@readme/markdown 15.9.1 → 15.9.3

package/dist/main.node.js

@@ -16243,6 +16243,15 @@ function cloneSort(comparator) {
   return templateFn(comparator);
 }
 
+let isEvalAllowed = (function () {
+  try {
+    new Function('return 0')();
+    return true;
+  } catch {
+    return false;
+  }
+})();
+
 /**
  * Sort the given array in-place with the given comparator function.
  *
@@ -16254,7 +16263,7 @@ function cloneSort(comparator) {
 
 let sortCache = new WeakMap();
 exports.g = function (ary, comparator, start = 0) {
-  let doQuickSort = sortCache.get(comparator);
+  let doQuickSort = isEvalAllowed ? sortCache.get(comparator) : SortTemplate(comparator);
   if (doQuickSort === void 0) {
     doQuickSort = cloneSort(comparator);
     sortCache.set(comparator, doQuickSort);
@@ -16282,6 +16291,14 @@ var ArraySet = (__webpack_require__(4361)/* .ArraySet */ .C);
 var base64VLQ = __webpack_require__(582);
 var quickSort = (__webpack_require__(4951)/* .quickSort */ .g);
 
+// Upper bound for a section's `offset.line` in an indexed source map. A flat
+// map spends one ';' per generated line, so a tiny indexed map with a huge
+// offset.line turns into a huge amount of work and memory once its mappings
+// are copied into a SourceMapGenerator (CVE-2026-93749). Ten million lines is
+// far beyond any real generated file. Columns are VLQ-encoded as deltas and
+// don't amplify, so they only need to be valid integers.
+var MAX_SECTION_OFFSET_LINE = 1e7;
+
 function SourceMapConsumer(aSourceMap, aSourceMapURL) {
   var sourceMap = aSourceMap;
   if (typeof aSourceMap === 'string') {
@@ -17206,6 +17223,7 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
     line: -1,
     column: 0
   };
+  var maxOffsetLine = 0;
   this._sections = sections.map(function (s) {
     if (s.url) {
       // The url field will require support for asynchronicity.
@@ -17216,12 +17234,32 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
     var offsetLine = util.getArg(offset, 'line');
     var offsetColumn = util.getArg(offset, 'column');
 
+    if (!isValidOffset(offsetLine) || !isValidOffset(offsetColumn)) {
+      throw new Error('Section offset line and column must be non-negative integers.');
+    }
+    if (offsetLine > MAX_SECTION_OFFSET_LINE) {
+      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE + '.');
+    }
+
     if (offsetLine < lastOffset.line ||
         (offsetLine === lastOffset.line && offsetColumn < lastOffset.column)) {
       throw new Error('Section offsets must be ordered and non-overlapping.');
     }
     lastOffset = offset;
 
+    var consumer = new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL);
+
+    // Offsets of a nested indexed map add up with this one, so apply the
+    // bound to the total.
+    var totalOffsetLine = offsetLine + (consumer._maxOffsetLine || 0);
+    if (totalOffsetLine > MAX_SECTION_OFFSET_LINE) {
+      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE +
+                      ', including offsets of nested sections.');
+    }
+    if (totalOffsetLine > maxOffsetLine) {
+      maxOffsetLine = totalOffsetLine;
+    }
+
     return {
       generatedOffset: {
         // The offset fields are 0-based, but we use 1-based indices when
@@ -17229,9 +17267,24 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
         generatedLine: offsetLine + 1,
         generatedColumn: offsetColumn + 1
       },
-      consumer: new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL)
+      consumer: consumer
     }
   });
+
+  // The largest offset.line of any section, including nested sections.
+  this._maxOffsetLine = maxOffsetLine;
+}
+
+/**
+ * Section offsets come from untrusted input and are used as line/column
+ * numbers, so only accept non-negative safe integers (rejects NaN, Infinity,
+ * strings, fractions, etc).
+ */
+function isValidOffset(aValue) {
+  return typeof aValue === 'number' &&
+    aValue >= 0 &&
+    aValue <= 9007199254740991 && // Number.MAX_SAFE_INTEGER
+    Math.floor(aValue) === aValue;
 }
 
