@memberjunction/global 6.1.0-edge.2 → 6.1.0-edge.4

package/dist/__tests__/SafeExpressionEvaluator.security.test.js

@@ -0,0 +1,284 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { SafeExpressionEvaluator } from '../SafeExpressionEvaluator.js';
+/**
+ * Adversarial security tests for SafeExpressionEvaluator.
+ *
+ * SafeExpressionEvaluator compiles the caller's expression into a real JavaScript
+ * function via `new Function(...)` and runs it. Its defense against arbitrary code
+ * execution is a STRUCTURAL ALLOWLIST: the expression is parsed to an AST and every
+ * node is checked against a whitelist before it is ever compiled. A construct that
+ * is not on the list — computed member access with a non-literal key, `.constructor`
+ * / `__proto__` access, any call outside the safe-method list, a host-global
+ * identifier — is rejected at validation time and never reaches `new Function`.
+ *
+ * This is what closes the string-concatenation escape a textual denylist could not:
+ * `[]["cons"+"tructor"]["cons"+"tructor"]("…")()` parses to computed member access
+ * whose key is a `+` expression, not a literal, so it is rejected structurally no
+ * matter how the dangerous name is spelled. See the "string-concatenation escape"
+ * block below. Because the check is structural, it also stops over-rejecting data
+ * that merely mentions a reserved word (`name == 'constructor'` is a legal compare).
+ */
+describe('SafeExpressionEvaluator - Security', () => {
+    let evaluator;
+    beforeEach(() => {
+        evaluator = new SafeExpressionEvaluator();
+    });
+    /** Assert an expression is rejected at the validation stage (never compiled/run). */
+    const expectBlocked = (expr, ctx = {}) => {
+        const r = evaluator.evaluate(expr, ctx);
+        expect(r.success).toBe(false);
+        expect(r.error).toContain('forbidden construct');
+    };
+    // ---------------------------------------------------------------
+    // Direct code-execution primitives — denylist HOLDS
+    // ---------------------------------------------------------------
+    describe('direct eval / Function constructor (textual forms blocked)', () => {
+        it('should block eval(...)', () => {
+            expectBlocked("eval('1+1')");
+        });
+        it('should block new Function(...)', () => {
+            expectBlocked("new Function('return 1')");
+        });
+        it('should block a bare Function(...) call', () => {
+            expectBlocked("Function('return 1')()");
+        });
+        it('should block require(...)', () => {
+            expectBlocked("require('child_process')");
+        });
+        it('should block import statements', () => {
+            expectBlocked("import 'fs'");
+        });
+    });
+    // ---------------------------------------------------------------
+    // Prototype-chain escapes — denylist HOLDS
+    // ---------------------------------------------------------------
+    describe('prototype-chain escapes (blocked)', () => {
+        it('should block .constructor access (dotted)', () => {
+            expectBlocked('x.constructor', { x: 1 });
+        });
+        it('should block constructor.constructor (the classic Function-constructor climb)', () => {
+            expectBlocked("x.constructor.constructor('return process')()", { x: 1 });
+        });
+        it('should block constructor via bracket string', () => {
+            // The word-boundary denylist matches "constructor" even inside ["..."]
+            expectBlocked('x["constructor"]', { x: 1 });
+        });
+        it('should block __proto__ access (dotted)', () => {
+            expectBlocked('x.__proto__', { x: {} });
+        });
+        it('should block __proto__ via bracket string', () => {
+            expectBlocked('x["__proto__"]', { x: {} });
+        });
+        it('should block prototype access', () => {
+            expectBlocked('x.prototype', { x: {} });
+        });
+    });
+    // ---------------------------------------------------------------
+    // Dotted access to host globals — denylist HOLDS for the dotted form
+    // ---------------------------------------------------------------
+    describe('dotted host-global access (blocked)', () => {
+        it('should block process.<member>', () => {
+            expectBlocked('process.exit');
+        });
+        it('should block global.<member>', () => {
+            expectBlocked('global.process');
+        });
+        it('should block window.<member>', () => {
+            expectBlocked('window.location');
+        });
+        it('should block document.<member>', () => {
+            expectBlocked('document.cookie');
+        });
+    });
+    // ---------------------------------------------------------------
+    // Statement / control-flow injection — denylist HOLDS
+    // ---------------------------------------------------------------
+    describe('statement and control-flow injection (blocked)', () => {
+        it('should block semicolons (statement chaining)', () => {
+            expectBlocked('a == 1; b == 2', { a: 1, b: 2 });
+        });
+        it('should block curly braces (code blocks)', () => {
+            expectBlocked('{ a: 1 }', { a: 1 });
+        });
+        it('should block template literals', () => {
+            expectBlocked('a == `x`', { a: 'x' });
+        });
+        it.each(['throw', 'try', 'catch', 'finally', 'async', 'await', 'class', 'extends', 'this'])('should block the "%s" keyword', (keyword) => {
+            expectBlocked(`${keyword} x`, { x: 1 });
+        });
+    });
+    // ---------------------------------------------------------------
+    // Input-size guard (the one DoS-ish protection the code promises)
+    // ---------------------------------------------------------------
+    describe('input-size guard', () => {
+        it('should reject expressions over 1000 characters', () => {
+            const huge = 'a == 1 && '.repeat(150) + 'a == 1';
+            const r = evaluator.evaluate(huge, { a: 1 });
+            expect(r.success).toBe(false);
+            expect(r.error).toContain('maximum length');
+        });
+    });
+    // ---------------------------------------------------------------
+    // Context sanitisation
+    // ---------------------------------------------------------------
+    describe('context sanitisation', () => {
+        it('should drop a dangerous "eval" context key so compilation still succeeds', () => {
+            // A parameter named "eval" is a SyntaxError inside the strict-mode compiled function,
+            // so if createSafeContext did NOT strip it, evaluation would fail. Success here proves
+            // the dangerous key was dropped before `new Function(...)` was built.
