@mintlify/common 1.0.1135 → 1.0.1136

package/dist/mdx/plugins/remark/remarkMdxExpandExpressions.js

@@ -39,6 +39,15 @@ const JSXParser = Parser.extend(jsx());
 export const MAX_MDX_FRAGMENT_DEPTH = 8;
 export const MAX_MDX_FRAGMENTS_PER_PAGE = 500;
 const UNKNOWN = Symbol('unknown');
+/**
+ * Bounds on the work reachability analysis may spend on a single expression (nodes visited across
+ * binding collection, the reachability walk and constant folding, and recursion depth). The
+ * analysis only prunes headings from the table of contents, so exceeding a cap fails open:
+ * analysis stops and every remaining `<MDX>` element keeps its headings.
+ */
+const MAX_ANALYSIS_NODES = 50000;
+const MAX_ANALYSIS_DEPTH = 1000;
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 /**
  * Compile-time expansion of `<MDX>` inside `{…}` expressions.
  *
@@ -254,6 +263,7 @@ const isMdxElement = (node) => node.type === 'JSXElement' &&
  */
 export const getExportedConstants = (tree) => {
     const constants = {};
+    const budget = { remaining: MAX_ANALYSIS_NODES };
     visit(tree, 'mdxjsEsm', (node) => {
         var _a, _b, _c, _d;
         for (const statement of (_c = (_b = (_a = node.data) === null || _a === void 0 ? void 0 : _a.estree) === null || _b === void 0 ? void 0 : _b.body) !== null && _c !== void 0 ? _c : []) {
@@ -264,9 +274,9 @@ export const getExportedConstants = (tree) => {
             if (statement.declaration.kind !== 'const')
                 continue;
             for (const { id, init } of statement.declaration.declarations) {
-                if (id.type !== 'Identifier' || !init)
+                if (id.type !== 'Identifier' || !init || UNSAFE_KEYS.has(id.name))
                     continue;
-                const value = evaluate(init, {});
+                const value = evaluate(init, {}, budget);
                 if (value !== UNKNOWN)
                     constants[id.name] = value;
             }
@@ -313,10 +323,13 @@ const compare = (operator, left, right) => {
     }
 };
 /** Static value of an expression given the page's constants, or UNKNOWN. */
-const evaluate = (node, constants) => {
+const evaluate = (node, constants, budget, depth = 0) => {
+    if (budget.remaining <= 0 || depth >= MAX_ANALYSIS_DEPTH)
+        return UNKNOWN;
+    budget.remaining -= 1;
     // acorn emits this node only with `preserveParens`; the estree types do not list it
     if (node.type === 'ParenthesizedExpression') {
-        return evaluate(node.expression, constants);
+        return evaluate(node.expression, constants, budget, depth + 1);
     }
     switch (node.type) {
         case 'Literal':
@@ -330,7 +343,7 @@ const evaluate = (node, constants) => {
                 return undefined;
             return Object.hasOwn(constants, node.name) ? constants[node.name] : UNKNOWN;
         case 'ObjectExpression': {
-            const object = {};
+            const object = Object.create(null);
             for (const property of node.properties) {
                 if (property.type !== 'Property' || property.kind !== 'init' || property.computed) {
                     return UNKNOWN;
@@ -340,9 +353,9 @@ const evaluate = (node, constants) => {
                     : property.key.type === 'Literal'
                         ? String(property.key.value)
                         : undefined;
-                if (key === undefined)
+                if (key === undefined || UNSAFE_KEYS.has(key))
                     return UNKNOWN;
-                const value = evaluate(property.value, constants);
+                const value = evaluate(property.value, constants, budget, depth + 1);
                 if (value === UNKNOWN)
                     return UNKNOWN;
                 object[key] = value;
@@ -350,11 +363,11 @@ const evaluate = (node, constants) => {
             return object;
         }
         case 'MemberExpression': {
-            const object = evaluate(node.object, constants);
+            const object = evaluate(node.object, constants, budget, depth + 1);
             if (object === UNKNOWN || !isObject(object))
                 return UNKNOWN;
             const key = node.computed
-                ? evaluate(node.property, constants)
+                ? evaluate(node.property, constants, budget, depth + 1)
                 : node.property.type === 'Identifier'
                     ? node.property.name
                     : UNKNOWN;
@@ -363,7 +376,7 @@ const evaluate = (node, constants) => {
             return Object.hasOwn(object, String(key)) ? object[String(key)] : undefined;
         }
         case 'UnaryExpression': {
-            const argument = evaluate(node.argument, constants);
+            const argument = evaluate(node.argument, constants, budget, depth + 1);
             if (argument === UNKNOWN)
                 return UNKNOWN;
             if (node.operator === '!')
