ecma-evaluator 2.0.10 → 2.1.0

package/README.md

@@ -2,7 +2,7 @@
 
 [![Badge](https://img.shields.io/badge/link-996.icu-%23FF4D5B.svg?style=flat-square)](https://996.icu/#/en_US)
 [![LICENSE](https://img.shields.io/badge/license-Anti%20996-blue.svg?style=flat-square)](https://github.com/996icu/996.ICU/blob/master/LICENSE)
-![Node](https://img.shields.io/badge/node-%3E=14-blue.svg?style=flat-square)
+![Node](https://img.shields.io/badge/node-%3E=18-blue.svg?style=flat-square)
 [![npm version](https://badge.fury.io/js/ecma-evaluator.svg)](https://badge.fury.io/js/ecma-evaluator)
 
 A tiny, fast, and **secure** JavaScript expression evaluator for safely evaluating expressions and template strings in a sandboxed environment.
@@ -34,6 +34,6 @@ evalTemplate("Hello {{ name }}!", { name: "World" }); // "Hello World!"
 
 - [Getting started](/guide/getting-started)
 - [API, supported features, security, and usage reference](/guide/reference)
-- [Online playground](/#playground)
+- [Online playground](https://axetroy.github.io/ecma-evaluator/#playground)
 
 See the [documentation site](https://axetroy.github.io/ecma-evaluator/).

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [![Badge](https://img.shields.io/badge/link-996.icu-%23FF4D5B.svg?style=flat-square)](https://996.icu/#/zh_CN)
 [![LICENSE](https://img.shields.io/badge/license-Anti%20996-blue.svg?style=flat-square)](https://github.com/996icu/996.ICU/blob/master/LICENSE)
-![Node](https://img.shields.io/badge/node-%3E=14-blue.svg?style=flat-square)
+![Node](https://img.shields.io/badge/node-%3E=18-blue.svg?style=flat-square)
 [![npm version](https://badge.fury.io/js/ecma-evaluator.svg)](https://badge.fury.io/js/ecma-evaluator)
 
 一个小巧、快速且**安全**的 JavaScript 表达式求值器，用于在沙箱环境中安全地执行表达式和模板字符串。
@@ -34,6 +34,6 @@ evalTemplate("你好，{{ name }}！", { name: "世界" }); // "你好，世界
 
 - [快速开始](/zh-CN/guide/getting-started)
 - [API、支持的特性、安全性和使用说明](/zh-CN/guide/reference)
-- [在线体验](/zh-CN/#playground)
+- [在线体验](https://axetroy.github.io/ecma-evaluator/zh-CN/#playground)
 
 也可以访问[文档网站](https://axetroy.github.io/ecma-evaluator/zh-CN/)。

package/dist/cjs/Evaluator.d.cts

@@ -11,6 +11,12 @@ export interface EvaluatorOptions {
 	 * @default 10000
 	 */
 	maxEvaluationSteps?: number;
+	/**
+	 * Maximum interpreter recursion depth (hard maximum: 2000). Bounds nested
+	 * expressions so a deeply nested input cannot exhaust the host call stack.
+	 * @default 1000
+	 */
+	maxDepth?: number;
 }
 
 export declare class Evaluator {
@@ -21,4 +27,8 @@ export declare class Evaluator {
 	evaluate<T = unknown>(expression: string): T;
 }
 
-export declare function getNodeString(node: Node): string;
+/**
+ * Renders an AST node back to a short source-like string. Returns `null` for
+ * node types that have no textual representation.
+ */
+export declare function getNodeString(node: Node): string | null;

