@vibesdotdev/security 1.0.0-rc.4 → 1.0.0-rc.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/implementations/encryption.js +10 -9
- package/dist/implementations/encryption.js.map +1 -1
- package/dist/implementations/redaction.d.ts +5 -3
- package/dist/implementations/redaction.d.ts.map +1 -1
- package/dist/implementations/redaction.js +182 -3
- package/dist/implementations/redaction.js.map +1 -1
- package/dist/implementations/redactor.inprocess.impl.d.ts +7 -5
- package/dist/implementations/redactor.inprocess.impl.d.ts.map +1 -1
- package/dist/implementations/redactor.inprocess.impl.js +7 -5
- package/dist/implementations/redactor.inprocess.impl.js.map +1 -1
- package/dist/implementations/redactor.subprocess.impl.d.ts +2 -1
- package/dist/implementations/redactor.subprocess.impl.d.ts.map +1 -1
- package/dist/implementations/redactor.subprocess.impl.js +2 -1
- package/dist/implementations/redactor.subprocess.impl.js.map +1 -1
- package/dist/svelte/security-svelte.plugin.d.ts +2 -0
- package/dist/svelte/security-svelte.plugin.d.ts.map +1 -1
- package/dist/svelte/security-svelte.plugin.js +13 -2
- package/package.json +41 -14
|
@@ -28,15 +28,16 @@ function keyFromHex(hex) {
|
|
|
28
28
|
const runtimeKeys = new WeakMap();
|
|
29
29
|
/** One key resolution per runtime; a refused resolution is not cached, so a later bind is seen. */
|
|
30
30
|
function keyFor(runtime) {
|
|
31
|
-
|
|
32
|
-
if (
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
}
|
|
31
|
+
const existing = runtimeKeys.get(runtime);
|
|
32
|
+
if (existing)
|
|
33
|
+
return existing;
|
|
34
|
+
let key;
|
|
35
|
+
key = resolveEncryptionKeyHex(runtime).then(keyFromHex).catch((failure) => {
|
|
36
|
+
if (key !== undefined && runtimeKeys.get(runtime) === key)
|
|
37
|
+
runtimeKeys.delete(runtime);
|
|
38
|
+
throw failure;
|
|
39
|
+
});
|
|
40
|
+
runtimeKeys.set(runtime, key);
|
|
40
41
|
return key;
|
|
41
42
|
}
|
|
42
43
|
function concatBytes(...parts) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/implementations/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAA6B,MAAM,WAAW,CAAC;AAC/E,OAAO,EACN,qBAAqB,EACrB,mBAAmB,EACnB,8BAA8B,EAC9B,gCAAgC,EAChC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAwB,MAAM,0BAA0B,CAAC;AAE5K,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAwBvD,IAAI,WAAW,GAA4B,IAAI,CAAC;AAChD,SAAS,UAAU;IAClB,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,6CAA6C,EAAE,aAAa,EAAE;YACvF,MAAM,EAAE,oBAAoB;YAC5B,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,WAAW,GAAG,MAAM,CAAC;IACrB,OAAO,MAAM,CAAC;AACf,CAAC;AACD,SAAS,UAAU,CAAC,GAAW;IAC9B,OAAO,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AACD,MAAM,WAAW,GAAG,IAAI,OAAO,EAA+B,CAAC;AAE/D,mGAAmG;AACnG,SAAS,MAAM,CAAC,OAA6B;IAC5C,
|
|
1
|
+
{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/implementations/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAA6B,MAAM,WAAW,CAAC;AAC/E,OAAO,EACN,qBAAqB,EACrB,mBAAmB,EACnB,8BAA8B,EAC9B,gCAAgC,EAChC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAwB,MAAM,0BAA0B,CAAC;AAE5K,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAwBvD,IAAI,WAAW,GAA4B,IAAI,CAAC;AAChD,SAAS,UAAU;IAClB,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,6CAA6C,EAAE,aAAa,EAAE;YACvF,MAAM,EAAE,oBAAoB;YAC5B,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,WAAW,GAAG,MAAM,CAAC;IACrB,OAAO,MAAM,CAAC;AACf,CAAC;AACD,SAAS,UAAU,CAAC,GAAW;IAC9B,OAAO,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AACD,MAAM,WAAW,GAAG,IAAI,OAAO,EAA+B,CAAC;AAE/D,mGAAmG;AACnG,SAAS,MAAM,CAAC,OAA6B;IAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,GAAoC,CAAC;IACzC,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;QACzE,IAAI,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG;YAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvF,MAAM,OAAO,CAAC;IACf,CAAC,CAAC,CAAC;IACH,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,GAAG,KAAmB;IAC1C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAe,EAAE,IAAgB;IAC1D,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,CAAC;IACrD,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAElD,OAAO,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,IAAI,eAAe,CACzB,wFAAwF,EACxF,eAAe,EACf,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAC3F,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAe,EAAE,SAAqB;IAC/D,eAAe,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC;IAEjF,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAc;IAChE,OAAO,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAgB,EAAE,MAAc;IACtE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAe,EAAE,KAAa;IACxD,