@@ -375,58 +388,64 @@ const evaluate = (node, constants) => {
             return UNKNOWN;
         }
         case 'BinaryExpression': {
-            const left = evaluate(node.left, constants);
-            const right = evaluate(node.right, constants);
+            const left = evaluate(node.left, constants, budget, depth + 1);
+            const right = evaluate(node.right, constants, budget, depth + 1);
             return left === UNKNOWN || right === UNKNOWN ? UNKNOWN : compare(node.operator, left, right);
         }
         case 'LogicalExpression': {
-            const left = evaluate(node.left, constants);
+            const left = evaluate(node.left, constants, budget, depth + 1);
             if (left === UNKNOWN)
                 return UNKNOWN;
             if (node.operator === '&&')
-                return left ? evaluate(node.right, constants) : left;
+                return left ? evaluate(node.right, constants, budget, depth + 1) : left;
             if (node.operator === '||')
-                return left ? left : evaluate(node.right, constants);
-            return left != null ? left : evaluate(node.right, constants);
+                return left ? left : evaluate(node.right, constants, budget, depth + 1);
+            return left != null ? left : evaluate(node.right, constants, budget, depth + 1);
         }
         default:
             return UNKNOWN;
     }
 };
 /**
- * Names a function binds: parameters and every declaration in its body. Over-approximate on
- * purpose (a destructuring key counts too): a shadowed name becomes unknown, which keeps headings.
+ * Names bound anywhere in the expression: parameters and every declaration. Collected in a single
+ * pass and over-approximate on purpose (a destructuring key counts too, and a name one function
+ * binds shadows constants inside every function): a shadowed name becomes unknown, which keeps
+ * headings. Returns null when the node budget runs out.
  */
-const collectFunctionBindings = (fn) => {
+const collectBindingNames = (root, budget) => {
     const names = new Set();
-    const addIdentifiers = (pattern) => {
-        if (pattern) {
-            walk(pattern, {
-                enter(jsNode) {
-                    if (jsNode.type === 'Identifier')
-                        names.add(jsNode.name);
-                },
-            });
+    let capped = false;
+    const visitValue = (value, inBinding, depth) => {
+        if (capped || !value || typeof value !== 'object')
+            return;
+        if (Array.isArray(value)) {
+            for (const child of value)
+                visitValue(child, inBinding, depth);
+            return;
+        }
+        const node = value;
+        if (typeof node.type !== 'string')
+            return;
+        if (budget.remaining <= 0 || depth >= MAX_ANALYSIS_DEPTH) {
+            capped = true;
+            return;
+        }
+        budget.remaining -= 1;
+        if (inBinding && node.type === 'Identifier')
+            names.add(node.name);
+        for (const key of Object.keys(node)) {
+            if (NON_CHILD_KEYS.has(key))
+                continue;
+            visitValue(node[key], inBinding || isBindingKey(node, key), depth + 1);
         }
     };
-    walk(fn, {
-        enter(jsNode) {
-            if (isFunction(jsNode)) {
-                for (const param of jsNode.params)
-                    addIdentifiers(param);
-                if (jsNode.type === 'FunctionDeclaration')
-                    addIdentifiers(jsNode.id);
-            }
-            else if (jsNode.type === 'VariableDeclarator')
-                addIdentifiers(jsNode.id);
-            else if (jsNode.type === 'ClassDeclaration')
-                addIdentifiers(jsNode.id);
-            else if (jsNode.type === 'CatchClause')
-                addIdentifiers(jsNode.param);
-        },
-    });
-    return names;
+    visitValue(root, false, 0);
+    return capped ? null : names;
 };
+const isBindingKey = (node, key) => (isFunction(node) && (key === 'params' || key === 'id')) ||
+    (node.type === 'VariableDeclarator' && key === 'id') ||
+    (node.type === 'ClassDeclaration' && key === 'id') ||
+    (node.type === 'CatchClause' && key === 'param');
 const isFunction = (node) => node.type === 'ArrowFunctionExpression' ||
     node.type === 'FunctionExpression' ||
     node.type === 'FunctionDeclaration';
@@ -434,34 +453,47 @@ const NON_CHILD_KEYS = new Set(['type', 'start', 'end', 'loc', 'range', 'comment
 /**
  * Whether each `<MDX>` element in `expression` can render: `false` only when a guarding
  * conditional or logical operator folds to the other branch, `true` on a taken branch or when
- * any guard is unknown. Names a function binds shadow constants inside it.
