@spintax/core 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -3,6 +3,70 @@
 All notable changes to `@spintax/core` are documented here. This project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.5.3 — 2026-08-18
+
+The expansion budget added in 0.5.2 was created per rendered AST, and an `#include` renders one
+— so every include handed the bomb a fresh allowance. Fifty `#include` lines over a single
+62-character body turned **690 bytes into 57 MB**, growing linearly with the include count: the
+bound held for each subtree and bounded nothing overall.
+
+### Fixed
+
+The budget now belongs to the `render()` call and travels on the render context, includes and
+all. Measured after: 200 includes over the same body produce 1.14 MB, flat, in about 210 ms —
+the same figure one include produces.
+
+A host may cap the number of include resolutions (the reference Worker does), but the engine
+must not need it to.
+
+### Notes
+
+Worth stating plainly, since it decides who is exposed: **this needs an untrusted template
+author, not untrusted data.** The bomb is built from `#set` definitions, and definitions live in
+the template — T1, author-trusted in the §6 model. A context value is T2, and `neutralize()`
+strips `%` from it (`%b% %b%` becomes `b b`), so shielded data cannot carry a reference at all.
+A host that renders its own templates against user data is not reachable; a host that renders
+templates its users write is.
+
+## 0.5.2 — 2026-08-18
+
+**`render()` no longer dies on a 62-character template** (issue #69). Not a regression — the
+published 0.3.4 does the same, and so did every engine in the family. Live, this was HTTP 503
+from the reference Worker.
+
+### Fixed
+
+```
+#set %a% = %b% %b%
+#set %b% = %a% %a%
+%a%
+```
+
+Each expansion replaces one reference with two, so the 50-level depth cap allows 2^50 and the
+process ends: an out-of-memory abort here and in the Python port, a memory fatal in both PHP
+engines. Acyclic doubling definitions do it too, so the cycle guard never fires. **Any**
+reference to such a value reaches it — plain text, a plural slot, an enumeration, a
+permutation. Defining the pair is harmless, and a conditional testing one is harmless, because
+neither expands the value.
+
+A render may now expand at most 1 MB of `%variable%` text. Past that a reference is left
+literal — exactly what an undefined name already does, so no new output shape appears, render
+stays lenient (§9.2), and a plural whose count did not resolve erases as it always has. The
+ceiling is far above any real document; the point is to end an explosion, not to ration output.
+
+### Notes
+
+**What a truncated explosion looks like is deliberately NOT parity-gated,** and the conformance
+README now says so. The engines expand by different mechanisms — a per-reference tree walk here
+and in Python, a whole-text fixpoint in both PHP engines — so they stop in different places and
+produce different byte counts for the same bomb (1 198 223 against 599 191, measured). What is
+contract, and what each engine pins in its own suite, is that render terminates, does not
+throw, bounds its output, and leaves what it could not afford as literal `%name%`. Making the
+byte counts agree would mean rewriting one engine's expansion to match another's traversal, for
+input no author writes.
+
+This is the render-side twin of the counting bomb fixed in 0.5.1; that one bounds `validate()`.
+
 ## 0.5.1 — 2026-08-18
 
 Two crashes in the 0.5.0 form-counting path, both reachable from template text, both found by

package/dist/index.cjs

@@ -911,6 +911,7 @@ var NotImplementedError = class extends SpintaxError {
 
 // src/internal/render.ts
 var MAX_VARIABLE_DEPTH = 50;
+var MAX_EXPANSION_CHARS = 1024 * 1024;
 var INCLUDE_LINE_RE = /^[ \t]*#include[ \t\n\r\f\x0B]+"([^"]+)"[ \t\n\r\f\x0B]*$/gmu;
 function renderAst(ast, ctx) {
   const base = buildVars(ast.setDefs, ctx.runtimeContext);
@@ -918,7 +919,8 @@ function renderAst(ast, ctx) {
     rng: ctx.rng,
     locale: ctx.locale,
     depth: 0,
-    onPluralError: ctx.onPluralError
+    onPluralError: ctx.onPluralError,
+    budget: ctx.budget
   };
   const vars = Object.keys(ast.defDefs).length > 0 ? { ...base, ...rollDefinitions(ast.defDefs, base, ctx.runtimeContext, walkOpts) } : base;
   const text = renderNodes(ast.nodes, { ...walkOpts, vars });
@@ -1031,6 +1033,8 @@ function resolveVariable(name, opts) {
   const value = opts.vars[name.toLowerCase()];
   if (value === void 0) return `%${name}%`;
   if (opts.depth >= MAX_VARIABLE_DEPTH || !/[{[%]/u.test(value)) return value;
+  if (opts.budget.left <= 0) return `%${name}%`;
+  opts.budget.left -= value.length;
   return renderNodes(parseSequence(value), { ...opts, depth: opts.depth + 1 });
 }
 function expandVarsOnly(text, opts) {
@@ -1040,6 +1044,8 @@ function expandVarsOnly(text, opts) {
     out = out.replace(/%(\w+)%/gu, (m, name) => {
       const value = opts.vars[name.toLowerCase()];
       if (value === void 0) return m;
+      if (opts.budget.left <= 0) return m;
+      opts.budget.left -= value.length;
       changed = true;
       return value;
     });
@@ -1354,7 +1360,10 @@ function renderWith(input, rng, opts = {}) {
     resolver: opts.includeResolver,
     maxDepth: opts.maxDepth ?? DEFAULT_MAX_DEPTH,
     includeStack: [],
-    onPluralError: opts.onPluralError
+    onPluralError: opts.onPluralError,
+    // One allowance for the whole call. Created here rather than in renderAst because
+    // includes re-enter renderAst, and a budget made there is a budget per subtree.
+    budget: { left: MAX_EXPANSION_CHARS }
   };
   const ast = resolveAst(input);
   let out = renderAst(ast, ctx);