@spintax/core 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -3,6 +3,89 @@
 All notable changes to `@spintax/core` are documented here. This project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.5.2 — 2026-08-18
+
+**`render()` no longer dies on a 62-character template** (issue #69). Not a regression — the
+published 0.3.4 does the same, and so did every engine in the family. Live, this was HTTP 503
+from the reference Worker.
+
+### Fixed
+
+```
+#set %a% = %b% %b%
+#set %b% = %a% %a%
+%a%
+```
+
+Each expansion replaces one reference with two, so the 50-level depth cap allows 2^50 and the
+process ends: an out-of-memory abort here and in the Python port, a memory fatal in both PHP
+engines. Acyclic doubling definitions do it too, so the cycle guard never fires. **Any**
+reference to such a value reaches it — plain text, a plural slot, an enumeration, a
+permutation. Defining the pair is harmless, and a conditional testing one is harmless, because
+neither expands the value.
+
+A render may now expand at most 1 MB of `%variable%` text. Past that a reference is left
+literal — exactly what an undefined name already does, so no new output shape appears, render
+stays lenient (§9.2), and a plural whose count did not resolve erases as it always has. The
+ceiling is far above any real document; the point is to end an explosion, not to ration output.
+
+### Notes
+
+**What a truncated explosion looks like is deliberately NOT parity-gated,** and the conformance
+README now says so. The engines expand by different mechanisms — a per-reference tree walk here
+and in Python, a whole-text fixpoint in both PHP engines — so they stop in different places and
+produce different byte counts for the same bomb (1 198 223 against 599 191, measured). What is
+contract, and what each engine pins in its own suite, is that render terminates, does not
+throw, bounds its output, and leaves what it could not afford as literal `%name%`. Making the
+byte counts agree would mean rewriting one engine's expansion to match another's traversal, for
+input no author writes.
+
+This is the render-side twin of the counting bomb fixed in 0.5.1; that one bounds `validate()`.
+
+## 0.5.1 — 2026-08-18
+
+Two crashes in the 0.5.0 form-counting path, both reachable from template text, both found by
+review rather than by a failing test. **Upgrade from 0.5.0.**
+
+### Fixed
+
+- **A 62-character template could take `validate()` out with an out-of-memory crash.**
+
+  ```
+  #set %a% = %b% %b%
+  #set %b% = %a% %a%
+  {plural 2: one|%a%}
+  ```
+
+  Counting plural forms expands definitions, and the expansion was bounded by 51 *passes* with
+  nothing bounding the *size*. That template doubles the text on every pass, so 51 passes is 2^51.
+  Every engine in the family died on it — this one and the Python port with an out-of-memory
+  crash, both PHP engines with a memory fatal. A non-cyclic doubling chain does the same, so the
+  circular-reference guard never got a chance.
+
+  The expansion now stops at 64 KB and reports the count as unknowable, which is the same silence
+  this validator already uses for every input it cannot pin down. A form list is a handful of
+  plural forms; nothing legitimate approaches the ceiling.
+
+  `validate` is exposed by public HTTP surfaces — this was a remote denial of service, not a
+  local footgun.
+
+- **`validate()` threw `RangeError` on a long `#set` chain.** The macro walk added in 0.5.0 was
+  recursive: roughly 9000 links (a 205 KB template) exhausted the call stack, while the Python
+  port gave up at ~1000 links (20 KB) and both PHP engines answered normally — one input, three
+  behaviours. The walk is iterative now.
+
+  It is a pre-order depth-first walk in source order, and it has to stay one: the first non-clean
+  answer wins, so a graph holding both an opaque macro and a brackety one gives different
+  diagnostics depending on which is met first. Checked by leaving the PHP engine recursive and
+  diffing 300 generated macro graphs against it — no mismatches.
+
+### Notes
+
+No API change and no verdict change for any template that was not crashing. Both fixes are
+mirrored into `spintax/core`, `spintax-core` and the WordPress plugin, and pinned by two corpus
+fixtures whose real assertion is that the engine answers at all — a runner that hangs fails them.
+
 ## 0.5.0 — 2026-08-18
 
 Two plural fixes, both cross-engine, both found by measuring one engine against another rather