+ * any guard is unknown. A name bound anywhere in the expression shadows constants inside every
+ * function (collected once, so the walk stays linear). Total work is capped by a shared node
+ * budget and a depth limit; past either cap the walk stops and every element not yet marked
+ * stays reachable.
  */
 const markReachability = (expression, constants) => {
     const reachability = new Map();
-    const visitNode = (value, reachable, scope) => {
+    const budget = { remaining: MAX_ANALYSIS_NODES };
+    const bindings = collectBindingNames(expression, budget);
+    if (bindings === null)
+        return reachability;
+    const functionScope = Object.assign({}, constants);
+    for (const name of bindings)
+        delete functionScope[name];
+    const visitNode = (value, reachable, scope, depth) => {
         if (!value || typeof value !== 'object')
             return;
         if (Array.isArray(value)) {
             for (const child of value)
-                visitNode(child, reachable, scope);
+                visitNode(child, reachable, scope, depth);
             return;
         }
         const node = value;
         if (typeof node.type !== 'string')
             return;
+        if (budget.remaining <= 0 || depth >= MAX_ANALYSIS_DEPTH)
+            return;
+        budget.remaining -= 1;
         if (isMdxElement(node)) {
             reachability.set(node, reachable);
             return;
         }
         if (node.type === 'ConditionalExpression') {
-            const test = evaluate(node.test, scope);
-            visitNode(node.consequent, reachable && (test === UNKNOWN || Boolean(test)), scope);
-            visitNode(node.alternate, reachable && (test === UNKNOWN || !test), scope);
+            const test = evaluate(node.test, scope, budget);
+            visitNode(node.consequent, reachable && (test === UNKNOWN || Boolean(test)), scope, depth + 1);
+            visitNode(node.alternate, reachable && (test === UNKNOWN || !test), scope, depth + 1);
             return;
         }
         if (node.type === 'LogicalExpression') {
-            const left = evaluate(node.left, scope);
-            visitNode(node.left, reachable, scope);
+            const left = evaluate(node.left, scope, budget);
+            visitNode(node.left, reachable, scope, depth + 1);
             let rightReachable = reachable;
             if (left !== UNKNOWN) {
                 if (node.operator === '&&')
@@ -471,22 +503,17 @@ const markReachability = (expression, constants) => {
                 else
                     rightReachable = reachable && left == null;
             }
-            visitNode(node.right, rightReachable, scope);
+            visitNode(node.right, rightReachable, scope, depth + 1);
             return;
         }
-        let childScope = scope;
-        if (isFunction(node)) {
-            childScope = Object.assign({}, scope);
-            for (const name of collectFunctionBindings(node))
-                delete childScope[name];
-        }
+        const childScope = isFunction(node) ? functionScope : scope;
         for (const key of Object.keys(node)) {
             if (NON_CHILD_KEYS.has(key))
                 continue;
-            visitNode(node[key], reachable, childScope);
+            visitNode(node[key], reachable, childScope, depth + 1);
         }
     };
-    visitNode(expression, true, constants);
+    visitNode(expression, true, constants, 0);
     return reachability;
 };
 export const dedent = (text) => {