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,CAAC;IACrD,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3B,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChB,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC;QAClB,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;KAC9B,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAe,EAAE,IAAqB;IAChE,IAAI,GAAG,eAAe,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7B,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,gBAAgB;IACC;IAA7B,YAA6B,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;IAAG,CAAC;IAEtD,GAAG;QACV,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAgB;QAClC,OAAO,gBAAgB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAqB;QACvC,OAAO,gBAAgB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAgB;QACrC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,iBAAiB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAqB;QAClC,OAAO,iBAAiB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACtC,eAAe,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,EAAE,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,eAAe,EAAE;gBAC5E,MAAM,EAAE,oBAAoB;aAC5B,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,iBAAiB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,WAAW;QACjB,OAAO,qBAAqB,EAAE,CAAC;IAChC,CAAC;CACD"}
|
|
@@ -2,8 +2,10 @@ import type { RedactionRule } from '../schemas/RedactionRule.ts';
|
|
|
2
2
|
/**
|
|
3
3
|
* The most candidate spans one call may collect across every rule. Content is
|
|
4
4
|
* capped at 262,144 code units and rules at 64, so without this bound a
|
|
5
|
-
* zero-width rule set could hold millions of spans. Each `exec`
|
|
6
|
-
* adds one span
|
|
5
|
+
* zero-width rule set could hold millions of spans. Each successful `exec`
|
|
6
|
+
* adds one span. Nested unbounded quantifiers are exponential in the input
|
|
7
|
+
* length and one `exec` cannot count those steps, so an input longer than
|
|
8
|
+
* log2 of this budget refuses before that `exec`.
|
|
7
9
|
*/
|
|
8
10
|
export declare const MAX_REDACTION_CANDIDATES = 65536;
|
|
9
11
|
/**
|
|
@@ -11,7 +13,7 @@ export declare const MAX_REDACTION_CANDIDATES = 65536;
|
|
|
11
13
|
* subprocess implementation ships this function's source into its child, so it
|
|
12
14
|
* references nothing outside its own body. All coordinates are original UTF-16
|
|
13
15
|
* offsets. Returns `{ budgetExceeded: true }` instead of a result once
|
|
14
|
-
* `maxCandidates` spans would be exceeded.
|
|
16
|
+
* `maxCandidates` spans or the exponential step ceiling would be exceeded.
|
|
15
17
|
*/
|
|
16
18
|
export declare function redactSpans(content: string, rules: RedactionRule[], maxCandidates: number): {
|
|
17
19
|
budgetExceeded: true;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/implementations/redaction.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE
|
|
1
|
+
{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/implementations/redaction.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,MAAM;;;;;;;;;;;;;;;EAkLzF"}
|
|
@@ -1,8 +1,10 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* The most candidate spans one call may collect across every rule. Content is
|
|
3
3
|
* capped at 262,144 code units and rules at 64, so without this bound a
|
|
4
|
-
* zero-width rule set could hold millions of spans. Each `exec`
|
|
5
|
-
* adds one span
|
|
4
|
+
* zero-width rule set could hold millions of spans. Each successful `exec`
|
|
5
|
+
* adds one span. Nested unbounded quantifiers are exponential in the input
|
|
6
|
+
* length and one `exec` cannot count those steps, so an input longer than
|
|
7
|
+
* log2 of this budget refuses before that `exec`.
|
|
6
8
|
*/
|
|
7
9
|
export const MAX_REDACTION_CANDIDATES = 65_536;
|
|
8
10
|
/**
|
|
@@ -10,13 +12,190 @@ export const MAX_REDACTION_CANDIDATES = 65_536;
|
|
|
10
12
|
* subprocess implementation ships this function's source into its child, so it
|
|
11
13
|
* references nothing outside its own body. All coordinates are original UTF-16
|
|
12
14
|
* offsets. Returns `{ budgetExceeded: true }` instead of a result once
|
|
13
|
-
* `maxCandidates` spans would be exceeded.
|
|
15
|
+
* `maxCandidates` spans or the exponential step ceiling would be exceeded.
|
|
14
16
|
*/
|
|
15
17
|
export function redactSpans(content, rules, maxCandidates) {
|
|
18
|
+
// True when an unbounded quantifier applies to a subpattern that already
|
|
19
|
+
// contains one. That shape backtracks exponentially; the candidate budget
|
|
20
|
+
// is the step ceiling because a single exec cannot be interrupted.