+            const r = evaluator.evaluate('normal == 1', { eval: 99, normal: 1 });
+            expect(r.success).toBe(true);
+            expect(r.value).toBe(true);
+        });
+        it('should drop a dangerous "constructor" context key and keep normal keys usable', () => {
+            const r = evaluator.evaluate('normal == 1', { constructor: 99, normal: 1 });
+            expect(r.success).toBe(true);
+            expect(r.value).toBe(true);
+        });
+    });
+    // ===============================================================
+    // SANDBOX ESCAPE — bracket-string member access (now CLOSED)
+    // ===============================================================
+    //
+    // The escape reached host globals two ways the old dotted/call rules missed:
+    //   - the bare identifiers `globalThis` / `global` (host global object), and
+    //   - BRACKET-STRING member access, e.g. globalThis["Function"] or globalThis["process"],
+    //     which contains neither `Function(` nor `process.` and so slipped every rule.
+    //
+    // Because `new Function` runs in global scope, `globalThis`/`global` resolved to the real
+    // host global, giving arbitrary code execution and `process` reachability:
+    //
+    //     globalThis["Function"]("<attacker JS>")()          // was: arbitrary code execution
+    //     globalThis["process"]["mainModule"]["require"]("child_process")  // was: RCE gateway
+    //
+    // Fixed by denying the dangerous identifiers as WHOLE WORDS (\bglobalThis\b, \bglobal\b,
+    // \bFunction\b, \bprocess\b, \beval\b, \brequire\b, …) — a bare-word match also catches the
+    // bracket-string form. These tests pin that the route stays blocked.
+    // ===============================================================
+    describe('sandbox escape via bracket-string member access (blocked)', () => {
+        it('blocks the bare `globalThis` host global', () => {
+            expectBlocked('globalThis');
+        });
+        it('blocks the Function constructor reached via bracket string', () => {
+            expectBlocked('globalThis["Function"]("return 40+2")() === 42');
+        });
+        it('blocks `process` reached via bracket string on globalThis', () => {
+            expectBlocked('typeof globalThis["process"] === "object"');
+        });
+        it('blocks `process` reached via the bare `global` identifier', () => {
+            expectBlocked('typeof global["process"] === "object"');
+        });
+        it('blocks chained bracket-string access to process internals', () => {
+            expectBlocked('globalThis["process"]["version"].length > 0');
+        });
+        it('blocks single-segment dotted host global (globalThis.process)', () => {
+            expectBlocked('globalThis.process');
+        });
+    });
+    // ===============================================================
+    // STRING-CONCATENATION ESCAPE — the route a textual denylist missed (blocked)
+    // ===============================================================
+    //
+    // The prior whole-word denylist matched only literal tokens, so splitting a
+    // dangerous name across a `+` expression spelled it nowhere in the source:
+    //
+    //     []["cons"+"tructor"]["cons"+"tructor"]("return process.pid")()
+    //
+    // `[].constructor` is Array; `Array.constructor` is Function; the resulting
+    // Function constructor runs in global scope and reaches `process`. The AST walk
+    // rejects it because the computed member key is a `+` (BinaryExpression), not a
+    // literal — no matter how the name is assembled.
