@poe-platform/safe-fs 0.1.724 → 0.1.725

package/README.md

@@ -339,6 +339,8 @@ Each batch lists from the beginning because previous keys have been deleted; it
 
 Known identity Content-Length responses use one result buffer; other responses grow storage up to the configured ceiling and return a view without a final copy. Growth can temporarily retain the old and new buffers (up to three times the response size), plus transport chunks. These per-response defaults leave headroom in Workers; hosts must still budget for metadata parsing, text decoding, transport buffers, and concurrent reads, especially when raising the limits. Use streaming reads for large files.
 
+WebDAV metadata parsing limits the document to 100,000 elements, 100,000 content nodes, 100,000 attributes, and 256 levels of nesting, independently of `maxEntries`. Text is bounded by `maxXmlBytes`. Exceeding a structural budget reports `EFBIG`; parsing yields cooperatively so caller cancellation and `timeoutMs` remain active.
+
 See the [binding types](src/fs/webdav/webdav.ts) before implementing atomic directory removal. A recursive WebDAV DELETE does not satisfy that contract.
 
 </details>

package/dist/safe-fs/fs/webdav/webdav.js

@@ -1,7 +1,7 @@
 import { FsError, isErrnoCode, isFsError } from "../../contracts/errors.js";
 import { composeAbortSignals } from "../../contracts/abort.js";
 import { readBytes } from "../../contracts/io.js";
-import { davChild, davChildren, parseXml, scalar, XmlResponseLimitError } from "./xml.js";
+import { davChild, davChildren, parseXmlSteps, scalar, XmlResponseLimitError, XmlResourceLimitError } from "./xml.js";
 import { admitDirectoryEntries, directoryEntryLimit } from "../directory-admission.js";
 import { assertCallbackAuthorityAllowed, compareEntries, registerEntryAuthority } from "../mount/comparison.js";
 import { compareWebDavResources, ownedResponseIdentifier, recordOwnedResourceStat, registerResourceQuery, resourceIdentifier } from "./resource-id.js";
@@ -561,7 +561,34 @@ export class WebDavFileSystem {
         const data = await this.bytes(response, this.maxXmlBytes, signal);
         const encoding = (data[0] === 0xff && data[1] === 0xfe) || (data[0] === 0x3c && data[1] === 0)
             ? "utf-16le" : (data[0] === 0xfe && data[1] === 0xff) || (data[0] === 0 && data[1] === 0x3c) ? "utf-16be" : "utf-8";
-        return parseXml(new TextDecoder(encoding, { fatal: true }).decode(data), maxResponses === undefined ? undefined : { maxResponses });
+        const parser = parseXmlSteps(new TextDecoder(encoding, { fatal: true }).decode(data), {
+            ...(maxResponses === undefined ? {} : { maxResponses }),
+            maxNodes: 100_000, maxContentNodes: 100_000, maxDepth: 256,
+            maxAttributes: 100_000, maxTextLength: this.maxXmlBytes,
+        });
+        let work = 0;
+        try {
+            while (true) {
+                signal.throwIfAborted();
+                const step = parser.next();
+                if (step.done)
+                    return step.value;
+                work += step.value;
+                if (work >= 4096) {
+                    work = 0;
+                    // Yield to the host task queue so request deadlines and caller aborts can fire.
+                    await new Promise(resolve => setTimeout(resolve, 0));
+                }
+            }
+        }
+        catch (error) {
+            if (error instanceof XmlResourceLimitError)
+                fail("EFBIG", "webdav", "", error.message);
+            throw error;
+        }
+        finally {
+            parser.return(undefined);
+        }
     }
     async multistatus(response, signal, method = "PROPFIND", path = "") {
         const link = response.headers.get("link");

package/dist/safe-fs/fs/webdav/xml.d.ts

@@ -6,7 +6,10 @@ export interface XmlLimits extends Omit<DocumentLimits, "onElement"> {
 }
 export declare class XmlResponseLimitError extends SyntaxError {
 }
+export declare class XmlResourceLimitError extends SyntaxError {
+}
 export declare function parseXml(input: string, limits?: XmlLimits): XmlElement;
+export declare function parseXmlSteps(input: string, limits?: XmlLimits): Generator<number, XmlElement, void>;
 export declare function davChildren(element: XmlElement, localName: string): XmlElement[];
 export declare function davChild(element: XmlElement, localName: string): XmlElement | undefined;
 export declare function scalar(element: XmlElement): string;