|
|
21
|
+
function nestedUnbounded(source) {
|
|
22
|
+
const length = source.length;
|
|
23
|
+
let index = 0;
|
|
24
|
+
let danger = false;
|
|
25
|
+
const frames = [];
|
|
26
|
+
let current = { contains: false, branch: false, last: false };
|
|
27
|
+
const fresh = () => ({ contains: false, branch: false, last: false });
|
|
28
|
+
const digit = (cursor) => {
|
|
29
|
+
const character = source[cursor];
|
|
30
|
+
return character !== undefined && character >= '0' && character <= '9';
|
|
31
|
+
};
|
|
32
|
+
function noteAtom(inner) {
|
|
33
|
+
current.last = inner;
|
|
34
|
+
if (inner)
|
|
35
|
+
current.branch = true;
|
|
36
|
+
}
|
|
37
|
+
function closeBranch() {
|
|
38
|
+
if (current.branch || current.last)
|
|
39
|
+
current.contains = true;
|
|
40
|
+
current.branch = false;
|
|
41
|
+
current.last = false;
|
|
42
|
+
}
|
|
43
|
+
function skipEscape() {
|
|
44
|
+
index += 1;
|
|
45
|
+
if (index >= length)
|
|
46
|
+
return;
|
|
47
|
+
const escaped = source[index];
|
|
48
|
+
index += 1;
|
|
49
|
+
if (escaped === 'c') {
|
|
50
|
+
index += 1;
|
|
51
|
+
return;
|
|
52
|
+
}
|
|
53
|
+
if (escaped === 'x') {
|
|
54
|
+
index += 2;
|
|
55
|
+
return;
|
|
56
|
+
}
|
|
57
|
+
if (escaped === 'u' && source[index] === '{') {
|
|
58
|
+
const end = source.indexOf('}', index + 1);
|
|
59
|
+
index = end < 0 ? length : end + 1;
|
|
60
|
+
return;
|
|
61
|
+
}
|
|
62
|
+
if (escaped === 'u')
|
|
63
|
+
index += 4;
|
|
64
|
+
}
|
|
65
|
+
function skipClass() {
|
|
66
|
+
index += 1;
|
|
67
|
+
if (source[index] === '^')
|
|
68
|
+
index += 1;
|
|
69
|
+
if (source[index] === ']')
|
|
70
|
+
index += 1;
|
|
71
|
+
while (index < length && source[index] !== ']') {
|
|
72
|
+
if (source[index] === '\\')
|
|
73
|
+
skipEscape();
|
|
74
|
+
else
|
|
75
|
+
index += 1;
|
|
76
|
+
}
|
|
77
|
+
if (index < length)
|
|
78
|
+
index += 1;
|
|
79
|
+
}
|
|
80
|
+
function readQuantifier() {
|
|
81
|
+
if (index >= length)
|
|
82
|
+
return 'none';
|
|
83
|
+
const marker = source[index];
|
|
84
|
+
if (marker === '*' || marker === '+' || marker === '?') {
|
|
85
|
+
index += 1;
|
|
86
|
+
if (source[index] === '?')
|
|
87
|
+
index += 1;
|
|
88
|
+
return marker === '?' ? 'bounded' : 'unbounded';
|
|
89
|
+
}
|
|
90
|
+
if (marker !== '{')
|
|
91
|
+
return 'none';
|
|
92
|
+
let cursor = index + 1;
|
|
93
|
+
if (!digit(cursor))
|
|
94
|
+
return 'none';
|
|
95
|
+
while (digit(cursor))
|
|
96
|
+
cursor += 1;
|
|
97
|
+
let unbounded = false;
|
|
98
|
+
if (source[cursor] === ',') {
|
|
99
|
+
cursor += 1;
|
|
100
|
+
if (digit(cursor))
|
|
101
|
+
while (digit(cursor))
|
|
102
|
+
cursor += 1;
|
|
103
|
+
else
|
|
104
|
+
unbounded = true;
|
|
105
|
+
}
|
|
106
|
+
if (source[cursor] !== '}')
|
|
107
|
+
return 'none';
|
|
108
|
+
index = cursor + 1;
|
|
109
|
+
if (source[index] === '?')
|
|
110
|
+
index += 1;
|
|
111
|
+
return unbounded ? 'unbounded' : 'bounded';
|
|
112
|
+
}
|
|
113
|
+
function applyQuantifier(kind) {
|
|
114
|
+
if (kind === 'unbounded' && current.last)
|
|
115
|
+
danger = true;
|
|
116
|
+
if (kind === 'unbounded') {
|
|
117
|
+
current.last = true;
|
|
118
|
+
current.branch = true;
|
|
119
|
+
}
|
|
120
|
+
}
|
|
121
|
+
function openGroup() {
|
|
122
|
+
index += 1;
|
|
123
|
+
if (source[index] === '?') {
|
|
124
|
+
index += 1;
|
|
125
|
+
const flag = source[index];
|
|
126
|
+
if (flag === '<') {
|
|
127
|
+
index += 1;
|
|
128
|
+
if (source[index] === '=' || source[index] === '!')