+    // ===============================================================
+    describe('string-concatenation sandbox escape (blocked)', () => {
+        it('blocks the Function-constructor climb built from split string literals', () => {
+            expectBlocked('[]["cons"+"tructor"]["cons"+"tructor"]("return 1")()');
+        });
+        it('blocks a split-name computed member access on a context value', () => {
+            expectBlocked('x["con"+"structor"]', { x: 1 });
+        });
+        it('blocks a split host-global name reached via computed access', () => {
+            expectBlocked('({})["__pro"+"to__"]', {});
+        });
+        it('blocks any dynamic (non-literal) computed member key', () => {
+            // Even a harmless-looking dynamic key is refused: dynamic keys are the escape surface.
+            expectBlocked('x[y]', { x: { a: 1 }, y: 'a' });
+        });
+        it('blocks a parenthesized string key that resolves to a dangerous property', () => {
+            expectBlocked('x[("constructor")]', { x: 1 });
+        });
+    });
+    // ===============================================================
+    // SAFE GLOBALS DO NOT REOPEN THE ESCAPE
+    // ===============================================================
+    //
+    // `Math.abs(x)` and `parseInt(x)` are admitted so the task-graph door stops refusing
+    // specs that run correctly. Both halves of every admitted call are FIXED identifiers
+    // in the AST, so the four invariants that close the escape still hold: literal-only
+    // computed keys, no `constructor`/`__proto__`/`prototype`, a closed non-computed call
+    // surface with no `call`/`apply`/`bind`, and screened free identifiers. These pin that.
+    // ===============================================================
+    describe('safe-global calls do not widen the escape surface', () => {
+        it('blocks the constructor climb off an allowed namespace', () => {
+            expectBlocked('Math.constructor("return 1")()');
+            expectBlocked('JSON.stringify.constructor("return 1")()');
+        });
+        it('blocks call/apply/bind on an allowed namespace method', () => {
+            expectBlocked('Math.abs.call(null, -1) === 1');
+            expectBlocked('parseInt.apply(null, ["1"]) === 1');
+        });
+        it('blocks a computed method name on an allowed namespace', () => {
+            expectBlocked('Math["cons"+"tructor"]("return 1")()');
+            expectBlocked('Math[m](-1) === 1', { m: 'abs' });
+        });
+        it('blocks a namespace method that is not on its list', () => {
+            expectBlocked('Object.getPrototypeOf(x) !== null', { x: {} });
+            expectBlocked('Object.setPrototypeOf(x, null) !== null', { x: {} });
+            expectBlocked('String.fromCharCode(65) === "A"');
+        });
+        it('blocks a bare call to any global outside the callable list', () => {
+            expectBlocked('setTimeout(1) === 1');
+            expectBlocked('structuredClone(x) !== null', { x: 1 });
+        });
+        it('blocks an optional call on a context value', () => {
+            // Optional chaining unwraps to the ordinary rules; it does not make `f()` callable.
+            expectBlocked('f?.() === 1', { f: 1 });
+            expectBlocked('x?.constructor', { x: 1 });
+        });
+    });
+    // ---------------------------------------------------------------
+    // No over-blocking of harmless data — the structural allowlist fix
+    // ---------------------------------------------------------------
+    // The old denylist rejected any expression whose TEXT mentioned a reserved token,
+    // even inside a string literal or as a field name. The AST walk distinguishes a
+    // reserved word used as CODE (blocked) from the same characters used as DATA
+    // (allowed), so these legitimate comparisons now succeed.
+    describe('legitimate data that mentions reserved words (allowed)', () => {
+        it('allows comparing a field against the literal string "constructor"', () => {
+            const r = evaluator.evaluate('name == "constructor"', { name: 'constructor' });
+            expect(r.success).toBe(true);
+            expect(r.value).toBe(true);
+        });
+        it('allows comparing a field against the literal string "this"', () => {
+            const r = evaluator.evaluate('label == "this"', { label: 'this' });
+            expect(r.success).toBe(true);
+            expect(r.value).toBe(true);
+        });
+        it('allows a `${...}` sequence inside a plain string literal', () => {
+            const r = evaluator.evaluate("a == '${x}'", { a: '${x}' });
+            expect(r.success).toBe(true);
+            expect(r.value).toBe(true);
+        });
+        it('allows reading a context field whose name is a former reserved token', () => {
+            // `payload.window` is a data field read, not host-global access.
