dsh-unlag 1.9.42 → 1.9.44

package/index.js

@@ -1496,9 +1496,18 @@ export async function verifyStartupRows(graph, fetchBody, rows, budgetMs = MAX_V
   const wanted = []
   for (const row of offered) {
     if (typeof row !== 'string' || row === '') continue
-    if (row.length > MAX_STARTUP_ROW_CHARS) continue
+    // A row past the bound is a script that will not be read, and a script this check does not read
+    // is one nothing proved the next document could load: refuse the list instead of approving the
+    // part that happened to be readable.
+    if (row.length > MAX_STARTUP_ROW_CHARS) {
+      return { status: 'blocked', reason: 'list', detail: 'the startup list names an address longer than a document loads' }
+    }
     const path = row.includes('://') ? row.replace(/^[a-z]+:\/\/[^/]+/iu, '') : row
     const url = path.startsWith('/') ? path : `/${path.replace(/^\.?\//u, '')}`
+    // A list can name the same address more than once, and one address can be most of a profile's
+    // bytes: read each address once so a repeated row cannot make one check read the profile's
+    // scripts tens of times.
+    if (wanted.some((entry) => entry.url === url)) continue
     const request = bundleRequest(url)
     wanted.push({ url, ids: request === null ? [] : request.ids })
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.9.42",
+  "version": "1.9.44",
   "type": "module",
   "description": "A press applies plugin edits right away and brings a laggy interface back; automatic reloading stays off unless you turn it on, so the press is the only trigger, and nothing restarts.",
   "license": "MIT",