|
|
129
|
+
index += 1;
|
|
130
|
+
else {
|
|
131
|
+
while (index < length && source[index] !== '>')
|
|
132
|
+
index += 1;
|
|
133
|
+
if (index < length)
|
|
134
|
+
index += 1;
|
|
135
|
+
}
|
|
136
|
+
}
|
|
137
|
+
else if (flag === ':' || flag === '=' || flag === '!') {
|
|
138
|
+
index += 1;
|
|
139
|
+
}
|
|
140
|
+
else {
|
|
141
|
+
while (index < length) {
|
|
142
|
+
const character = source[index];
|
|
143
|
+
if (character === undefined)
|
|
144
|
+
break;
|
|
145
|
+
const letter = (character >= 'a' && character <= 'z') || (character >= 'A' && character <= 'Z') || character === '-';
|
|
146
|
+
if (!letter)
|
|
147
|
+
break;
|
|
148
|
+
index += 1;
|
|
149
|
+
}
|
|
150
|
+
if (source[index] === ':')
|
|
151
|
+
index += 1;
|
|
152
|
+
}
|
|
153
|
+
}
|
|
154
|
+
frames.push(current);
|
|
155
|
+
current = fresh();
|
|
156
|
+
}
|
|
157
|
+
while (index < length && !danger) {
|
|
158
|
+
const character = source[index];
|
|
159
|
+
if (character === '\\') {
|
|
160
|
+
skipEscape();
|
|
161
|
+
noteAtom(false);
|
|
162
|
+
applyQuantifier(readQuantifier());
|
|
163
|
+
}
|
|
164
|
+
else if (character === '[') {
|
|
165
|
+
skipClass();
|
|
166
|
+
noteAtom(false);
|
|
167
|
+
applyQuantifier(readQuantifier());
|
|
168
|
+
}
|
|
169
|
+
else if (character === '(') {
|
|
170
|
+
openGroup();
|
|
171
|
+
}
|
|
172
|
+
else if (character === ')') {
|
|
173
|
+
closeBranch();
|
|
174
|
+
const groupContains = current.contains;
|
|
175
|
+
current = frames.pop() ?? fresh();
|
|
176
|
+
index += 1;
|
|
177
|
+
noteAtom(groupContains);
|
|
178
|
+
applyQuantifier(readQuantifier());
|
|
179
|
+
}
|
|
180
|
+
else if (character === '|') {
|
|
181
|
+
closeBranch();
|
|
182
|
+
index += 1;
|
|
183
|
+
}
|
|
184
|
+
else {
|
|
185
|
+
index += 1;
|
|
186
|
+
noteAtom(false);
|
|
187
|
+
applyQuantifier(readQuantifier());
|
|
188
|
+
}
|
|
189
|
+
}
|
|
190
|
+
return danger;
|
|
191
|
+
}
|
|
192
|
+
const stepCeiling = Math.floor(Math.log2(maxCandidates));
|
|
16
193
|
const candidates = [];
|
|
17
194
|
for (const [order, rule] of rules.entries()) {
|
|
18
195
|
if (!rule.enabled || rule.target !== 'content')
|
|
19
196
|
continue;
|
|
197
|
+
if (content.length > stepCeiling && nestedUnbounded(rule.pattern))
|
|
198
|
+
return { budgetExceeded: true };
|
|
20
199
|
const pattern = new RegExp(rule.pattern, 'g');
|
|
21
200
|
let match;
|
|
22
201
|
while ((match = pattern.exec(content)) !== null) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/implementations/redaction.ts"],"names":[],"mappings":"AAGA
|
|
1
|
+
{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/implementations/redaction.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,KAAsB,EAAE,aAAqB;IACtF,yEAAyE;IACzE,0EAA0E;IAC1E,mEAAmE;IACnE,SAAS,eAAe,CAAC,MAAc;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,GAAG,KAAK,CAAC;QAEnB,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,GAAa,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,CAAC,MAAc,EAAW,EAAE;YACtC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YACjC,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG,CAAC;QAC3E,CAAC,CAAC;QACF,SAAS,QAAQ,CAAC,KAAc;YAC5B,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC;YACrB,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;QACrC,CAAC;QACD,SAAS,WAAW;YAChB,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAC5D,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;YACvB,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC;QACzB,CAAC;QACD,SAAS,UAAU;YACf,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,IAAI,MAAM;gBAAE,OAAO;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,IAAI,CAAC,CAAC;gBACX,OAAO;YACX,CAAC;YACD,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,IAAI,CAAC,CAAC;gBACX,OAAO;YACX,CAAC;YACD,IAAI,OAAO,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC3C,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;gBACnC,OAAO;YACX,CAAC;YACD,IAAI,OAAO,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,SAAS,SAAS;YACd,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAC;YACtC,OAAO,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI;oBAAE,UAAU,EAAE,CAAC;;oBACpC,KAAK,IAAI,CAAC,CAAC;YACpB,CAAC;YACD,IAAI,KAAK,GAAG,MAAM;gBAAE,KAAK,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,SAAS,cAAc;YACnB,IAAI,KAAK,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrD,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;oBAAE,KAAK,IAAI,CAAC,CAAC;gBACtC,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;YACpD,CAAC;YACD,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,MAAM,CAAC;YAClC,IAAI,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YAClC,OAAO,KAAK,