bonsai-js 0.4.0 → 0.5.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { a as attachLocation, c as offsetToPosition, i as ExpressionError, l as suggest, n as BonsaiSecurityError, o as formatBonsaiError, r as BonsaiTypeError, s as formatError, t as BonsaiReferenceError } from "./errors-BONB6P_5.mjs";
-import { i as tokenize, n as ExecutionContext, r as SecurityPolicy } from "./execution-context-B-5hQ92X.mjs";
+import { a as attachLocation, c as offsetToPosition, i as ExpressionError, l as suggest, n as BonsaiSecurityError, o as formatBonsaiError, r as BonsaiTypeError, s as formatError, t as BonsaiReferenceError } from "./errors-CCZDd1gK.mjs";
+import { i as isMethodAllowedOn, n as ExecutionContext, o as tokenize, r as SecurityPolicy } from "./execution-context-b6FBfEdv.mjs";
 //#region src/parser.ts
 const PIPE_PRECEDENCE = 5;
 const PRECEDENCE = {
@@ -23,6 +23,7 @@ const PRECEDENCE = {
 	"not": void 0
 };
 const MAX_PARSE_DEPTH = 32;
+const MAX_GRAMMAR_DEPTH = 1e3;
 function parse(source, _depth = 0) {
 	if (_depth > MAX_PARSE_DEPTH) throw new ExpressionError("Maximum template nesting depth exceeded", {
 		source,
@@ -31,6 +32,7 @@ function parse(source, _depth = 0) {
 	});
 	const tokens = tokenize(source);
 	let pos = 0;
+	let grammarDepth = 0;
 	function current() {
 		return tokens[pos];
 	}
@@ -46,7 +48,26 @@ function parse(source, _depth = 0) {
 		});
 		return advance();
 	}
+	function enterNesting() {
+		if (++grammarDepth > MAX_GRAMMAR_DEPTH) {
+			grammarDepth--;
+			const tok = current();
+			throw new ExpressionError("Maximum expression nesting depth exceeded", {
+				source,
+				start: tok.start,
+				end: tok.end
+			});
+		}
+	}
 	function parseExpression(minPrec = 0) {
+		enterNesting();
+		try {
+			return parseExpressionInner(minPrec);
+		} finally {
+			grammarDepth--;
+		}
+	}
+	function parseExpressionInner(minPrec = 0) {
 		let left = parseUnary();
 		if (current().type === "Punctuation" && current().value === "?" && minPrec === 0) {
 			advance();
@@ -151,6 +172,14 @@ function parse(source, _depth = 0) {
 		return node;
 	}
 	function parseUnary() {
+		enterNesting();
+		try {
+			return parseUnaryInner();
+		} finally {
+			grammarDepth--;
+		}
+	}
+	function parseUnaryInner() {
 		const tok = current();
 		if (tok.type === "Operator" && (tok.value === "!" || tok.value === "-" || tok.value === "+")) {
 			advance();
@@ -610,8 +639,18 @@ function parse(source, _depth = 0) {
 			let depth = 1;
 			const exprStart = i;
 			while (i < raw.length && depth > 0) {
-				if (raw[i] === "{") depth++;
-				else if (raw[i] === "}") depth--;
+				const c = raw[i];
+				if (c === "\"" || c === "'" || c === "`") {
+					i++;
+					while (i < raw.length && raw[i] !== c) {
+						if (raw[i] === "\\") i++;
+						i++;
+					}
+					i++;
+					continue;
+				}
+				if (c === "{") depth++;
+				else if (c === "}") depth--;
 				if (depth > 0) i++;
 			}
 			const exprSource = raw.slice(exprStart, i);
@@ -791,50 +830,6 @@ function makeConstant(value, start, end) {
 }
 //#endregion
 //#region src/eval-ops.ts
-/** Receiver type check for safe methods. */
-function isAllowedReceiver(obj, methodName) {
-	const t = typeof obj;
-	switch (methodName) {
-		case "startsWith":
-		case "endsWith":
-		case "substring":
-		case "charAt":
-		case "charCodeAt":
-		case "repeat":
-		case "trim":
-		case "trimStart":
-		case "trimEnd":
-		case "toLowerCase":
-		case "toUpperCase":
-		case "replace":
-		case "replaceAll":
-		case "padStart":
-		case "padEnd":
-		case "split": return t === "string";
-		case "includes":
-		case "indexOf":
-		case "lastIndexOf":
-		case "slice":
-		case "at":
