@stacksjs/stx 0.2.95 → 0.2.96

package/dist/safe-evaluator.js

@@ -1,2 +1,444 @@
-// @bun
-import{kz as a,lz as b,mz as c,nz as d,oz as e,pz as f,qz as g,rz as h,sz as i,tz as j,uz as k,vz as l,wz as m,xz as n,yz as o}from"./chunk-w3b6m427.js";import"./chunk-xv34zbp4.js";export{d as sanitizeExpression,k as safeEvaluateObject,i as safeEvaluateCondition,m as safeEvaluateCode,j as safeEvaluateArray,f as safeEvaluate,b as resetSafeEvaluatorConfig,n as isForExpressionSafe,g as isExpressionSafe,c as getSafeEvaluatorConfig,h as getExpressionSafetyReason,o as createSafeLoopFunction,l as createSafeFunction,e as createSafeContext,a as configureSafeEvaluator};
+const defaultConfig = {
+  maxSanitizeDepth: 10,
+  allowBracketNotation: !1
+};
+let currentConfig = { ...defaultConfig };
+export function configureSafeEvaluator(config) {
+  currentConfig = { ...currentConfig, ...config };
+}
+export function resetSafeEvaluatorConfig() {
+  currentConfig = { ...defaultConfig };
+}
+export function getSafeEvaluatorConfig() {
+  return { ...currentConfig };
+}
+const _ALLOWED_GLOBALS = new Set([
+  "Math",
+  "parseInt",
+  "parseFloat",
+  "isNaN",
+  "isFinite",
+  "String",
+  "encodeURIComponent",
+  "decodeURIComponent",
+  "Array",
+  "Date",
+  "JSON",
+  "Number",
+  "Boolean"
+]), DANGEROUS_PATTERNS = [
+  /\b(eval|Function|setTimeout|setInterval|setImmediate)\b/,
+  /\b(process|require|import|exports|module)\b/,
+  /\b(window|document|global|globalThis)\b/,
+  /\b(constructor|prototype|__proto__)\b/,
+  /\b(Reflect|Proxy)\b/,
+  /\bSymbol\b/,
+  /\b(WeakMap|WeakSet|WeakRef|FinalizationRegistry)\b/,
+  /\b(Generator|AsyncGenerator)\b/,
+  /__\w+__/,
+  /\.(bind|call|apply)\s*\(/,
+  /\bnew\s+/,
+  /\bdelete\s+/,
+  /\bthis\b/
+], DANGEROUS_IDENTIFIERS = new Set([
+  "eval",
+  "Function",
+  "setTimeout",
+  "setInterval",
+  "setImmediate",
+  "process",
+  "require",
+  "import",
+  "exports",
+  "module",
+  "window",
+  "document",
+  "global",
+  "globalThis",
+  "constructor",
+  "prototype",
+  "Reflect",
+  "Proxy",
+  "Symbol",
+  "WeakMap",
+  "WeakSet",
+  "WeakRef",
+  "FinalizationRegistry",
+  "Generator",
+  "AsyncGenerator",
+  "delete",
+  "this"
+]), DANGEROUS_BRACKET_KEYS = new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]), BRACKET_NOTATION_PATTERN = /[\w)\]]\s*\[\s*['"]/;
+function stripStringLiterals(expr) {
+  let result = "", inString = null, escaped = !1;
+  for (let i = 0;i < expr.length; i++) {
+    const ch = expr[i];
+    if (escaped) {
+      escaped = !1;
+      continue;
+    }
+    if (ch === "\\" && inString) {
+      escaped = !0;
+      continue;
+    }
+    if (inString) {
+      if (inString === "`" && ch === "$" && i + 1 < expr.length && expr[i + 1] === "{") {
+        let tplDepth = 1;
+        i += 2;
+        while (i < expr.length && tplDepth > 0) {
+          if (expr[i] === "{")
+            tplDepth++;
+          else if (expr[i] === "}")
+            tplDepth--;
+          if (tplDepth > 0) {
+            result += expr[i];
+            i++;
+          }
+        }
+        continue;
+      }
+      if (ch === inString)
+        inString = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      inString = ch;
+      continue;
+    }
+    result += ch;
+  }
+  return result;
+}
+function assertNoUnsafeIdentifierTokens(strippedExpression, originalExpression) {
+  const identifierRe = /[$A-Z_a-z][$\w]*/g;
+  let match;
+  while ((match = identifierRe.exec(strippedExpression)) !== null) {
+    const identifier = match[0], previous = strippedExpression[match.index - 1];
