@spintax/core 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -3,6 +3,50 @@
 All notable changes to `@spintax/core` are documented here. This project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.5.1 — 2026-08-18
+
+Two crashes in the 0.5.0 form-counting path, both reachable from template text, both found by
+review rather than by a failing test. **Upgrade from 0.5.0.**
+
+### Fixed
+
+- **A 62-character template could take `validate()` out with an out-of-memory crash.**
+
+  ```
+  #set %a% = %b% %b%
+  #set %b% = %a% %a%
+  {plural 2: one|%a%}
+  ```
+
+  Counting plural forms expands definitions, and the expansion was bounded by 51 *passes* with
+  nothing bounding the *size*. That template doubles the text on every pass, so 51 passes is 2^51.
+  Every engine in the family died on it — this one and the Python port with an out-of-memory
+  crash, both PHP engines with a memory fatal. A non-cyclic doubling chain does the same, so the
+  circular-reference guard never got a chance.
+
+  The expansion now stops at 64 KB and reports the count as unknowable, which is the same silence
+  this validator already uses for every input it cannot pin down. A form list is a handful of
+  plural forms; nothing legitimate approaches the ceiling.
+
+  `validate` is exposed by public HTTP surfaces — this was a remote denial of service, not a
+  local footgun.
+
+- **`validate()` threw `RangeError` on a long `#set` chain.** The macro walk added in 0.5.0 was
+  recursive: roughly 9000 links (a 205 KB template) exhausted the call stack, while the Python
+  port gave up at ~1000 links (20 KB) and both PHP engines answered normally — one input, three
+  behaviours. The walk is iterative now.
+
+  It is a pre-order depth-first walk in source order, and it has to stay one: the first non-clean
+  answer wins, so a graph holding both an opaque macro and a brackety one gives different
+  diagnostics depending on which is met first. Checked by leaving the PHP engine recursive and
+  diffing 300 generated macro graphs against it — no mismatches.
+
+### Notes
+
+No API change and no verdict change for any template that was not crashing. Both fixes are
+mirrored into `spintax/core`, `spintax-core` and the WordPress plugin, and pinned by two corpus
+fixtures whose real assertion is that the engine answers at all — a runner that hangs fails them.
+
 ## 0.5.0 — 2026-08-18
 
 Two plural fixes, both cross-engine, both found by measuring one engine against another rather

package/dist/index.cjs

@@ -633,6 +633,7 @@ function checkPlurals(text, idx, locale, knownVariables, out) {
 var UNRESOLVED_AT_PLURAL_TIME = /\[|\{(?!\?)/u;
 var ANY_BRACKET = /[[\]{}]/u;
 var FORM_EXPANSION_PASSES = 51;
+var FORM_EXPANSION_MAX_GROWTH = 64 * 1024;
 function expandFormsForCounting(formsRaw, defs, macros, hostNames) {
   const unknown = (directMacroSpintax = false) => ({
     forms: 0,
@@ -640,17 +641,23 @@ function expandFormsForCounting(formsRaw, defs, macros, hostNames) {
     directMacroSpintax
   });
   const seenMacro = /* @__PURE__ */ new Set();
+  const refsOf = (text2) => [...text2.matchAll(/%(\w+)%/gu)].map((m) => (m[1] ?? "").toLowerCase());
   const walkMacros = (source) => {
-    for (const m of source.matchAll(/%(\w+)%/gu)) {
-      const name = (m[1] ?? "").toLowerCase();
+    const stack = [{ refs: refsOf(source), i: 0 }];
+    while (stack.length > 0) {
+      const frame = stack[stack.length - 1];
+      if (frame.i >= frame.refs.length) {
+        stack.pop();
+        continue;
+      }
+      const name = frame.refs[frame.i++];
       if (defs[name] !== void 0 || hostNames.has(name)) continue;
       const macro = macros[name];
       if (macro === void 0 || seenMacro.has(name)) continue;
       seenMacro.add(name);
       if (/\{\?/u.test(macro)) return "opaque";
       if (ANY_BRACKET.test(macro)) return "brackets";
-      const deeper = walkMacros(macro);
-      if (deeper !== "clean") return deeper;
+      stack.push({ refs: refsOf(macro), i: 0 });
     }
     return "clean";
   };
@@ -658,28 +665,33 @@ function expandFormsForCounting(formsRaw, defs, macros, hostNames) {
   if (verbatim === "brackets") return unknown(true);
   if (verbatim === "opaque") return unknown();
   let text = formsRaw;
+  const budget = formsRaw.length + FORM_EXPANSION_MAX_GROWTH;
   for (let pass = 0; pass < FORM_EXPANSION_PASSES; pass++) {
     let sawReference = false;
     let bailed = false;
-    text = text.replace(/%(\w+)%/gu, (whole, raw) => {
+    const parts = [];
+    let total = 0;
+    let cursor = 0;
+    const re = /%(\w+)%/gu;
+    let m;
+    while ((m = re.exec(text)) !== null) {
       sawReference = true;
-      const name = raw.toLowerCase();
-      if (hostNames.has(name)) {
-        bailed = true;
-        return whole;
-      }
-      const value = defs[name] ?? macros[name];
-      if (value === void 0) {
-        bailed = true;
-        return whole;
-      }
-      if (ANY_BRACKET.test(value)) {
+      const name = (m[1] ?? "").toLowerCase();
+      const value = hostNames.has(name) ? void 0 : defs[name] ?? macros[name];
+      if (value === void 0 || ANY_BRACKET.test(value)) {
         bailed = true;
-        return whole;
+        break;
       }
-      return value;
-    });
+      parts.push(text.slice(cursor, m.index), value);
+      total += m.index - cursor + value.length;
+      cursor = m.index + m[0].length;
+      if (total > budget) return unknown();
+    }
     if (bailed) return unknown();
+    parts.push(text.slice(cursor));
+    total += text.length - cursor;
+    if (total > budget) return unknown();
+    text = parts.join("");
     if (!sawReference) {
       return { forms: text.split("|").length, unresolved: false, directMacroSpintax: false };
     }