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,CAAC,CAAC;YAClC,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzB,MAAM,IAAI,CAAC,CAAC;gBACZ,IAAI,KAAK,CAAC,MAAM,CAAC;oBAAE,OAAO,KAAK,CAAC,MAAM,CAAC;wBAAE,MAAM,IAAI,CAAC,CAAC;;oBAChD,SAAS,GAAG,IAAI,CAAC;YAC1B,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,OAAO,MAAM,CAAC;YAC1C,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC;YACnB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAC;YACtC,OAAO,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,CAAC;QACD,SAAS,eAAe,CAAC,IAAsC;YAC3D,IAAI,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI;gBAAE,MAAM,GAAG,IAAI,CAAC;YACxD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAC1B,CAAC;QACL,CAAC;QACD,SAAS,SAAS;YACd,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACf,KAAK,IAAI,CAAC,CAAC;oBACX,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;wBAAE,KAAK,IAAI,CAAC,CAAC;yBAC1D,CAAC;wBACF,OAAO,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;4BAAE,KAAK,IAAI,CAAC,CAAC;wBAC3D,IAAI,KAAK,GAAG,MAAM;4BAAE,KAAK,IAAI,CAAC,CAAC;oBACnC,CAAC;gBACL,CAAC;qBAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACtD,KAAK,IAAI,CAAC,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACJ,OAAO,KAAK,GAAG,MAAM,EAAE,CAAC;wBACpB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;wBAChC,IAAI,SAAS,KAAK,SAAS;4BAAE,MAAM;wBACnC,MAAM,MAAM,GAAG,CAAC,SAAS,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG,CAAC,IAAI,SAAS,KAAK,GAAG,CAAC;wBACrH,IAAI,CAAC,MAAM;4BAAE,MAAM;wBACnB,KAAK,IAAI,CAAC,CAAC;oBACf,CAAC;oBACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;wBAAE,KAAK,IAAI,CAAC,CAAC;gBAC1C,CAAC;YACL,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,GAAG,KAAK,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACrB,UAAU,EAAE,CAAC;gBACb,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChB,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;YACtC,CAAC;iBAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC3B,SAAS,EAAE,CAAC;gBACZ,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChB,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;YACtC,CAAC;iBAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC3B,SAAS,EAAE,CAAC;YAChB,CAAC;iBAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC3B,WAAW,EAAE,CAAC;gBACd,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;gBACvC,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,KAAK,EAAE,CAAC;gBAClC,KAAK,IAAI,CAAC,CAAC;gBACX,QAAQ,CAAC,aAAa,CAAC,CAAC;gBACxB,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;YACtC,CAAC;iBAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC3B,WAAW,EAAE,CAAC;gBACd,KAAK,IAAI,CAAC,CAAC;YACf,CAAC;iBAAM,CAAC;gBACJ,KAAK,IAAI,CAAC,CAAC;gBACX,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChB,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;YACtC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACzD,MAAM,UAAU,GAEX,EAAE,CAAC;IACR,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAC1C,SAAS;QACb,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;YAC7D,OAAO,EAAE,cAAc,EAAE,IAAa,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,IAAI,UAAU,CAAC,MAAM,IAAI,aAAa;gBAClC,OAAO,EAAE,cAAc,EAAE,IAAa,EAAE,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9H,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBACrB,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QAC5C,CAAC;IACL,CAAC;IACD,kGAAkG;IAClG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,IAAI,UAAU,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YACjD,SAAS;QACb,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;QACnE,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QACpC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;AAC1D,CAAC"}
|
|
@@ -7,11 +7,13 @@ import type { SecurityRedactorDescriptor } from '../schemas/redactor.ts';
|
|
|
7
7
|
* same candidate budget as the subprocess redactor, run in the caller's isolate.
|
|
8
8
|
*
|
|
9
9
|
* Bounds: content 262,144 code units, 64 rules, 4,096-unit patterns, and at
|
|
10
|
-
* most MAX_REDACTION_CANDIDATES spans (which also bounds regex steps).
|
|
11
|
-
*
|
|
12
|
-
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
10
|
+
* most MAX_REDACTION_CANDIDATES spans (which also bounds regex steps). Nested
|
|
11
|
+
* unbounded quantifiers refuse at that step ceiling before exec. There is no
|
|
12
|
+
* wall-clock deadline: workerd freezes `Date.now()`/`performance.now()` during
|
|
13
|
+
* synchronous compute, so a clock check could never fire, and one `RegExp.exec`
|
|
14
|
+
* cannot be interrupted in-process. The host's CPU limit is the backstop for a
|
|
15
|
+
* single catastrophically backtracking caller pattern the step ceiling does
|
|
16
|
+
* not classify.