+    if (DANGEROUS_IDENTIFIERS.has(identifier))
+      throw Error(`Potentially unsafe expression (matched /\\b${identifier}\\b/; identifier ${identifier}): ${originalExpression}`);
+    if (previous === "." && DANGEROUS_BRACKET_KEYS.has(identifier))
+      throw Error(`Potentially unsafe expression (matched /.${identifier}/; property ${identifier}): ${originalExpression}`);
+  }
+}
+function assertSafeBracketLiteralKeys(expression) {
+  const bracketLiteralRe = /\[\s*(['"])(.*?)\1\s*\]/g;
+  let match;
+  while ((match = bracketLiteralRe.exec(expression)) !== null) {
+    const key = match[2];
+    if (!DANGEROUS_BRACKET_KEYS.has(key))
+      continue;
+    const previousNonSpace = expression.slice(0, match.index).match(/\S(?=\s*$)/)?.[0], nextNonSpace = expression.slice(match.index + match[0].length).match(/^\s*(\S)/)?.[1];
+    if (!((previousNonSpace === "{" || previousNonSpace === ",") && nextNonSpace === ":"))
+      throw Error(`Potentially unsafe expression (bracket key ${match[2]}): ${expression}`);
+  }
+}
+export function sanitizeExpression(expression) {
+  const trimmed = expression.trim(), stripped = stripStringLiterals(trimmed);
+  assertNoUnsafeIdentifierTokens(stripped, trimmed);
+  assertSafeBracketLiteralKeys(trimmed);
+  for (const pattern of DANGEROUS_PATTERNS)
+    if (pattern.test(stripped))
+      throw Error(`Potentially unsafe expression (matched /${pattern.source}/): ${trimmed}`);
+  if (!currentConfig.allowBracketNotation && BRACKET_NOTATION_PATTERN.test(trimmed))
+    throw Error(`Bracket notation with strings not allowed: ${trimmed}. Enable with configureSafeEvaluator({ allowBracketNotation: true })`);
+  return trimmed;
+}
+export function createSafeContext(context) {
+  const safeContext = {};
+  safeContext.Math = Math;
+  safeContext.JSON = JSON;
+  safeContext.Date = Date;
+  safeContext.String = String;
+  safeContext.Number = Number;
+  safeContext.Boolean = Boolean;
+  safeContext.Array = Array;
+  safeContext.parseInt = Number.parseInt;
+  safeContext.parseFloat = Number.parseFloat;
+  safeContext.isNaN = Number.isNaN;
+  safeContext.isFinite = Number.isFinite;
+  safeContext.encodeURIComponent = encodeURIComponent;
+  safeContext.decodeURIComponent = decodeURIComponent;
+  for (const [key, value] of Object.entries(context)) {
+    if (key.startsWith("__") || DANGEROUS_PATTERNS.some((p) => p.test(key)))
+      continue;
+    if (value && typeof value === "object" && !Array.isArray(value))
+      safeContext[key] = sanitizeObject(value);
+    else
+      safeContext[key] = value;
+  }
+  return safeContext;
+}
+function sanitizeObject(obj, depth = 0) {
+  if (depth >= currentConfig.maxSanitizeDepth)
+    return "[Object too deep]";
+  if (obj === null || typeof obj !== "object")
+    return obj;
+  if (Array.isArray(obj))
+    return obj.map((item) => sanitizeObject(item, depth + 1));
+  if (obj instanceof Date || obj instanceof RegExp || obj instanceof Map || obj instanceof Set || obj instanceof Error)
+    return obj;
+  const sanitized = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (key.startsWith("__") || key === "constructor" || key === "prototype")
+      continue;
+    if (value && typeof value === "object")
+      sanitized[key] = sanitizeObject(value, depth + 1);
+    else
+      sanitized[key] = value;
+  }
+  return sanitized;
+}
+export function safeEvaluate(expression, context) {
+  try {
+    const safeContext = createSafeContext(context), keys = Object.keys(safeContext), values = Object.values(safeContext);
