@poe-platform/safe-fs 0.1.73 → 0.1.74

package/dist/safe-fs/fs/webdav/webdav.js

@@ -1,7 +1,7 @@
 import { FsError, isErrnoCode, isFsError } from "../../contracts/errors.js";
 import { composeAbortSignals } from "../../contracts/abort.js";
 import { readBytes } from "../../contracts/io.js";
-import { davChild, davChildren, parseXml, scalar } from "./xml.js";
+import { davChild, davChildren, parseXml, scalar, XmlResponseLimitError } from "./xml.js";
 import { admitDirectoryEntries, directoryEntryLimit } from "../directory-admission.js";
 import { assertCallbackAuthorityAllowed, compareEntries, registerEntryAuthority } from "../mount/comparison.js";
 import { compareWebDavResources, ownedResponseIdentifier, recordOwnedResourceStat, registerResourceQuery, resourceIdentifier } from "./resource-id.js";
@@ -474,20 +474,26 @@ export class WebDavFileSystem {
             reader.releaseLock();
         }
     }
-    async xml(response, signal) {
+    async xml(response, signal, maxResponses) {
         const data = await this.bytes(response, this.maxXmlBytes, signal);
         const encoding = (data[0] === 0xff && data[1] === 0xfe) || (data[0] === 0x3c && data[1] === 0)
             ? "utf-16le" : (data[0] === 0xfe && data[1] === 0xff) || (data[0] === 0 && data[1] === 0x3c) ? "utf-16be" : "utf-8";
-        return parseXml(new TextDecoder(encoding, { fatal: true }).decode(data), {
-            maxNodes: this.maxXmlBytes, maxAttributes: this.maxXmlBytes,
-        });
+        return parseXml(new TextDecoder(encoding, { fatal: true }).decode(data), maxResponses === undefined ? undefined : { maxResponses });
     }
     async multistatus(response, signal, method = "PROPFIND", path = "") {
         const link = response.headers.get("link");
         if (link && /\brel\s*=\s*(?:"[^"]*\bnext\b[^"]*"|'[^']*\bnext\b[^']*'|next\b)/i.test(link)) {
             fail("ENOTSUP", method, path, "paginated WebDAV responses are unsupported");
         }
-        const root = await this.xml(response, signal);
+        let root;
+        try {
+            root = await this.xml(response, signal, this.maxEntries);
+        }
+        catch (error) {
+            if (error instanceof XmlResponseLimitError)
+                fail("EFBIG", method, path, "response exceeds entry limit");
+            throw error;
+        }
         if (root.namespace !== "DAV:" || root.localName !== "multistatus")
             throw new Error("expected DAV:multistatus");
         const responses = davChildren(root, "response");

package/dist/safe-fs/fs/webdav/xml.d.ts

@@ -8,6 +8,9 @@ export interface XmlLimits {
     readonly maxDepth?: number;
     readonly maxNodes?: number;
     readonly maxAttributes?: number;
+    readonly maxResponses?: number;
+}
+export declare class XmlResponseLimitError extends SyntaxError {
 }
 export declare function parseXml(input: string, limits?: XmlLimits): XmlElement;
 export declare function davChildren(element: XmlElement, localName: string): XmlElement[];

package/dist/safe-fs/fs/webdav/xml.js

@@ -1,3 +1,5 @@
+export class XmlResponseLimitError extends SyntaxError {
+}
 const xmlNamespace = "http://www.w3.org/XML/1998/namespace";
 const xmlnsNamespace = "http://www.w3.org/2000/xmlns/";
 function invalid(message) {
@@ -66,7 +68,7 @@ export function parseXml(input, limits = {}) {
     const maxDepth = limits.maxDepth ?? 64;
     const maxNodes = limits.maxNodes ?? 100_000;
     const maxAttributes = limits.maxAttributes ?? 10_000;
-    for (const limit of [maxDepth, maxNodes, maxAttributes]) {
+    for (const limit of [maxDepth, maxNodes, maxAttributes, ...(limits.maxResponses === undefined ? [] : [limits.maxResponses])]) {
         if (!Number.isSafeInteger(limit) || limit < 1)
             throw new RangeError("XML limits must be positive integers");
     }
@@ -80,6 +82,7 @@ export function parseXml(input, limits = {}) {
     let offset = 0;
     let nodes = 0;
     let attributeCount = 0;
+    let responses = 0;
     const whitespace = () => {
         while (offset < source.length && " \t\n\r".includes(source[offset]))
             offset++;
@@ -211,9 +214,16 @@ export function parseXml(input, limits = {}) {
             const [prefix, localName] = qualifiedName(name);
             if (prefix === "xmlns" || (prefix && !namespaces.has(prefix)))
                 invalid("unbound element prefix");
-            const element = { namespace: namespaces.get(prefix) ?? "", localName, children: [], text: "" };
             if (++nodes > maxNodes || stack.length + 1 > maxDepth)
                 invalid("XML resource limit exceeded");
+            const namespace = namespaces.get(prefix) ?? "";
+            if (limits.maxResponses !== undefined && stack.length === 1
+                && root?.namespace === "DAV:" && root.localName === "multistatus"
+                && namespace === "DAV:" && localName === "response"
+                && ++responses > limits.maxResponses) {
+                throw new XmlResponseLimitError("WebDAV XML response limit exceeded");
+            }
+            const element = { namespace, localName, children: [], text: "" };
             const parent = stack.at(-1);
             if (parent)
                 parent.element.children.push(element);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poe-platform/safe-fs",
-  "version": "0.1.73",
+  "version": "0.1.74",
   "description": "Composable filesystem with a portable core and explicit Node adapters",
   "type": "module",
   "license": "MIT",