@ts-graphviz/ast 3.0.3 → 3.0.4-next-6966a6699e87e2c74e7348aa6fdc2c50ae11b308

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @ts-graphviz/ast
 
+## 3.0.4-next-6966a6699e87e2c74e7348aa6fdc2c50ae11b308
+
+### Patch Changes
+
+- [#1526](https://github.com/ts-graphviz/ts-graphviz/pull/1526) [`00aaf2f`](https://github.com/ts-graphviz/ts-graphviz/commit/00aaf2ff6ef6fa8b6611ec2a477bc46b76fdebaf) Thanks [@kamiazya](https://github.com/kamiazya)! - Fix critical stack overflow vulnerability in HTML string parser
+
+  This patch addresses a critical security vulnerability where deeply nested HTML-like structures in DOT files could cause stack overflow, leading to application crashes and potential DoS attacks.
+
+  **Changes:**
+
+  - Added depth limit (default: 100) to HTML string parsing in PEG grammar
+  - Introduced `maxHtmlNestingDepth` option to `parse()` function for custom depth limits
+  - Improved parser to track and limit HTML nesting depth during parsing
+
+  **Security Impact:**
+
+  - Prevents stack overflow attacks from maliciously crafted DOT files with deep HTML nesting
+  - Normal use cases (typically <10 levels) are unaffected
+  - Configurable limit allows complex parsing when needed
+
+  **Breaking Changes:**
+  None. This is a backward-compatible security fix with sensible defaults.
+
 ## 3.0.3
 
 ### Patch Changes

package/README.md

@@ -66,6 +66,22 @@ console.log(ast);
 // Output: A DotASTNode representing the DOT structure
 ```
 
+#### Parser Options
+
+The `parse` function accepts an optional second argument for configuration:
+
+```ts
+import { parse } from "@ts-graphviz/ast";
+
+// Parse with custom HTML nesting depth limit
+const ast = parse(dotString, {
+  startRule: 'Dot',  // Specify the starting rule (default: 'Dot')
+  maxHtmlNestingDepth: 200  // Set maximum HTML nesting depth (default: 100)
+});
+```
+
+**Security Note**: The `maxHtmlNestingDepth` option limits the depth of nested HTML-like structures in DOT files to prevent stack overflow attacks. The default limit of 100 is sufficient for normal use cases (typically <10 levels). Increase this value only if you have legitimate deeply nested HTML structures.
+
 ### Generating DOT Language
 
 ```ts

package/lib/ast.d.ts

@@ -189,6 +189,12 @@ export declare interface CommonParseOptions {
      * filename (optional): A string value that is used to identify the file to be parsed.
      */
     filename?: string;
+    /**
+     * maxHtmlNestingDepth (optional): Maximum allowed nesting depth for HTML-like strings.
+     * Default is 100. This limit prevents stack overflow attacks from deeply nested HTML structures.
+     * @default 100
+     */
+    maxHtmlNestingDepth?: number;
 }
 
