96219377 bytes
-sha256: 285f6bf9e6c1720d4db98f9aeedcf0d751e8ef33a5f7a3b2d2d2c501c9f12a9d
+size: 96170429 bytes
+sha256: d08ad3914d8a2862e52db7dbc3ec43c38c1143dea99dda6c87383c7d59212c7d

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manifest-configuration-language/browser",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Run MCL projects in a browser Web Worker using the Go WebAssembly runtime.",
   "repository": {
     "type": "git",

package/src/index.d.ts

@@ -24,6 +24,9 @@ export declare const maxSourceBytes: number;
 export declare const maxProjectFiles: number;
 export declare const maxProjectFileBytes: number;
 export declare const maxProjectBytes: number;
+export declare const maxProjectPathLength: number;
+export declare const maxProjectPathDepth: number;
+export declare function isValidProjectPath(path: unknown): path is string;
 
 /** Root-relative project files passed to MCL's per-request filesystem. Uint8Array values are copied before transfer so callers can reuse them. */
 export type ProjectFile = string | Uint8Array;

package/src/index.js

@@ -1,6 +1,27 @@
-import { maxProjectBytes, maxProjectFileBytes, maxProjectFiles, maxSourceBytes } from "./limits.js";
+import {
+  maxProjectBytes,
+  maxProjectFileBytes,
+  maxProjectFiles,
+  maxProjectPathDepth,
+  maxProjectPathLength,
+  maxSourceBytes,
+} from "./limits.js";
 
-export { maxProjectBytes, maxProjectFileBytes, maxProjectFiles, maxSourceBytes };
+export { maxProjectBytes, maxProjectFileBytes, maxProjectFiles, maxProjectPathDepth, maxProjectPathLength, maxSourceBytes };
+
+export function isValidProjectPath(value) {
+  if (typeof value !== "string" || value.length === 0 || value.startsWith("/") ||
+    /^[a-z]:/i.test(value) || value.includes("\\") || value.includes("\0")) {
+    return false;
+  }
+  let pathLength = 0;
+  let pathDepth = 1;
+  for (const character of value) {
+    if (++pathLength > maxProjectPathLength) return false;
+    if (character === "/" && ++pathDepth > maxProjectPathDepth) return false;
+  }
+  return value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
+}
 
 const defaultInitializationTimeoutMs = 30_000;
 const defaultOperationTimeoutMs = 10_000;
@@ -113,7 +134,8 @@ export function createMclRuntime(options = {}) {
       try {
         if (timeoutMs <= 0) throw timeoutError;
         timer = setTimeout(() => {
-          (stopCurrent ?? stopInitialization)?.(timeoutError);
+          if (stopCurrent) stopCurrent(timeoutError);
+          else stopInitialization?.(timeoutError);
         }, timeoutMs);
         await waitUntilReady(requestOptions.signal);
         if (requestOptions.signal?.aborted) throw new DOMException("The operation was aborted", "AbortError");
@@ -258,7 +280,7 @@ export function createMclRuntime(options = {}) {
   }
 
   function isSafeRelativePath(filePath) {
-    return typeof filePath === "string" && filePath.length > 0 && !/^[a-z]:/i.test(filePath) && !filePath.startsWith("/") && !filePath.includes("\\") && filePath.split("/").every((part) => part && part !== "." && part !== "..");
+    return isValidProjectPath(filePath);
   }
 
   function prepareFilesForTransfer(source, files, entrypoint) {

package/src/limits.js

@@ -5,3 +5,5 @@ export const maxProjectFileBytes = 16777216;
 export const maxProjectBytes = 67108864;
 export const maxOutputBytes = 1048576;
 export const evaluationTimeoutMillis = 4000;
+export const maxProjectPathLength = 512;
+export const maxProjectPathDepth = 64;

package/src/protocol.d.ts

@@ -6,10 +6,7 @@ export type Request = {
   revision?: number;
   operation: "parse" | "lint" | "format" | "check" | "evaluate" | "render" | "completion" | "definition" | "hover";
   position?: CompletionPosition;
-  /**
-   * Project-relative MCL source path. Defaults to main.mcl.
-   */
-  entrypoint?: string;
+  entrypoint?: ProjectPath;
   /**
    * UTF-8 entrypoint source, limited by the runtime.
    */
@@ -21,6 +18,10 @@ export type Request = {
     [k: string]: FileInput;
   };
 };
+/**
+ * Project-relative MCL source path. Defaults to main.mcl.
+ */
+export type ProjectPath = string;
 /**
  * Binary files omit content and are supplied in the optional second run argument under the same path.
  */