package/dist/cjs/index.cjs

@@ -76,6 +76,7 @@ var mutableMethods = [
     "Array.prototype.sort",
     "Array.prototype.fill",
     "Array.prototype.copyWithin",
+    "Object.create",
     "Object.defineProperty",
     "Object.defineProperties",
     "Object.preventExtensions",
@@ -379,6 +380,18 @@ var MAX_STRING_LENGTH = 100000;
 var MAX_DATA_NODES = 100000;
 var MAX_BIGINT_EXPONENT = 256n;
 var MAX_BIGINT_BITS = 65536;
+var DEFAULT_MAX_DEPTH = 1000;
+var MAX_CONFIGURABLE_DEPTH = 2000;
+var MAX_REGEXP_SOURCE_LENGTH = 1000;
+var MAX_REGEXP_FLAGS_LENGTH = 32;
+var NON_SANDBOX_GLOBALS = new Set([
+    "WeakRef",
+    "FinalizationRegistry",
+    "Iterator",
+    "SharedArrayBuffer",
+    "escape",
+    "unescape"
+]);
 var TYPED_ARRAY_CONSTRUCTORS = new Set([
     Int8Array,
     Uint8Array,
@@ -387,6 +400,7 @@ var TYPED_ARRAY_CONSTRUCTORS = new Set([
     Uint16Array,
     Int32Array,
     Uint32Array,
+    "function" == typeof Float16Array ? Float16Array : null,
     Float32Array,
     Float64Array,
     "function" == typeof BigInt64Array ? BigInt64Array : null,
@@ -394,6 +408,39 @@ var TYPED_ARRAY_CONSTRUCTORS = new Set([
 ].filter(function(constructor) {
     return "function" == typeof constructor;
 }));
+function isTypedArrayConstructor(value) {
+    return TYPED_ARRAY_CONSTRUCTORS.has(value) || "function" == typeof value && "number" == typeof value.BYTES_PER_ELEMENT;
+}
+var TYPED_ARRAY_MUTATORS = function() {
+    var map = new Map();
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;
+    try {
+        for(var _iterator = TYPED_ARRAY_CONSTRUCTORS[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var constructor = _step.value;
+            for(var _i = 0, _iter = [
+                "set",
+                "fill",
+                "reverse",
+                "sort",
+                "copyWithin"
+            ]; _i < _iter.length; _i++){
+                var name = _iter[_i];
+                var method = constructor.prototype[name];
+                if ("function" == typeof method && !map.has(method)) map.set(method, name);
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && null != _iterator.return) _iterator.return();
+        } finally{
+            if (_didIteratorError) throw _iteratorError;
+        }
+    }
+    return map;
+}();
 var NO_OBJECT = Symbol("no-object");
 var renderErrorMessage = function(template) {
     var context = arguments.length > 1 && void 0 !== arguments[1] ? arguments[1] : {};
@@ -558,14 +605,20 @@ var BINARY_OPERATION_MAP = {
 function createGlobalScope() {
     var scope = Object.create(null);
     var builtin = external_globals_namespaceObject.builtin;
-    for(var key in builtin)if (!blockedGlobalBuiltIns.includes(key)) {
-        var isWritable = builtin[key];
-        Object.defineProperty(scope, key, {
-            value: globalThis[key],
-            writable: isWritable,
-            enumerable: false,
-            configurable: false
-        });
+    for(var key in builtin){
+        if (!blockedGlobalBuiltIns.includes(key)) {
+            if (!NON_SANDBOX_GLOBALS.has(key)) {
+                if (Object.hasOwn(globalThis, key)) {
+                    var isWritable = builtin[key];
+                    Object.defineProperty(scope, key, {
+                        value: globalThis[key],
+                        writable: isWritable,
+                        enumerable: false,
+                        configurable: false
+                    });
+                }
+            }
+        }
     }
     Object.defineProperty(scope, "globalThis", {
         value: scope,
@@ -575,6 +628,7 @@ function createGlobalScope() {
     });
     return scope;
 }
+var GLOBAL_SCOPE = createGlobalScope();
 var getBlockedMethods = function() {
     var BLOCKED_METHODS = null;
     return function() {
@@ -629,11 +683,12 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
         _class_call_check(this, Evaluator);
         this.maxInputLength = validateLimit(null == options ? void 0 : options.maxInputLength, "maxInputLength", DEFAULT_MAX_INPUT_LENGTH, MAX_CONFIGURABLE_INPUT_LENGTH);
         this.maxEvaluationSteps = validateLimit(null == options ? void 0 : options.maxEvaluationSteps, "maxEvaluationSteps", DEFAULT_MAX_EVALUATION_STEPS, MAX_CONFIGURABLE_EVALUATION_STEPS);
+        this.maxDepth = validateLimit(null == options ? void 0 : options.maxDepth, "maxDepth", DEFAULT_MAX_DEPTH, MAX_CONFIGURABLE_DEPTH);
         assertBoundedData(variables, "Evaluation context");
         var clonedVariables = structuredClone(variables);
         this.scopes = [
             clonedVariables,