+    return createSafeFunction(expression, keys)(...values);
+  } catch {
+    return;
+  }
+}
+export function isExpressionSafe(expression) {
+  try {
+    sanitizeExpression(expression);
+    return !0;
+  } catch {
+    return !1;
+  }
+}
+export function getExpressionSafetyReason(expression) {
+  try {
+    sanitizeExpression(expression);
+    return null;
+  } catch (e) {
+    return e instanceof Error ? e.message : String(e);
+  }
+}
+export function safeEvaluateCondition(expression, context) {
+  try {
+    const result = safeEvaluate(expression, context);
+    return Boolean(result);
+  } catch {
+    return !1;
+  }
+}
+export function safeEvaluateArray(expression, context) {
+  try {
+    const result = safeEvaluate(expression, context);
+    if (Array.isArray(result))
+      return result;
+    if (result && typeof result === "object" && "length" in result) {
+      const len = result.length;
+      if (typeof len === "number" && Number.isFinite(len) && len >= 0 && Number.isInteger(len))
+        return Array.from(result);
+    }
+    return [];
+  } catch {
+    return [];
+  }
+}
+export function safeEvaluateObject(expression, context) {
+  try {
+    const result = safeEvaluate(expression, context);
+    if (result && typeof result === "object" && !Array.isArray(result))
+      return result;
+    return {};
+  } catch {
+    return {};
+  }
+}
+const RESERVED_PARAM_NAMES = new Set([
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "continue",
+  "debugger",
+  "default",
+  "delete",
+  "do",
+  "else",
+  "enum",
+  "export",
+  "extends",
+  "false",
+  "finally",
+  "for",
+  "function",
+  "if",
+  "import",
+  "in",
+  "instanceof",
+  "new",
+  "null",
+  "return",
+  "super",
+  "switch",
+  "this",
+  "throw",
+  "true",
+  "try",
+  "typeof",
+  "var",
+  "void",
+  "while",
+  "with",
+  "yield",
+  "let",
+  "static",
+  "implements",
+  "interface",
+  "package",
+  "private",
+  "protected",
+  "public",
+  "arguments",
+  "eval",
+  "await"
+]);
+export function createSafeFunction(expression, contextKeys) {
+  const sanitizedExpr = sanitizeExpression(expression), validIdent = /^[A-Za-z_$][\w$]*$/, validIndices = [], filteredKeys = [];
+  for (let i = 0;i < contextKeys.length; i++) {
+    const key = contextKeys[i];
+    if (!validIdent.test(key))
+      continue;
+    if (RESERVED_PARAM_NAMES.has(key))
+      continue;
+    validIndices.push(i);
+    filteredKeys.push(key);
+  }
+  const buildFunc = (extraParams) => Function(...filteredKeys, ...extraParams, `
+    'use strict';
+    try {
+      return ${sanitizedExpr};
+    }
+catch (e) {
+      if (e instanceof TypeError) {
+        return undefined;
+      }
+      throw e;
+    }
+  `);
+  let func = buildFunc([]);
+  if (filteredKeys.length === contextKeys.length)
+    return wrapWithMissingIdentifierRetry(func, filteredKeys, buildFunc);
+  return wrapWithMissingIdentifierRetry((...args) => {
+    const projected = Array(validIndices.length);
+    for (let i = 0;i < validIndices.length; i++)
+      projected[i] = args[validIndices[i]];
+    return func(...projected);
+  }, filteredKeys, buildFunc, (extra) => {
+    func = buildFunc(extra);
+  });
+}
+function wrapWithMissingIdentifierRetry(initialFunc, filteredKeys, buildFunc, onRebuild) {
+  const MAX_RETRIES = 8, missingRe = /^(\w+) is not defined$/;
+  let func = initialFunc;
+  const extraParams = [], knownNames = new Set(filteredKeys);
+  return (...args) => {
+    for (let attempt = 0;attempt <= MAX_RETRIES; attempt++)
+      try {