-		case "concat": return t === "string" || Array.isArray(obj);
-		case "filter":
-		case "map":
-		case "find":
-		case "findIndex":
-		case "some":
-		case "every":
-		case "flatMap": return Array.isArray(obj);
-		case "join":
-		case "flat":
-		case "toReversed":
-		case "toSorted":
-		case "toSpliced":
-		case "with": return Array.isArray(obj);
-		case "toFixed": return t === "number";
-		case "toString": return t === "string" || t === "number";
-		default: return false;
-	}
-}
 function toPropertyKey(value) {
 	return String(value);
 }
@@ -874,7 +869,7 @@ function applyUnaryOp(operator, operand) {
 function validateMethodCall(obj, methodName, guard) {
 	guard.checkNameAccess(methodName, "method");
 	if (obj == null) throw new BonsaiTypeError(methodName, "a non-null value", obj);
-	if (!isAllowedReceiver(obj, methodName)) throw new BonsaiSecurityError("METHOD_NOT_ALLOWED", `Method "${methodName}" is not allowed on ${typeof obj}`);
+	if (!isMethodAllowedOn(obj, methodName)) throw new BonsaiSecurityError("METHOD_NOT_ALLOWED", `Method "${methodName}" is not allowed on ${typeof obj}`);
 	const method = obj[methodName];
 	if (typeof method !== "function") throw new BonsaiTypeError(methodName, "a method", method);
 	return method;
@@ -921,7 +916,17 @@ function expandSpreadValue(value, maxLength) {
 }
 const REPLACE_METHODS = new Set(["replace", "replaceAll"]);
 const MAX_REPEAT_COUNT = 1e5;
-function validateMethodArgs(methodName, args) {
+const HIGHER_ORDER_METHODS = new Set([
+	"map",
+	"filter",
+	"find",
+	"findIndex",
+	"some",
+	"every",
+	"flatMap"
+]);
+const LAMBDA_CALLBACK_EXPECTED = "a lambda or function callback (e.g. .field or . > value)";
+function validateMethodArgs(receiver, methodName, args, guard) {
 	if (REPLACE_METHODS.has(methodName)) for (const arg of args) {
 		if (typeof arg === "function") throw new BonsaiTypeError(methodName, "string arguments (callbacks are not allowed)", arg);
 		if (arg instanceof RegExp) throw new BonsaiTypeError(methodName, "string arguments (RegExp is not allowed)", arg);
@@ -930,7 +935,32 @@ function validateMethodArgs(methodName, args) {
 	if (methodName === "repeat") {
 		const count = Number(args[0]);
 		if (!Number.isFinite(count) || count < 0 || count > MAX_REPEAT_COUNT) throw new BonsaiTypeError("repeat", `a count between 0 and ${MAX_REPEAT_COUNT}`, args[0]);
+		if (typeof receiver === "string") guard.checkStringLength(receiver.length * count);
 	}
+	if (methodName === "padStart" || methodName === "padEnd") guard.checkStringLength(Number(args[0]));
+	if (HIGHER_ORDER_METHODS.has(methodName) && typeof args[0] !== "function") throw new BonsaiTypeError(methodName, LAMBDA_CALLBACK_EXPECTED, args[0]);
+}
+/**
+* Enforce the array-size limit on a value produced by a method call. Array
+* literals and spread are checked at construction; array-returning methods
+* (split, map, flat, concat, toSorted, ...) are checked here so maxArrayLength
+* is a real ceiling on every array that flows through evaluation.
+*/
+function checkResultArrayLength(result, guard) {
+	if (Array.isArray(result)) guard.checkArrayLength(result.length);
+}
+/**
+* Enforce the string-size limit on a value produced by a method call. The
+* argument-time checks on padStart/padEnd/repeat stop the worst single-call
+* amplifiers before allocation, but string-returning methods such as join,
+* concat, slice, and toUpperCase can still produce a string past the ceiling
+* (notably `arr.join(sep)`, whose output is array length times separator length
+* in a single native call). Checking the produced length here makes
+* maxStringLength a real ceiling on every string that flows through evaluation,
+* mirroring checkResultArrayLength.
