@ts-graphviz/ast 3.0.4-next-52e3f1ff58a77bf9bd9a0d0b6e29edb20e3700e5 → 3.0.4

package/CHANGELOG.md

@@ -1,9 +1,30 @@
 # @ts-graphviz/ast
 
-## 3.0.4-next-52e3f1ff58a77bf9bd9a0d0b6e29edb20e3700e5
+## 3.0.4
 
 ### Patch Changes
 
+- [#1531](https://github.com/ts-graphviz/ts-graphviz/pull/1531) [`c4a08b9`](https://github.com/ts-graphviz/ts-graphviz/commit/c4a08b9f6bbe9104a461d5dc599ca307f6940f7c) Thanks [@kamiazya](https://github.com/kamiazya)! - Fix stack overflow vulnerability in edge chain parser
+
+  This patch addresses a security vulnerability where deeply chained edges in DOT files could cause stack overflow, leading to application crashes and potential DoS attacks.
+
+  **Changes:**
+
+  - Added depth limit (default: 1000) to edge chain parsing in PEG grammar
+  - Introduced `maxEdgeChainDepth` option to `parse()` function for custom depth limits
+  - Improved parser to track and limit edge chain depth during parsing
+  - Reset edge chain depth counter after successful edge parse
+
+  **Security Impact:**
+
+  - Prevents stack overflow attacks from maliciously crafted DOT files with deep edge chains (e.g., `a -> b -> c -> ... -> z`)
+  - Prevents memory exhaustion from unbounded `edgeops` array growth
+  - Normal use cases (typically <100 edges per chain) are unaffected
+  - Configurable limit allows complex graphs when needed
+
+  **Breaking Changes:**
+  None. This is a backward-compatible security fix with sensible defaults.
+
 - [#1526](https://github.com/ts-graphviz/ts-graphviz/pull/1526) [`00aaf2f`](https://github.com/ts-graphviz/ts-graphviz/commit/00aaf2ff6ef6fa8b6611ec2a477bc46b76fdebaf) Thanks [@kamiazya](https://github.com/kamiazya)! - Fix critical stack overflow vulnerability in HTML string parser
 
   This patch addresses a critical security vulnerability where deeply nested HTML-like structures in DOT files could cause stack overflow, leading to application crashes and potential DoS attacks.

package/lib/ast.d.ts

@@ -195,6 +195,12 @@ export declare interface CommonParseOptions {
      * @default 100
      */
     maxHtmlNestingDepth?: number;
+    /**
+     * maxEdgeChainDepth (optional): Maximum allowed depth for chained edges.
+     * Default is 1000. This limit prevents stack overflow attacks from deeply chained edge structures.
+     * @default 1000
+     */
+    maxEdgeChainDepth?: number;
 }
 
 /**

package/lib/ast.js

@@ -321,6 +321,7 @@ function peg$parse(input, options) {
     );
   }
   function peg$f14(id, rhs, _children) {
+    edgeChainDepth = 0;
     return b.createElement(
       // @ts-ignore
       "Edge",
@@ -365,6 +366,13 @@ function peg$parse(input, options) {
     return { operator, location: location() };
   }
   function peg$f22(edgeop, id, rest) {
+    edgeChainDepth++;
+    if (edgeChainDepth > MAX_EDGE_CHAIN_DEPTH) {
+      const loc = location();
+      error(
+        `Edge chain depth exceeds maximum allowed depth of ${MAX_EDGE_CHAIN_DEPTH} at line ${loc.start.line}, column ${loc.start.column}. Consider breaking up long edge chains or increasing the 'maxEdgeChainDepth' option.`
+      );
+    }
     edgeops.push(edgeop);
     return [id].concat(rest || []);
   }
@@ -2706,7 +2714,9 @@ function peg$parse(input, options) {
   }
   const edgeops = [];
   const MAX_HTML_NESTING_DEPTH = options.maxHtmlNestingDepth ?? 100;
+  const MAX_EDGE_CHAIN_DEPTH = options.maxEdgeChainDepth ?? 1e3;
   let htmlNestingDepth = 0;
+  let edgeChainDepth = 0;
   const b = new Builder({
     locationFunction: location
   });
@@ -2743,9 +2753,14 @@ function peg$parse(input, options) {
   }
 }
 function parse(input, options) {
-  const { startRule, filename, maxHtmlNestingDepth } = options ?? {};
+  const { startRule, filename, maxHtmlNestingDepth, maxEdgeChainDepth } = options ?? {};
   try {
-    return peg$parse(input, { startRule, filename, maxHtmlNestingDepth });
+    return peg$parse(input, {
+      startRule,
+      filename,
+      maxHtmlNestingDepth,
+      maxEdgeChainDepth
+    });
   } catch (e) {
     if (e instanceof peg$SyntaxError) {
       throw new DotSyntaxError(e.message, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-graphviz/ast",
-  "version": "3.0.4-next-52e3f1ff58a77bf9bd9a0d0b6e29edb20e3700e5",
+  "version": "3.0.4",
   "description": "Graphviz AST(Abstract Syntax Tree) Utilities",
   "keywords": [],
   "homepage": "https://github.com/ts-graphviz/ts-graphviz#readme",