 IndexedSourceMapConsumer.prototype = Object.create(SourceMapConsumer.prototype);
@@ -17249,8 +17302,12 @@ Object.defineProperty(IndexedSourceMapConsumer.prototype, 'sources', {
   get: function () {
     var sources = [];
     for (var i = 0; i < this._sections.length; i++) {
-      for (var j = 0; j < this._sections[i].consumer.sources.length; j++) {
-        sources.push(this._sections[i].consumer.sources[j]);
+      // Read the getter once per section: for a nested indexed map it is
+      // itself this getter, and re-reading it per item is exponential in the
+      // nesting depth (CVE-2026-93749).
+      var sectionSources = this._sections[i].consumer.sources;
+      for (var j = 0; j < sectionSources.length; j++) {
+        sources.push(sectionSources[j]);
       }
     }
     return sources;
@@ -17814,10 +17871,12 @@ SourceMapGenerator.prototype._serializeMappings =
 
       if (mapping.generatedLine !== previousGeneratedLine) {
         previousGeneratedColumn = 0;
-        while (mapping.generatedLine !== previousGeneratedLine) {
-          next += ';';
-          previousGeneratedLine++;
-        }
+        // One ';' per skipped line. Build large gaps with a single flat
+        // string: appending ';' one by one creates a rope node per line, which
+        // can exhaust the heap for a big gap (CVE-2026-93749).
+        var lineDelta = mapping.generatedLine - previousGeneratedLine;
+        next += lineDelta === 1 ? ';' : ';'.repeat(lineDelta);
+        previousGeneratedLine = mapping.generatedLine;
       }
       else {
         if (i > 0) {
@@ -18031,6 +18090,13 @@ SourceNode.fromStringWithSourceMap =
       // to the SourceNode without any mapping.
       // Each line is added as separate string.
       while (lastGeneratedLine < mapping.generatedLine) {
+        if (remainingLinesIndex >= remainingLines.length) {
+          // The generated code is exhausted. Skip the rest instead of adding
+          // empty lines one by one: a mapping may point far past the end of
+          // the code (e.g. an indexed map section with a huge offset.line).
+          lastGeneratedLine = mapping.generatedLine;
+          break;
+        }
         node.add(shiftNextLine());
         lastGeneratedLine++;
       }
@@ -24741,7 +24807,8 @@ const HTMLBlock = ({ children = '', html: htmlProp, runScripts, safeMode: safeMo
     // In MDX mode, safeMode is passed in as a boolean from JSX parsing
     // In MDXish mode, safeMode comes in as a string from HAST props
     const safeMode = typeof safeModeRaw !== 'boolean' ? safeModeRaw === 'true' : safeModeRaw;
-    const [cleanedHtml, exec] = extractScripts(html);
+    // Memoised so `exec` is stable across rerenders and the effect below only runs when the html changes.
+    const [cleanedHtml, exec] = (0,external_react_.useMemo)(() => extractScripts(html), [html]);
     (0,external_react_.useEffect)(() => {
         if (typeof window !== 'undefined' && typeof runScripts === 'boolean' && runScripts)
             exec();
@@ -25722,6 +25789,8 @@ const TOKENIZER_MDX_COMPONENT_EXCLUDED_TAGS = new Set([
  * run after rehype (where hast `tagName` is normalized to lowercase).
  */
 const INLINE_COMPONENT_TAGS_LOWER = new Set([...INLINE_COMPONENT_TAGS].map(t => t.toLowerCase()));
+/** Raw markup props injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed; never interpolate reader values. */
+const RAW_HTML_PROP_NAMES = new Set(['html']);
 
 ;// ./node_modules/github-slugger/regex.js
 // This module is generated by `script/`.
@@ -127957,33 +128026,75 @@ function repairMistakenTableClosers(content) {
     return applyInserts(content, edits).value;
 }
 