+        return func(...args);
+      } catch (e) {
+        const message = e instanceof Error ? e.message : "", match = missingRe.exec(message);
+        if (!(e instanceof ReferenceError) || !match)
+          return;
+        const missingName = match[1];
+        if (knownNames.has(missingName) || RESERVED_PARAM_NAMES.has(missingName))
+          return;
+        knownNames.add(missingName);
+        extraParams.push(missingName);
+        func = buildFunc(extraParams);
+        onRebuild?.(extraParams);
+      }
+    return;
+  };
+}
+const MAX_SAFE_EVAL_CODE_LENGTH = 65536;
+export function safeEvaluateCode(code, context) {
+  try {
+    if (typeof code !== "string")
+      return;
+    if (code.length > MAX_SAFE_EVAL_CODE_LENGTH)
+      throw Error(`safeEvaluateCode: input exceeds ${MAX_SAFE_EVAL_CODE_LENGTH} chars`);
+    for (const pattern of DANGEROUS_PATTERNS)
+      if (pattern.test(code))
+        throw Error("Potentially unsafe code detected");
+    const safeContext = createSafeContext(context), keys = Object.keys(safeContext), values = Object.values(safeContext);
+    return Function(...keys, `
+      'use strict';
+      ${code}
+    `)(...values);
+  } catch {
+    return;
+  }
+}
+export function isForExpressionSafe(expression) {
+  const trimmed = expression.trim(), forDangerousPatterns = [
+    /\beval\s*\(/i,
+    /\bFunction\s*\(/i,
+    /\bimport\s*\(/i,
+    /\brequire\s*\(/i,
+    /\bprocess\b/i,
+    /\b__proto__\b/i,
+    /\bconstructor\s*[.(]/i,
+    /\bglobalThis\b/i,
+    /\bwindow\b/i,
+    /\bdocument\b/i,
+    /\bfetch\s*\(/i,
+    /\bBun\b/i,
+    /\bDeno\b/i,
+    /\bconsole\b/i,
+    /\bthis\b/i,
+    /\bReflect\b/i,
+    /\bProxy\b/i,
+    /\bprototype\b/i,
+    /\.(bind|call|apply)\s*\(/i
+  ];
+  for (const pattern of forDangerousPatterns)
+    if (pattern.test(trimmed))
+      return !1;
+  return !0;
+}
+export function createSafeLoopFunction(loopType, expression, body, contextKeys, maxIterations = 1000) {
+  if (!isForExpressionSafe(expression))
+    throw Error(`Unsafe expression in @${loopType}: ${expression}`);
+  const processedBody = body.replace(/`/g, "\\`").replace(/\$\{/g, "\\${").replace(/\{\{([^}]+)\}\}/g, (_match, expr) => {
+    return `\${${expr}}`;
+  });
+  if (loopType === "for")
+    return Function(...contextKeys, `
+      'use strict';
+      let result = '';
+      for (${expression}) {
+        result += \`${processedBody}\`;
+      }
+      return result;
+    // eslint-disable-next-line pickier/no-unused-vars
+    `);
+  else
+    return Function(...contextKeys, `
+      'use strict';
+      let result = '';
+      let __safeCounter = 0;
+      const __maxIterations = ${maxIterations};
+      while (${expression} && __safeCounter < __maxIterations) {
+        __safeCounter++;
+        result += \`${processedBody}\`;
+      }
+      // Surface the truncation both inline (for end users) and via
+      // console.warn (for developers running \`stx dev\`). A silent cut-off
+      // made pages render half a list with no breadcrumb.
+      if (__safeCounter >= __maxIterations) {
+        result += '<!-- [Loop Error]: Maximum iterations exceeded -->';
+        if (typeof console !== 'undefined' && typeof console.warn === 'function') {
+          console.warn('[stx] @while loop hit max iterations (' + __maxIterations + '); template output was truncated. Raise via createSafeForLoop(..., maxIterations) if intentional.');
+        }
+      }
+      return result;
+    // eslint-disable-next-line pickier/no-unused-vars
+    `);
+}