|
|
15
17
|
*/
|
|
16
18
|
export default class InProcessRedactor {
|
|
17
19
|
readonly descriptor: SecurityRedactorDescriptor;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redactor.inprocess.impl.d.ts","sourceRoot":"","sources":["../../src/implementations/redactor.inprocess.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAIzE
|
|
1
|
+
{"version":3,"file":"redactor.inprocess.impl.d.ts","sourceRoot":"","sources":["../../src/implementations/redactor.inprocess.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAIzE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACtB,QAAQ,CAAC,UAAU,EAAE,0BAA0B;gBAAtC,UAAU,EAAE,0BAA0B,EAAE,QAAQ,EAAE,WAAW;IAC5E,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,kBAAkB,EAAE;;;;;;;;;;CAI7D"}
|
|
@@ -7,11 +7,13 @@ import { admitBuiltinRedaction, admitRedactionOutput } from "./redaction-admissi
|
|
|
7
7
|
* same candidate budget as the subprocess redactor, run in the caller's isolate.
|
|
8
8
|
*
|
|
9
9
|
* Bounds: content 262,144 code units, 64 rules, 4,096-unit patterns, and at
|
|
10
|
-
* most MAX_REDACTION_CANDIDATES spans (which also bounds regex steps).
|
|
11
|
-
*
|
|
12
|
-
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
10
|
+
* most MAX_REDACTION_CANDIDATES spans (which also bounds regex steps). Nested
|
|
11
|
+
* unbounded quantifiers refuse at that step ceiling before exec. There is no
|
|
12
|
+
* wall-clock deadline: workerd freezes `Date.now()`/`performance.now()` during
|
|
13
|
+
* synchronous compute, so a clock check could never fire, and one `RegExp.exec`
|
|
14
|
+
* cannot be interrupted in-process. The host's CPU limit is the backstop for a
|
|
15
|
+
* single catastrophically backtracking caller pattern the step ceiling does
|
|
16
|
+
* not classify.
|
|
15
17
|
*/
|
|
16
18
|
export default class InProcessRedactor {
|
|
17
19
|
descriptor;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redactor.inprocess.impl.js","sourceRoot":"","sources":["../../src/implementations/redactor.inprocess.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEvF
|
|
1
|
+
{"version":3,"file":"redactor.inprocess.impl.js","sourceRoot":"","sources":["../../src/implementations/redactor.inprocess.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACb;IAArB,YAAqB,UAAsC,EAAE,QAAqB;QAA7D,eAAU,GAAV,UAAU,CAA4B;IAA2B,CAAC;IACvF,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,KAA4B;QACtD,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,oBAAoB,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACnG,CAAC;CACJ"}
|
|
@@ -3,7 +3,8 @@ import { type RedactionRuleInput } from '../schemas/RedactionRule.ts';
|
|
|
3
3
|
import type { SecurityRedactorDescriptor } from '../schemas/redactor.ts';
|
|
4
4
|
/**
|
|
5
5
|
* Consumer-hardware built-in redactor. Matching runs in the execution owner's
|
|
6
|
-
* supervised Node child
|
|
6
|
+
* supervised Node child. The shared step ceiling refuses nested unbounded
|
|
7
|
+
* quantifiers before exec; a pattern that ceiling does not classify is
|
|
7
8
|
* preempted at a one-second deadline instead of blocking the host's event loop.
|
|
8
9
|
* This preemption is what the in-process redactor cannot provide.
|
|
9
10
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redactor.subprocess.impl.d.ts","sourceRoot":"","sources":["../../src/implementations/redactor.subprocess.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAIzE
|
|
1
|
+
{"version":3,"file":"redactor.subprocess.impl.d.ts","sourceRoot":"","sources":["../../src/implementations/redactor.subprocess.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAIzE;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,kBAAkB;IACvB,QAAQ,CAAC,UAAU,EAAE,0BAA0B;IAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAhE,UAAU,EAAE,0BAA0B,EAAmB,OAAO,EAAE,WAAW;IAC5F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,kBAAkB,EAAE;;;;;;;;;;CAsB7D"}
|
|
@@ -5,7 +5,8 @@ import { MAX_REDACTION_CANDIDATES, redactSpans } from "./redaction.js";
|
|
|
5
5
|
import { admitBuiltinRedaction, admitRedactionOutput, redactionBudgetExceeded } from "./redaction-admission.js";
|
|
6
6
|
/**
|
|
7
7
|
* Consumer-hardware built-in redactor. Matching runs in the execution owner's
|
|
8
|
-
* supervised Node child
|
|
8
|
+
* supervised Node child. The shared step ceiling refuses nested unbounded
|
|
9
|
+
* quantifiers before exec; a pattern that ceiling does not classify is
|
|
9
10
|
* preempted at a one-second deadline instead of blocking the host's event loop.