+;// ./lib/utils/mdxish/mdxish-variables.ts
+
+
+// The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
+// substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
+// which either evaluated already or is meant to stay literal.
+const MDX_VARIABLE_REGEX = new RegExp(`(?<!\\$)${variable_dist.MDX_VARIABLE_REGEXP}`, 'gu');
+// A whole attribute expression that is one `user.*` reference, e.g. the `user.name` in `title={user.name}`.
+const BARE_VARIABLE_REGEX = new RegExp(`^${variable_dist.MDX_VARIABLE_REGEXP}$`, 'u');
+// Bracket notation names the same variable as dot notation, so normalize it before substituting.
+// Escaped and `$`-prefixed forms are left alone so a reference that stays literal keeps its source.
+// A closing escape needs no lookahead: requiring a literal `]}` already rules out `]\}`.
+const BRACKET_NOTATION_REGEX = /(?<![$\\])\{user\[['"](\w+)['"]\]\}/gu;
+/**
+ * Resolve `{user.*}` in a JSX attribute value against the same `user` binding the rmdx engine gets,
+ * so both engines agree. Body text differs on empty values: `Variable` falls back to the default.
+ *
+ * Legacy `<<...>>` is valid inside a quoted attribute but deliberately left literal — attributes are
+ * an MDX surface, and `{user.*}` is the syntax authors use there.
+ */
+function resolveAttributeVariables(value, user) {
+    if (!value.includes('{user'))
+        return value;
+    return value
+        .replace(BRACKET_NOTATION_REGEX, '{user.$1}')
+        .replace(MDX_VARIABLE_REGEX, (source, escapePrefix, name, escapeSuffix) => {
+        if (escapePrefix || escapeSuffix)
+            return source;
+        return stringifyVariableValue(user[name]);
+    });
+}
+/** Whether an attribute expression's source is a bare `user.*` reference, left for render-time substitution. */
+const isBareVariableReference = (source) => BARE_VARIABLE_REGEX.test(`{${source.trim()}}`.replace(BRACKET_NOTATION_REGEX, '{user.$1}'));
+
 ;// ./processor/transform/mdxish/resolve-deferred-attribute-expression-props.ts
 
 
 
 
+
+
+
 /**
  * Resolve attribute expressions that `mdxJsxElementHandler` deferred.
  *
  * The handler stashed each attribute expression's source in `node.data.deferredExpressions`
  * (keyed by prop name) instead of evaluating eagerly, because an eager result can be a React
  * element or function that rehypeRaw's `structuredClone` passthrough rejects. Now that we're
- * past the clone, evaluate each source with a scope of `{ React, ...mdxishScope }` and write
+ * past the clone, evaluate each source with a scope of `{ user, React, ...mdxishScope }` and write
  * the real value into `properties` (e.g. an array of objects whose fields are React elements).
  *
  * Must run after `rehypeRaw` (past the clone) but before `normalizeMdxJsxNodes` rewrites these
  * `mdx-jsx` nodes into plain elements. Skipped in safeMode, which keeps expressions literal.
  */
-const resolveDeferredAttributeExpressionProps = () => (tree, file) => {
+const resolveDeferredAttributeExpressionProps = ({ variables } = {}) => (tree, file) => {
     const scope = { ...file.data.mdxishScope, React: (external_react_default()) };
+    // `user` only when variables were supplied, as in `evaluateExpressions`.
+    const userScope = variables ? { user: user(variables), ...scope } : scope;
     visit(tree, 'mdx-jsx', (node) => {
         const deferredExpressions = node.data?.deferredExpressions;
         if (!deferredExpressions)
             return;
         const properties = node.properties;
         Object.entries(deferredExpressions).forEach(([name, source]) => {
+            // Raw markup never gets `user`: a reader's values reaching `dangerouslySetInnerHTML` is an injection
+            // vector. A bare `{user.x}` keeps render-time substitution, which stringifies structured values.
+            const canReadUser = !RAW_HTML_PROP_NAMES.has(name) && !isBareVariableReference(source);
             try {
-                const result = evalExpression(source, scope);
+                const result = evalExpression(source, canReadUser ? userScope : scope);
                 // hast/HTML `style` is a plain CSS string; a `style={{...}}` expression evaluates to
                 // a JS object, which must be serialized or it renders as the literal "[object Object]".
                 properties[name] = name === 'style' && style_object_to_css_isPlainObject(result) ? styleObjectToCssText(result) : result;
@@ -128647,7 +128758,7 @@ function mdxish(mdContent, opts = {}) {
         .use(preserveBooleanProperties) // RehypeRaw converts boolean properties to empty strings
         .use(rehypeRaw, { passThrough: ['html-block', 'mdx-jsx'] }) // MDX JSX nodes bypass parse5's string-only HTML round-trip
         .use(restoreBooleanProperties)
-        .use(safeMode ? undefined : resolve_deferred_attribute_expression_props) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
+        .use(safeMode ? undefined : resolve_deferred_attribute_expression_props, { variables }) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
         .use(normalize_mdx_jsx_nodes) // Rewrite `mdx-jsx` back to standard `element` nodes for downstream plugins
         .use(sanitize ? rehypeStripTags : undefined) // Strip STRIPPED_TAG_NAMES elements; this pipeline has no sanitization step
         .use(rehypeFlattenTableCellParagraphs) // Remove <p> wrappers inside table cells to prevent margin issues
@@ -128853,36 +128964,6 @@ const makeUseMDXComponents = (more = {}) => {
 };
 /* harmony default export */ const makeUseMdxComponents = (makeUseMDXComponents);
 