package/dist/safe-fs/fs/webdav/xml.js

@@ -1,15 +1,31 @@
-import { parseXml as parseDocument, XmlLimitError } from "../../xml.js";
+import { parseXmlSteps as parseDocumentSteps, XmlLimitError } from "../../xml.js";
 export class XmlResponseLimitError extends SyntaxError {
 }
+export class XmlResourceLimitError extends SyntaxError {
+}
 function invalid(message) { throw new SyntaxError(`Invalid WebDAV XML: ${message}`); }
 export function parseXml(input, limits = {}) {
+    const parser = parseXmlSteps(input, limits);
+    try {
+        let step = parser.next();
+        while (!step.done)
+            step = parser.next();
+        return step.value;
+    }
+    catch (error) {
+        if (error instanceof XmlResourceLimitError)
+            throw new SyntaxError(error.message);
+        throw error;
+    }
+}
+export function* parseXmlSteps(input, limits = {}) {
     const { maxResponses, ...documentLimits } = limits;
     if (maxResponses !== undefined && (!Number.isSafeInteger(maxResponses) || maxResponses < 1)) {
         throw new RangeError("XML limits must be positive integers");
     }
     let responses = 0;
     try {
-        return parseDocument(input, { ...documentLimits, retainContent: false,
+        return yield* parseDocumentSteps(input, { ...documentLimits, retainContent: false,
             onElement(element, parent, depth) {
                 if (maxResponses !== undefined && depth === 2 && parent?.namespace === "DAV:" && parent.localName === "multistatus"
                     && element.namespace === "DAV:" && element.localName === "response" && ++responses > maxResponses) {
@@ -20,7 +36,7 @@ export function parseXml(input, limits = {}) {
     }
     catch (error) {
         if (error instanceof XmlLimitError)
-            invalid(error.message);
+            throw new XmlResourceLimitError(`Invalid WebDAV XML: ${error.message}`);
         if (error instanceof SyntaxError && error.message.startsWith("Invalid XML:")) {
             error.message = error.message.replace("Invalid XML:", "Invalid WebDAV XML:");
         }

package/dist/safe-fs/xml.js

@@ -288,9 +288,10 @@ export function* parseXmlSteps(input, limits = {}) {
         const parent = stack.at(-1);
         if (parent) {
             parent.element.text += text;
-            if (retainContent && (text.length || kind === "cdata")) {
+            if (text.length || kind === "cdata") {
                 admitContent();
-                parent.content.push({ kind, text });
+                if (retainContent)
+                    parent.content.push({ kind, text });
             }
         }
         else {
@@ -302,9 +303,10 @@ export function* parseXmlSteps(input, limits = {}) {
             }
             if (text.length % 512)
                 yield text.length % 512;
-            if (retainContent && text.length) {
+            if (text.length) {
                 admitContent();
-                (root ? epilog : prolog).push({ kind, text });
+                if (retainContent)
+                    (root ? epilog : prolog).push({ kind, text });
             }
         }
     };
@@ -326,8 +328,8 @@ export function* parseXmlSteps(input, limits = {}) {
             const parent = stack.at(-1);
             const text = source.slice(offset + 4, end);
             admitText(text);
+            admitContent();
             if (retainContent) {
-                admitContent();
                 (parent?.content ?? (root ? epilog : prolog)).push({ kind: "comment", text });
             }
             offset = end + 3;
@@ -371,8 +373,8 @@ export function* parseXmlSteps(input, limits = {}) {
                     yield start % 512;
                 const text = content.slice(start);
                 admitText(text);
+                admitContent();
                 if (retainContent) {
-                    admitContent();
                     (parent?.content ?? (root ? epilog : prolog)).push({ kind: "processing-instruction", target, text });
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poe-platform/safe-fs",
-  "version": "0.1.724",
+  "version": "0.1.725",
   "description": "Composable filesystem with a portable core and explicit Node adapters",
   "type": "module",
   "license": "MIT",