-            createGlobalScope()
+            GLOBAL_SCOPE
         ].filter(function(scope) {
             return null != scope;
         });
@@ -641,6 +696,7 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
         this.remainingEvaluationSteps = 0;
         this.remainingDataSize = MAX_BUFFER_BYTES;
         this.remainingDataNodes = MAX_DATA_NODES;
+        this.evaluationDepth = 0;
     }
     _create_class(Evaluator, [
         {
@@ -654,9 +710,16 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                 this.remainingEvaluationSteps = this.maxEvaluationSteps;
                 this.remainingDataSize = MAX_BUFFER_BYTES;
                 this.remainingDataNodes = MAX_DATA_NODES;
-                var ast = external_acorn_namespaceObject.parse(expression, {
-                    ecmaVersion: "latest"
-                });
+                this.evaluationDepth = 0;
+                var ast;
+                try {
+                    ast = external_acorn_namespaceObject.parse(expression, {
+                        ecmaVersion: "latest"
+                    });
+                } catch (error) {
+                    if (_instanceof(error, RangeError) && /call stack/i.test(error.message)) throw new SyntaxError("Expression nesting is too deep to parse");
+                    throw error;
+                }
                 try {
                     return this.execute(ast.body);
                 } finally{
@@ -709,9 +772,24 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
         {
             key: "visit",
             value: function(node) {
-                var _this = this;
                 this.remainingEvaluationSteps--;
                 if (this.remainingEvaluationSteps < 0) throw new RangeError("Evaluation step limit exceeded");
+                this.evaluationDepth++;
+                if (this.evaluationDepth > this.maxDepth) {
+                    this.evaluationDepth--;
+                    throw new RangeError("Maximum evaluation depth exceeded");
+                }
+                try {
+                    return this.visitNode(node);
+                } finally{
+                    this.evaluationDepth--;
+                }
+            }
+        },
+        {
+            key: "visitNode",
+            value: function(node) {
+                var _this = this;
                 switch(node.type){
                     case "ExpressionStatement":
                         return this.visit(node.expression);
@@ -797,10 +875,18 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                 throw new SyntaxError("Unsupported operator: ".concat(node.operator));
             }
         },
+        {
+            key: "assertBoundedRegExp",
+            value: function(args) {
+                if ("string" == typeof args[0] && args[0].length > MAX_REGEXP_SOURCE_LENGTH) throw new RangeError("RegExp source exceeds the maximum allowed length");
+                if ("string" == typeof args[1] && args[1].length > MAX_REGEXP_FLAGS_LENGTH) throw new RangeError("RegExp flags exceed the maximum allowed length");
+            }
+        },
         {
             key: "assertBoundedConstruction",
             value: function(Constructor, args) {
                 var _args_;
+                if (Constructor === RegExp) this.assertBoundedRegExp(args);
                 var size = args[0];
                 if (Constructor === Array && 1 === args.length && "number" == typeof size && size > MAX_ARRAY_LENGTH) throw new RangeError("Array length exceeds the maximum allowed length");
                 if (Constructor === ArrayBuffer && (size > MAX_BUFFER_BYTES || (null == (_args_ = args[1]) ? void 0 : _args_.maxByteLength) > MAX_BUFFER_BYTES)) throw new RangeError("ArrayBuffer size exceeds the maximum allowed size");
@@ -810,7 +896,7 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                     var collectionSize = "string" == typeof size || Array.isArray(size) ? size.length : null != (_size_size = null == size ? void 0 : size.size) ? _size_size : null == size ? void 0 : size.length;
                     if ("number" == typeof collectionSize && collectionSize > MAX_ARRAY_LENGTH) throw new RangeError("Collection source exceeds the maximum allowed size");
                 }
-                if (TYPED_ARRAY_CONSTRUCTORS.has(Constructor)) {
+                if (isTypedArrayConstructor(Constructor)) {
                     var byteLength;
                     if (_instanceof(size, ArrayBuffer)) {
                         var _args_1;