-;// ./lib/utils/mdxish/mdxish-variables.ts
-
-
-// The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
-// substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
-// which either evaluated already or is meant to stay literal.
-const MDX_VARIABLE_REGEX = new RegExp(`(?<!\\$)${variable_dist.MDX_VARIABLE_REGEXP}`, 'gu');
-// Bracket notation names the same variable as dot notation, so normalize it before substituting.
-// Escaped and `$`-prefixed forms are left alone so a reference that stays literal keeps its source.
-// A closing escape needs no lookahead: requiring a literal `]}` already rules out `]\}`.
-const BRACKET_NOTATION_REGEX = /(?<![$\\])\{user\[['"](\w+)['"]\]\}/gu;
-/**
- * Resolve `{user.*}` in a JSX attribute value against the same `user` binding the rmdx engine gets,
- * so both engines agree. Body text differs on empty values: `Variable` falls back to the default.
- *
- * Legacy `<<...>>` is valid inside a quoted attribute but deliberately left literal — attributes are
- * an MDX surface, and `{user.*}` is the syntax authors use there.
- */
-function resolveAttributeVariables(value, user) {
-    if (!value.includes('{user'))
-        return value;
-    return value
-        .replace(BRACKET_NOTATION_REGEX, '{user.$1}')
-        .replace(MDX_VARIABLE_REGEX, (source, escapePrefix, name, escapeSuffix) => {
-        if (escapePrefix || escapeSuffix)
-            return source;
-        return stringifyVariableValue(user[name]);
-    });
-}
-
 ;// ./lib/utils/mdxish/mdxish-render-utils.tsx
 
 
@@ -128893,6 +128974,7 @@ function resolveAttributeVariables(value, user) {
 
 
 
+
 /** Flatten CustomComponents into a component map for rehype-react */
 function exportComponentsForRehype(components) {
     const exported = Object.entries(components).reduce((memo, [tag, mod]) => {
@@ -128925,8 +129007,6 @@ function exportComponentsForRehype(components) {
  * deliberately leaves mermaid alone; resolving it again here would override that.
  */
 const CODE_TAG_NAMES = new Set(['code']);
-/** Raw markup injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed — never interpolate. */
-const RAW_HTML_PROP_NAMES = new Set(['html']);
 /**
  * Resolve `{user.*}` in string-valued props. Body text is handled by the `Variable` component, but
  * attributes are plain strings, so they are substituted here — at render time, so that a