+*/
+function checkResultStringLength(result, guard) {
+	if (typeof result === "string") guard.checkStringLength(result.length);
 }
 function accessMember(object, propertyNode, computed, computedValue, guard) {
 	const key = computed ? toPropertyKey(computedValue) : getIdentifierName(propertyNode, "Expected identifier property");
@@ -1061,8 +1091,11 @@ function evalCallExpression(node, env) {
 			const method = validateMethodCall(obj, methodName, g);
 			const args = [];
 			for (const arg of node.args) pushCallArgument(args, arg, env);
-			validateMethodArgs(methodName, args);
-			return rejectPromise(method.call(obj, ...args), "method", methodName);
+			validateMethodArgs(obj, methodName, args, g);
+			const result = rejectPromise(method.call(obj, ...args), "method", methodName);
+			checkResultArrayLength(result, g);
+			checkResultStringLength(result, g);
+			return result;
 		} catch (e) {
 			if (s) attachLocation(e, s, node.start, node.end);
 			throw e;
@@ -1135,8 +1168,11 @@ function evalLambdaBody(node, item, env) {
 					const args = [];
 					for (const arg of node.args) if (arg.type === "SpreadElement") args.push(...expandSpreadValue(evalNode(arg.argument, env), g.policy.maxArrayLength));
 					else args.push(evalArg(arg, env));
-					validateMethodArgs(methodName, args);
-					return rejectPromise(method.call(obj, ...args), "method", methodName);
+					validateMethodArgs(obj, methodName, args, g);
+					const result = rejectPromise(method.call(obj, ...args), "method", methodName);
+					checkResultArrayLength(result, g);
+					checkResultStringLength(result, g);
+					return result;
 				}
 				ownDepth = false;
 				g.exitDepth();
@@ -1302,18 +1338,21 @@ async function evalCallExpressionAsync(node, env) {
 			const method = validateMethodCall(obj, methodName, g);
 			const args = [];
 			for (const arg of node.args) await pushCallArgumentAsync(args, arg, env);
-			validateMethodArgs(methodName, args);
+			validateMethodArgs(obj, methodName, args, g);
 			if (Array.isArray(obj) && args.length === 1 && typeof args[0] === "function") {
 				const arr = obj;
 				const predicate = args[0];
 				const asyncResult = await evalAsyncArrayMethod(methodName, arr, predicate);
 				if (asyncResult !== void 0) {
 					g.checkTimeout();
+					checkResultArrayLength(asyncResult.value, g);
 					return asyncResult.value;
 				}
 			}
 			const result = await method.call(obj, ...args);
 			g.checkTimeout();
+			checkResultArrayLength(result, g);
+			checkResultStringLength(result, g);
 			return result;
 		} catch (e) {
 			if (s) attachLocation(e, s, node.start, node.end);
@@ -1343,35 +1382,32 @@ async function pushCallArgumentAsync(args, node, env) {
 async function evalAsyncArrayMethod(methodName, arr, predicate) {
 	switch (methodName) {
 		case "filter": {
-			const results = arr.map(predicate);
-			const resolved = results.some((r) => r instanceof Promise) ? await Promise.all(results) : results;
-			return { value: arr.filter((_, i) => resolved[i]) };
+			const out = [];
+			for (const item of arr) if (await predicate(item)) out.push(item);
+			return { value: out };
 		}
 		case "map": {
-			const results = arr.map(predicate);
-			return { value: results.some((r) => r instanceof Promise) ? await Promise.all(results) : results };
-		}
-		case "find": {
-			const results = arr.map(predicate);
-			const idx = (results.some((r) => r instanceof Promise) ? await Promise.all(results) : results).findIndex(Boolean);
-			return { value: idx >= 0 ? arr[idx] : void 0 };
-		}
-		case "some": {
-			const results = arr.map(predicate);
-			return { value: (results.some((r) => r instanceof Promise) ? await Promise.all(results) : results).some(Boolean) };
-		}
-		case "every": {
-			const results = arr.map(predicate);
-			return { value: (results.some((r) => r instanceof Promise) ? await Promise.all(results) : results).every(Boolean) };
-		}
-		case "findIndex": {
-			const results = arr.map(predicate);
-			return { value: (results.some((r) => r instanceof Promise) ? await Promise.all(results) : results).findIndex(Boolean) };
+			const out = [];