+            const r = evaluator.evaluate("payload.window == 'morning'", { payload: { window: 'morning' } });
+            expect(r.success).toBe(true);
+            expect(r.value).toBe(true);
+        });
+        it('still allows words that merely contain a reserved token as a substring', () => {
+            const r = evaluator.evaluate('label == "thistle"', { label: 'thistle' });
+            expect(r.success).toBe(true);
+            expect(r.value).toBe(true);
+        });
+    });
+});
+//# sourceMappingURL=SafeExpressionEvaluator.security.test.js.map

package/dist/__tests__/SafeExpressionEvaluator.security.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SafeExpressionEvaluator.security.test.js","sourceRoot":"","sources":["../../src/__tests__/SafeExpressionEvaluator.security.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE;;;;;;;;;;;;;;;;;GAiBG;AACH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,IAAI,SAAkC,CAAC;IAEvC,UAAU,CAAC,GAAG,EAAE;QACd,SAAS,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,qFAAqF;IACrF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,MAA+B,EAAE,EAAQ,EAAE;QAC9E,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,kEAAkE;IAClE,oDAAoD;IACpD,kEAAkE;IAClE,QAAQ,CAAC,4DAA4D,EAAE,GAAG,EAAE;QAC1E,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAChC,aAAa,CAAC,aAAa,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,aAAa,CAAC,0BAA0B,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,aAAa,CAAC,wBAAwB,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,aAAa,CAAC,0BAA0B,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,aAAa,CAAC,aAAa,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,2CAA2C;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;QACjD,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,aAAa,CAAC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;YACvF,aAAa,CAAC,+CAA+C,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,uEAAuE;YACvE,aAAa,CAAC,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,aAAa,CAAC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;QACnD,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,aAAa,CAAC,cAAc,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,sDAAsD;IACtD,kEAAkE;IAClE,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAC9D,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,aAAa,CAAC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CACzF,+BAA+B,EAC/B,CAAC,OAAO,EAAE,EAAE;YACV,aAAa,CAAC,GAAG,OAAO,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACjD,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,uBAAuB;IACvB,kEAAkE;IAClE,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;YAClF,sFAAsF;YACtF,uFAAuF;YACvF,sEAAsE;YACtE,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACrE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;YACvF,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5E,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,6DAA6D;IAC7D,kEAAkE;IAClE,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,0FAA0F;IAC1F,mFAAmF;IACnF,EAAE;IACF,0FAA0F;IAC1F,2EAA2E;IAC3E,EAAE;IACF,0FAA0F;IAC1F,2FAA2F;IAC3F,EAAE;IACF,yFAAyF;IACzF,4FAA4F;IAC5F,qEAAqE;IACrE,kEAAkE;IAClE,QAAQ,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACzE,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,aAAa,CAAC,gDAAgD,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,aAAa,CAAC,2CAA2C,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,aAAa,CAAC,uCAAuC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,aAAa,CAAC,6CAA6C,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;YACvE,aAAa,CAAC,oBAAoB,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,8EAA8E;IAC9E,kEAAkE;IAClE,EAAE;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,EAAE;IACF,qEAAqE;IACrE,EAAE;IACF,4EAA4E;IAC5E,gFAAgF;IAChF,gFAAgF;IAChF,iDAAiD;IACjD,kEAAkE;IAClE,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAC7D,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;YAChF,aAAa,CAAC,sDAAsD,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;YACvE,aAAa,CAAC,qBAAqB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACrE,aAAa,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;YAC9D,uFAAuF;YACvF,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;YACjF,aAAa,CAAC,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,wCAAwC;IACxC,kEAAkE;IAClE,EAAE;IACF,qFAAqF;IACrF,qFAAqF;IACrF,oFAAoF;IACpF,sFAAsF;IACtF,wFAAwF;IACxF,kEAAkE;IAClE,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;QACjE,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,aAAa,CAAC,gCAAgC,CAAC,CAAC;YAChD,aAAa,CAAC,0CAA0C,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,aAAa,CAAC,+BAA+B,CAAC,CAAC;YAC/C,aAAa,CAAC,mCAAmC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,aAAa,CAAC,sCAAsC,CAAC,CAAC;YACtD,aAAa,CAAC,mBAAmB,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,aAAa,CAAC,mCAAmC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9D,aAAa,CAAC,yCAAyC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACpE,aAAa,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,aAAa,CAAC,qBAAqB,CAAC,CAAC;YACrC,aAAa,CAAC,6BAA6B,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,oFAAoF;YACpF,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvC,aAAa,CAAC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,kFAAkF;IAClF,gFAAgF;IAChF,6EAA6E;IAC7E,0DAA0D;IAC1D,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;QACtE,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;YAC3E,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/E,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACnE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;YAC9E,iEAAiE;YACjE,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,6BAA6B,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAChG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;YAChF,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/SafeExpressionEvaluator.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=SafeExpressionEvaluator.test.d.ts.map

package/dist/__tests__/SafeExpressionEvaluator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SafeExpressionEvaluator.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/SafeExpressionEvaluator.test.ts"],"names":[],"mappings":""}