bank20baht-validator 0.4.2 → 0.4.3

package/dist/index.js

@@ -13,7 +13,7 @@
 // every value must have the shape the UI control could actually emit before
 // the authored validators run.
 // ---------------------------------------------------------------------------
-import { applyFlags, approvalFields, conditionRowRefs, createScriptContext, defaultValue, evaluate, hasScripts, runScripts, getCatalog, normalizeTagsValue, parseDisabledEntry, parseIsoDate, parseIsoDateTime, parseRowRef, resolveViewFields, setCatalog, setLocale, t, validateField, walkPath, normalizeLegacySchema, } from 'bank20baht-ui/engine';
+import { applyFlags, approvalFields, conditionRowRefs, createScriptContext, defaultValue, evaluate, hasScripts, runScripts, getCatalog, normalizeTagsValue, parseDisabledEntry, parseIsoDate, parseIsoDateTime, parseRowRef, resolveViewFields, setCatalog, setLocale, t, isUnsafePattern, validateField, walkPath, normalizeLegacySchema, } from 'bank20baht-ui/engine';
 /**
  * Run `fn` with the catalog switched to `locale`, restoring the previous
  * catalog after. The engine catalog is module-global; validation is fully
@@ -684,25 +684,6 @@ function assertValidFields(form) {
         assertSubFields(field, form.form_name);
     }
 }
-/**
- * True for the textbook ReDoS shape: an unbounded quantifier (`* + {n,}`)
- * applied to a group whose ENTIRE body is one unboundedly-quantified atom —
- * `(a+)+`, `(\d*)*`, `(?:\w+){2,}`. That exact nesting is always either
- * redundant (matches the same language as a single quantifier) or exponential
- * to backtrack, so rejecting it has no legitimate false positives. It is
- * deliberately NARROW: longer bodies like `(abc+)+` are safe (the literal
- * prefix removes the cross-iteration ambiguity) and other catastrophic shapes
- * (e.g. overlapping alternation `(a|a)*`) are out of scope — patterns are
- * builder-authored, so the goal is catching the classic authoring mistake at
- * save time, not sandboxing hostile regexes.
- */
-function hasNestedUnboundedQuantifier(pattern) {
-    // Strip escaped chars and character classes first so `\+`, `[+]` etc.
-    // aren't mistaken for quantifiers or group delimiters.
-    const stripped = pattern.replace(/\\./g, 'x').replace(/\[[^\]]*\]/g, 'C');
-    const unbounded = '(?:[*+]|\\{\\d+,\\})';
-    return new RegExp(`\\((?:\\?:)?[^()|]${unbounded}\\??\\)${unbounded}`).test(stripped);
-}
 function assertFieldKey(field, form_name) {
     // labels are static blocks and may omit the key; everything else needs one
     // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- runtime guard: value is untrusted JSON
@@ -725,7 +706,7 @@ function assertPatternValidator(v, where) {
     catch {
         throw new Error(`invalid pattern ${JSON.stringify(v.value)} on ${where}`);
     }
-    if (hasNestedUnboundedQuantifier(pattern)) {
+    if (isUnsafePattern(pattern)) {
         throw new Error(`pattern on ${where} nests unbounded quantifiers ` +
             `(e.g. "(a+)+") — this backtracks catastrophically on hostile input; ` +
             `an equivalent single quantifier matches the same strings`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bank20baht-validator",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "type": "module",
   "description": "Runtime validation for bahtui form/workflow JSON \u2014 the exact engine rules the client runs, on the server.",
   "license": "MIT",
@@ -46,7 +46,7 @@
     "vitest": "^3.2.4"
   },
   "peerDependencies": {
-    "bank20baht-ui": ">=0.12.1 <0.13.0"
+    "bank20baht-ui": ">=0.12.2 <0.13.0"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",