|
|
10
11
|
* This preemption is what the in-process redactor cannot provide.
|
|
11
12
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redactor.subprocess.impl.js","sourceRoot":"","sources":["../../src/implementations/redactor.subprocess.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAoB,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAA2B,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEhH
|
|
1
|
+
{"version":3,"file":"redactor.subprocess.impl.js","sourceRoot":"","sources":["../../src/implementations/redactor.subprocess.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAoB,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAA2B,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEhH;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,kBAAkB;IACd;IAAyD;IAA9E,YAAqB,UAAsC,EAAmB,OAAoB;QAA7E,eAAU,GAAV,UAAU,CAA4B;QAAmB,YAAO,GAAP,OAAO,CAAa;IAAI,CAAC;IACvG,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,KAA4B;QACtD,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO;YACR,MAAM,IAAI,eAAe,CAAC,gEAAgE,EAAE,aAAa,EAAE;gBACvG,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK;aAC9D,CAAC,CAAC;QACP,qGAAqG;QACrG,MAAM,OAAO,GAAG;;0CAEkB,WAAW,CAAC,QAAQ,EAAE,mBAAmB,wBAAwB,MAAM,CAAC;QAC1G,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YACxG,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI;SAC7E,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ;YACf,MAAM,uBAAuB,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YACrB,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,aAAa,EAAE;gBACxE,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,KAAK;aACzD,CAAC,CAAC;QACP,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;CACJ"}
|
|
@@ -1,3 +1,5 @@
|
|
|
1
|
+
/** Settles after every widget registration this module queued so far (none when Kit is absent). */
|
|
2
|
+
export declare function toolWidgetsRegistered(): Promise<void>;
|
|
1
3
|
export declare const securitySveltePlugin: import("@vibesdotdev/kernel").RuntimePlugin;
|
|
2
4
|
export default securitySveltePlugin;
|
|
3
5
|
//# sourceMappingURL=security-svelte.plugin.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"security-svelte.plugin.d.ts","sourceRoot":"","sources":["../../src/svelte/security-svelte.plugin.ts"],"names":[],"mappings":"AA0BA,eAAO,MAAM,oBAAoB,6CAiB/B,CAAC;AAEH,eAAe,oBAAoB,CAAC"}
|
|
1
|
+
{"version":3,"file":"security-svelte.plugin.d.ts","sourceRoot":"","sources":["../../src/svelte/security-svelte.plugin.ts"],"names":[],"mappings":"AA0BA,mGAAmG;AACnG,wBAAgB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAQD,eAAO,MAAM,oBAAoB,6CAiB/B,CAAC;AAEH,eAAe,oBAAoB,CAAC"}
|
|
@@ -12,8 +12,19 @@ const widgets = SECURITY_TOOL_IDS.map((toolId) => ({
|
|
|
12
12
|
tags: ['security', 'widget'],
|
|
13
13
|
enabled: true
|
|
14
14
|
}));
|
|
15
|
-
|
|
16
|
-
|
|
15
|
+
// Kit's widget registry loads lazily: a top-level await here would suspend every importer and,
|
|
16
|
+
// inside a module cycle, let WebKit run a dependent before this module's bindings exist.
|
|
17
|
+
const kitToolWidgets = settle(() => import('@vibesdotdev/kit/components/tool-widgets'));
|
|
18
|
+
function registerKitToolWidget(...args) {
|
|
19
|
+
void kitToolWidgets.then((kit) => {
|
|
20
|
+
if (kit.ok)
|
|
21
|
+
kit.value.registerToolWidget(...args);
|
|
22
|
+
});
|
|
23
|
+
}
|
|
24
|
+
/** Settles after every widget registration this module queued so far (none when Kit is absent). */
|
|
25
|
+
export function toolWidgetsRegistered() {
|
|
26
|
+
return kitToolWidgets.then(() => undefined);
|
|
27
|
+
}
|
|
17
28
|
if (registerKitToolWidget) {
|
|
18
29
|
for (const toolId of SECURITY_TOOL_IDS) {
|
|
19
30
|
registerKitToolWidget(toolId, loadSecurityToolCard);
|
package/package.json
CHANGED
|
@@ -1,25 +1,25 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vibesdotdev/security",
|
|
3
|
-
"version": "1.0.0-rc.
|
|
3
|
+
"version": "1.0.0-rc.7",
|
|
4
4
|
"dependencies": {
|
|
5
|
-
"@vibesdotdev/logging": "^1.0.0-rc.
|
|
5
|
+
"@vibesdotdev/logging": "^1.0.0-rc.8",
|
|
6
6
|
"zod": "^4.6.7",
|
|
7
|
-
"@vibesdotdev/crypto": "^1.0.0-rc.