package/dist/index.cjs

@@ -633,6 +633,7 @@ function checkPlurals(text, idx, locale, knownVariables, out) {
 var UNRESOLVED_AT_PLURAL_TIME = /\[|\{(?!\?)/u;
 var ANY_BRACKET = /[[\]{}]/u;
 var FORM_EXPANSION_PASSES = 51;
+var FORM_EXPANSION_MAX_GROWTH = 64 * 1024;
 function expandFormsForCounting(formsRaw, defs, macros, hostNames) {
   const unknown = (directMacroSpintax = false) => ({
     forms: 0,
@@ -640,17 +641,23 @@ function expandFormsForCounting(formsRaw, defs, macros, hostNames) {
     directMacroSpintax
   });
   const seenMacro = /* @__PURE__ */ new Set();
+  const refsOf = (text2) => [...text2.matchAll(/%(\w+)%/gu)].map((m) => (m[1] ?? "").toLowerCase());
   const walkMacros = (source) => {
-    for (const m of source.matchAll(/%(\w+)%/gu)) {
-      const name = (m[1] ?? "").toLowerCase();
+    const stack = [{ refs: refsOf(source), i: 0 }];
+    while (stack.length > 0) {
+      const frame = stack[stack.length - 1];
+      if (frame.i >= frame.refs.length) {
+        stack.pop();
+        continue;
+      }
+      const name = frame.refs[frame.i++];
       if (defs[name] !== void 0 || hostNames.has(name)) continue;
       const macro = macros[name];
       if (macro === void 0 || seenMacro.has(name)) continue;
       seenMacro.add(name);
       if (/\{\?/u.test(macro)) return "opaque";
       if (ANY_BRACKET.test(macro)) return "brackets";
-      const deeper = walkMacros(macro);
-      if (deeper !== "clean") return deeper;
+      stack.push({ refs: refsOf(macro), i: 0 });
     }
     return "clean";
   };
@@ -658,28 +665,33 @@ function expandFormsForCounting(formsRaw, defs, macros, hostNames) {
   if (verbatim === "brackets") return unknown(true);
   if (verbatim === "opaque") return unknown();
   let text = formsRaw;
+  const budget = formsRaw.length + FORM_EXPANSION_MAX_GROWTH;
   for (let pass = 0; pass < FORM_EXPANSION_PASSES; pass++) {
     let sawReference = false;
     let bailed = false;
-    text = text.replace(/%(\w+)%/gu, (whole, raw) => {
+    const parts = [];
+    let total = 0;
+    let cursor = 0;
+    const re = /%(\w+)%/gu;
+    let m;
+    while ((m = re.exec(text)) !== null) {
       sawReference = true;
-      const name = raw.toLowerCase();
-      if (hostNames.has(name)) {
-        bailed = true;
-        return whole;
-      }
-      const value = defs[name] ?? macros[name];
-      if (value === void 0) {
-        bailed = true;
-        return whole;
-      }
-      if (ANY_BRACKET.test(value)) {
+      const name = (m[1] ?? "").toLowerCase();
+      const value = hostNames.has(name) ? void 0 : defs[name] ?? macros[name];
+      if (value === void 0 || ANY_BRACKET.test(value)) {
         bailed = true;
-        return whole;
+        break;
       }
-      return value;
-    });
+      parts.push(text.slice(cursor, m.index), value);
+      total += m.index - cursor + value.length;
+      cursor = m.index + m[0].length;
+      if (total > budget) return unknown();
+    }
     if (bailed) return unknown();
+    parts.push(text.slice(cursor));
+    total += text.length - cursor;
+    if (total > budget) return unknown();
+    text = parts.join("");
     if (!sawReference) {
       return { forms: text.split("|").length, unresolved: false, directMacroSpintax: false };
     }
@@ -899,6 +911,7 @@ var NotImplementedError = class extends SpintaxError {
 
 // src/internal/render.ts
 var MAX_VARIABLE_DEPTH = 50;
+var MAX_EXPANSION_CHARS = 1024 * 1024;
 var INCLUDE_LINE_RE = /^[ \t]*#include[ \t\n\r\f\x0B]+"([^"]+)"[ \t\n\r\f\x0B]*$/gmu;
 function renderAst(ast, ctx) {
   const base = buildVars(ast.setDefs, ctx.runtimeContext);
@@ -906,7 +919,8 @@ function renderAst(ast, ctx) {
     rng: ctx.rng,
     locale: ctx.locale,
     depth: 0,
-    onPluralError: ctx.onPluralError
+    onPluralError: ctx.onPluralError,
+    budget: { left: MAX_EXPANSION_CHARS }
   };
   const vars = Object.keys(ast.defDefs).length > 0 ? { ...base, ...rollDefinitions(ast.defDefs, base, ctx.runtimeContext, walkOpts) } : base;
   const text = renderNodes(ast.nodes, { ...walkOpts, vars });
@@ -1019,6 +1033,8 @@ function resolveVariable(name, opts) {
   const value = opts.vars[name.toLowerCase()];
   if (value === void 0) return `%${name}%`;
   if (opts.depth >= MAX_VARIABLE_DEPTH || !/[{[%]/u.test(value)) return value;
+  if (opts.budget.left <= 0) return `%${name}%`;
+  opts.budget.left -= value.length;
   return renderNodes(parseSequence(value), { ...opts, depth: opts.depth + 1 });
 }
 function expandVarsOnly(text, opts) {
@@ -1028,6 +1044,8 @@ function expandVarsOnly(text, opts) {
     out = out.replace(/%(\w+)%/gu, (m, name) => {
       const value = opts.vars[name.toLowerCase()];
       if (value === void 0) return m;
+      if (opts.budget.left <= 0) return m;
+      opts.budget.left -= value.length;
       changed = true;
       return value;
     });