+			for (const item of arr) out.push(await predicate(item));
+			return { value: out };
 		}
 		case "flatMap": {
-			const results = arr.map(predicate);
-			return { value: (results.some((r) => r instanceof Promise) ? await Promise.all(results) : results).flat() };
+			const out = [];
+			for (const item of arr) out.push(await predicate(item));
+			return { value: out.flat() };
 		}
+		case "find":
+			for (const item of arr) if (await predicate(item)) return { value: item };
+			return { value: void 0 };
+		case "findIndex":
+			for (let i = 0; i < arr.length; i++) if (await predicate(arr[i])) return { value: i };
+			return { value: -1 };
+		case "some":
+			for (const item of arr) if (await predicate(item)) return { value: true };
+			return { value: false };
+		case "every":
+			for (const item of arr) if (!await predicate(item)) return { value: false };
+			return { value: true };
 		default: return;
 	}
 }
@@ -1429,15 +1465,19 @@ async function evalLambdaBodyAsync(node, item, env) {
 					const args = [];
 					for (const arg of node.args) if (arg.type === "SpreadElement") args.push(...expandSpreadValue(await evalNodeAsync(arg.argument, env), g.policy.maxArrayLength));
 					else args.push(await evalArgAsync(arg, env));
-					validateMethodArgs(methodName, args);
+					validateMethodArgs(obj, methodName, args, g);
 					if (Array.isArray(obj) && args.length === 1 && typeof args[0] === "function") {
 						const asyncResult = await evalAsyncArrayMethod(methodName, obj, args[0]);
 						if (asyncResult !== void 0) {
 							g.checkTimeout();
+							checkResultArrayLength(asyncResult.value, g);
 							return asyncResult.value;
 						}
 					}
-					return await method.call(obj, ...args);
+					const result = await method.call(obj, ...args);
+					checkResultArrayLength(result, g);
+					checkResultStringLength(result, g);
+					return result;
 				}
 				ownDepth = false;
 				g.exitDepth();
@@ -1614,6 +1654,28 @@ function createPluginRegistry() {
 //#endregion
 //#region src/index.ts
 const DEFAULT_CACHE_SIZE = 256;
+/**
+* Validate options at construction so misconfiguration fails fast with a clear
+* error rather than silently producing surprising behavior (e.g. a negative
+* cacheSize quietly disabling the cache).
+*/
+function assertValidOptions(options) {
+	const requireNonNegativeInt = (name, value) => {
+		if (value !== void 0 && (!Number.isInteger(value) || value < 0)) throw new RangeError(`bonsai: "${name}" must be a non-negative integer, received ${String(value)}`);
+	};
+	requireNonNegativeInt("cacheSize", options.cacheSize);
+	requireNonNegativeInt("maxArrayLength", options.maxArrayLength);
+	requireNonNegativeInt("maxStringLength", options.maxStringLength);
+	if (options.maxDepth !== void 0 && (!Number.isInteger(options.maxDepth) || options.maxDepth < 1)) throw new RangeError(`bonsai: "maxDepth" must be a positive integer, received ${String(options.maxDepth)}`);
+	if (options.timeout !== void 0 && (typeof options.timeout !== "number" || !Number.isFinite(options.timeout) || options.timeout < 0)) throw new RangeError(`bonsai: "timeout" must be a non-negative, finite number of milliseconds, received ${String(options.timeout)}`);
+	const requireStringArray = (name, value) => {
+		if (value === void 0) return;
+		if (!Array.isArray(value)) throw new TypeError(`bonsai: "${name}" must be an array of strings`);
+		if (!value.every((item) => typeof item === "string")) throw new TypeError(`bonsai: "${name}" must contain only strings`);
+	};
+	requireStringArray("allowedProperties", options.allowedProperties);
+	requireStringArray("deniedProperties", options.deniedProperties);
+}
 let sharedInstance;
 /**
 * Evaluate a single expression with default options. Uses a shared instance internally.
@@ -1647,6 +1709,7 @@ function evaluateExpression(expression, context) {
 * ```
 */
 function bonsai(options = {}) {
+	assertValidOptions(options);
 	const registry = createPluginRegistry();
 	const cache = new LRUCache(options.cacheSize ?? DEFAULT_CACHE_SIZE);
 	const astCache = new LRUCache(options.cacheSize ?? DEFAULT_CACHE_SIZE);