|
|
7
|
+
"@vibesdotdev/crypto": "^1.0.0-rc.5"
|
|
8
8
|
},
|
|
9
9
|
"peerDependencies": {
|
|
10
10
|
"@opentui/react": "^0.5.17",
|
|
11
11
|
"@types/bun": "^1.4.3",
|
|
12
12
|
"@types/react": "^19.3.0",
|
|
13
|
-
"@vibesdotdev/cli": "^1.0.0-rc.
|
|
14
|
-
"@vibesdotdev/kit": "^1.0.0-rc.
|
|
15
|
-
"@vibesdotdev/paths": "^1.0.0-rc.
|
|
16
|
-
"@vibesdotdev/kernel": "^1.0.0-rc.
|
|
17
|
-
"@vibesdotdev/testing": "^1.0.0-rc.
|
|
18
|
-
"@vibesdotdev/tui": "^1.0.0-rc.
|
|
13
|
+
"@vibesdotdev/cli": "^1.0.0-rc.7",
|
|
14
|
+
"@vibesdotdev/kit": "^1.0.0-rc.0",
|
|
15
|
+
"@vibesdotdev/paths": "^1.0.0-rc.5",
|
|
16
|
+
"@vibesdotdev/kernel": "^1.0.0-rc.11",
|
|
17
|
+
"@vibesdotdev/testing": "^1.0.0-rc.5",
|
|
18
|
+
"@vibesdotdev/tui": "^1.0.0-rc.5",
|
|
19
19
|
"react": "^19.3.1",
|
|
20
20
|
"svelte": "^5.57.2",
|
|
21
21
|
"typescript": "^6.0.3",
|
|
22
|
-
"@vibesdotdev/filesystem": "^1.0.0-rc.
|
|
22
|
+
"@vibesdotdev/filesystem": "^1.0.0-rc.6"
|
|
23
23
|
},
|
|
24
24
|
"main": "./dist/index.js",
|
|
25
25
|
"exports": {
|
|
@@ -179,7 +179,34 @@
|
|
|
179
179
|
"!dist/**/*.spec.js.map",
|
|
180
180
|
"!dist/**/*.spec.d.ts",
|
|
181
181
|
"!dist/**/*.spec.d.ts.map",
|
|
182
|
-
"!dist/**/*.tsbuildinfo"
|
|
182
|
+
"!dist/**/*.tsbuildinfo",
|
|
183
|
+
"!**/.turbo/**",
|
|
184
|
+
"!**/.svelte-kit/**",
|
|
185
|
+
"!**/.vibes/**",
|
|
186
|
+
"!**/__tests__/**",
|
|
187
|
+
"!**/__stubs__/**",
|
|
188
|
+
"!**/*.test.js",
|
|
189
|
+
"!**/*.test.mjs",
|
|
190
|
+
"!**/*.test.cjs",
|
|
191
|
+
"!**/*.test.jsx",
|
|
192
|
+
"!**/*.test.ts",
|
|
193
|
+
"!**/*.test.mts",
|
|
194
|
+
"!**/*.test.cts",
|
|
195
|
+
"!**/*.test.tsx",
|
|
196
|
+
"!**/*.spec.js",
|
|
197
|
+
"!**/*.spec.mjs",
|
|
198
|
+
"!**/*.spec.cjs",
|
|
199
|
+
"!**/*.spec.jsx",
|
|
200
|
+
"!**/*.spec.ts",
|
|
201
|
+
"!**/*.spec.mts",
|
|
202
|
+
"!**/*.spec.cts",
|
|
203
|
+
"!**/*.spec.tsx",
|
|
204
|
+
"!**/SPEC.md",
|
|
205
|
+
"!**/tsconfig.json",
|
|
206
|
+
"!**/tsconfig.*.json",
|
|
207
|
+
"!**/*.tsbuildinfo",
|
|
208
|
+
"!**/.build-ok.json",
|
|
209
|
+
"!**/*.tgz"
|
|
183
210
|
],
|
|
184
211
|
"scripts": {
|
|
185
212
|
"lint": "node ../node_modules/@vibesdotdev/internal-oxlint-toolchain/ratchet.mjs .",
|
|
@@ -238,10 +265,10 @@
|
|
|
238
265
|
}
|
|
239
266
|
},
|
|
240
267
|
"license": "MIT",
|
|
241
|
-
"gitHead": "
|
|
268
|
+
"gitHead": "d1948c757f179d2c3fb41553347085335cb76710",
|
|
242
269
|
"_vibes_source": {
|
|
243
270
|
"repo": "ssh://git@git.vibes.dev/vibesdotdev/framework.git",
|
|
244
|
-
"sha": "
|
|
245
|
-
"workspaceDigest": "sha256:
|
|
271
|
+
"sha": "d1948c757f179d2c3fb41553347085335cb76710",
|
|
272
|
+
"workspaceDigest": "sha256:6fcdfe752d549e5d63392c52154cea1d145420fdb81205a5a9be6a36e6428d5a"
|
|
246
273
|
}
|
|
247
274
|
}
|