 /**

package/lib/ast.js

@@ -485,16 +485,24 @@ function peg$parse(input, options) {
       []
     );
   }
-  function peg$f44(v) {
-    return "<" + v.join("") + ">";
+  function peg$f44() {
+    if (htmlNestingDepth >= MAX_HTML_NESTING_DEPTH) {
+      error(`HTML nesting depth exceeds maximum allowed depth of ${MAX_HTML_NESTING_DEPTH}`);
+    }
+    htmlNestingDepth++;
+    return true;
   }
   function peg$f45(v) {
-    return v;
+    htmlNestingDepth--;
+    return "<" + v.join("") + ">";
   }
   function peg$f46(v) {
+    return v;
+  }
+  function peg$f47(v) {
     return v.join("");
   }
-  function peg$f47(chars) {
+  function peg$f48(chars) {
     return b.createElement(
       "Literal",
       {
@@ -504,13 +512,13 @@ function peg$parse(input, options) {
       []
     );
   }
-  function peg$f48() {
+  function peg$f49() {
     return text();
   }
-  function peg$f49(v) {
+  function peg$f50(v) {
     return v[1] === '"' ? '"' : v[0] + v[1];
   }
-  function peg$f50() {
+  function peg$f51() {
     return "";
   }
   let peg$currPos = options.peg$currPos | 0;
@@ -2257,7 +2265,7 @@ function peg$parse(input, options) {
     return s0;
   }
   function peg$parsehtml_raw_string() {
-    let s0, s1, s2, s3;
+    let s0, s1, s2, s3, s4;
     s0 = peg$currPos;
     if (input.charCodeAt(peg$currPos) === 60) {
       s1 = peg$c30;
@@ -2269,30 +2277,42 @@ function peg$parse(input, options) {
       }
     }
     if (s1 !== peg$FAILED) {
-      s2 = [];
-      s3 = peg$parsehtml_char();
-      if (s3 === peg$FAILED) {
-        s3 = peg$parsehtml_raw_string();
+      peg$savedPos = peg$currPos;
+      s2 = peg$f44();
+      if (s2) {
+        s2 = void 0;
+      } else {
+        s2 = peg$FAILED;
       }
-      while (s3 !== peg$FAILED) {
-        s2.push(s3);
-        s3 = peg$parsehtml_char();
-        if (s3 === peg$FAILED) {
-          s3 = peg$parsehtml_raw_string();
+      if (s2 !== peg$FAILED) {
+        s3 = [];
+        s4 = peg$parsehtml_char();
+        if (s4 === peg$FAILED) {
+          s4 = peg$parsehtml_raw_string();
         }
-      }
-      if (input.charCodeAt(peg$currPos) === 62) {
-        s3 = peg$c31;
-        peg$currPos++;
-      } else {
-        s3 = peg$FAILED;
-        if (peg$silentFails === 0) {
-          peg$fail(peg$e39);
+        while (s4 !== peg$FAILED) {
+          s3.push(s4);
+          s4 = peg$parsehtml_char();
+          if (s4 === peg$FAILED) {
+            s4 = peg$parsehtml_raw_string();
+          }
+        }
+        if (input.charCodeAt(peg$currPos) === 62) {
+          s4 = peg$c31;
+          peg$currPos++;
+        } else {
+          s4 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e39);
+          }
+        }
+        if (s4 !== peg$FAILED) {
+          peg$savedPos = s0;
+          s0 = peg$f45(s3);
+        } else {
+          peg$currPos = s0;
+          s0 = peg$FAILED;
         }
-      }
-      if (s3 !== peg$FAILED) {
-        peg$savedPos = s0;
-        s0 = peg$f44(s2);
       } else {
         peg$currPos = s0;
         s0 = peg$FAILED;
@@ -2338,7 +2358,7 @@ function peg$parse(input, options) {
       }
       if (s4 !== peg$FAILED) {
         peg$savedPos = s2;
-        s2 = peg$f45(s4);
+        s2 = peg$f46(s4);
       } else {
         peg$currPos = s2;
         s2 = peg$FAILED;
@@ -2381,7 +2401,7 @@ function peg$parse(input, options) {
           }
           if (s4 !== peg$FAILED) {
             peg$savedPos = s2;
-            s2 = peg$f45(s4);
+            s2 = peg$f46(s4);
           } else {
             peg$currPos = s2;
             s2 = peg$FAILED;
@@ -2396,7 +2416,7 @@ function peg$parse(input, options) {
     }
     if (s1 !== peg$FAILED) {
       peg$savedPos = s0;
-      s1 = peg$f46(s1);
+      s1 = peg$f47(s1);
     }
     s0 = s1;
     return s0;
@@ -2431,7 +2451,7 @@ function peg$parse(input, options) {
       }
       if (s3 !== peg$FAILED) {
         peg$savedPos = s0;
-        s0 = peg$f47(s2);
+        s0 = peg$f48(s2);
       } else {
         peg$currPos = s0;
         s0 = peg$FAILED;
@@ -2469,7 +2489,7 @@ function peg$parse(input, options) {
         s2 = peg$parseSourceCharacter();
         if (s2 !== peg$FAILED) {
           peg$savedPos = s0;
-          s0 = peg$f48();
+          s0 = peg$f49();
         } else {
           peg$currPos = s0;
           s0 = peg$FAILED;
@@ -2520,7 +2540,7 @@ function peg$parse(input, options) {
     }
     if (s1 !== peg$FAILED) {
       peg$savedPos = s0;
-      s1 = peg$f49(s1);
+      s1 = peg$f50(s1);
     }
     s0 = s1;
     return s0;
@@ -2541,7 +2561,7 @@ function peg$parse(input, options) {
       s2 = peg$parseLineTerminatorSequence();
       if (s2 !== peg$FAILED) {
         peg$savedPos = s0;
-        s0 = peg$f50();
+        s0 = peg$f51();
       } else {
         peg$currPos = s0;
         s0 = peg$FAILED;
@@ -2685,6 +2705,8 @@ function peg$parse(input, options) {
     return str;
   }
   const edgeops = [];
+  const MAX_HTML_NESTING_DEPTH = options.maxHtmlNestingDepth ?? 100;
+  let htmlNestingDepth = 0;
   const b = new Builder({
     locationFunction: location
   });
@@ -2721,9 +2743,9 @@ function peg$parse(input, options) {
   }
 }
 function parse(input, options) {
-  const { startRule, filename } = options ?? {};
+  const { startRule, filename, maxHtmlNestingDepth } = options ?? {};
   try {
-    return peg$parse(input, { startRule, filename });
+    return peg$parse(input, { startRule, filename, maxHtmlNestingDepth });
   } catch (e) {
     if (e instanceof peg$SyntaxError) {
       throw new DotSyntaxError(e.message, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-graphviz/ast",
-  "version": "3.0.3",
+  "version": "3.0.4-next-6966a6699e87e2c74e7348aa6fdc2c50ae11b308",
   "description": "Graphviz AST(Abstract Syntax Tree) Utilities",
   "keywords": [],
   "homepage": "https://github.com/ts-graphviz/ts-graphviz#readme",