@@ -905,7 +991,7 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                 if ("stack" === property && _instanceof(object, Error)) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
                     "Accessing error stack"
                 ]));
-                if (null != object && object[property] === (null == object ? void 0 : object.__proto__)) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                if (null != object && void 0 !== object.__proto__ && object[property] === object.__proto__) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
                     "Accessing prototype properties"
                 ]));
                 if (null == object) {
@@ -1047,6 +1133,9 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                         path
                     ]));
                 }
+                if (TYPED_ARRAY_MUTATORS.has(func)) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                    "TypedArray.prototype.".concat(TYPED_ARRAY_MUTATORS.get(func))
+                ]));
                 var args = function() {
                     if (0 === node.arguments.length) return [];
                     var result = [];
@@ -1088,7 +1177,8 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                         if ("string" == typeof args[0] && "" !== args[0] && countLiteralMatches(target, args[0], true) >= MAX_ARRAY_LENGTH) throw new RangeError("Split result exceeds the maximum allowed length");
                     }
                 }
-                if ((target === Array || TYPED_ARRAY_CONSTRUCTORS.has(target)) && func === target.from) {
+                if (func === RegExp) this.assertBoundedRegExp(args);
+                if ((target === Array || isTypedArrayConstructor(target)) && func === target.from) {
                     var source = args[0];
                     var _source_size;
                     var size = "string" == typeof source || Array.isArray(source) ? source.length : null != (_source_size = null == source ? void 0 : source.size) ? _source_size : null == source ? void 0 : source.length;
@@ -1138,7 +1228,7 @@ function getNodeString(node) {
             return node.raw;
         case "ArrayExpression":
             return "[".concat(node.elements.map(function(child) {
-                return getNodeString(child);
+                return null === child ? "" : getNodeString(child);
             }).join(","), "]");
         case "ObjectExpression":
             if (0 === node.properties.length) return "{}";
@@ -1211,6 +1301,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                 var buffer = "";
                 var exprStartPos = 0;
                 var pos = 0;
+                var prevExprChar = "";
                 while(pos < length){
                     var char = template[pos];
                     var nextChar = template[pos + 1];
@@ -1228,6 +1319,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                                 }
                                 state = "EXPR";
                                 exprStartPos = pos;
+                                prevExprChar = "";
                                 pos += this.startLen;
                                 continue;
                             }
@@ -1237,6 +1329,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                             if ("'" === char) state = "STRING_SQ";
                             else if ('"' === char) state = "STRING_DQ";
                             else if ("`" === char) state = "TEMPLATE";
+                            else if ("/" === char && this._isRegexPosition(prevExprChar)) state = "REGEX";
                             else if ("\\" === char) state = "'" === nextChar ? "ESCAPE_SQ" : '"' === nextChar ? "ESCAPE_DQ" : "`" === nextChar ? "ESCAPE_TEMPLATE" : "ESCAPE_EXPR";
                             else if (this._isMatch(pos, template, this.exprEnd)) {
                                 var exprValue = this.preserveWhitespace ? buffer : buffer.trim();
@@ -1253,6 +1346,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                                 pos += this.endLen;
                                 continue;
                             }
+                            if (!RegExp("\\s", "u").test(char)) prevExprChar = char;
                             buffer += char;
                             break;
                         case "STRING_SQ":
@@ -1270,6 +1364,17 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                             else if ("`" === char) state = "EXPR";
                             buffer += char;
                             break;
+                        case "REGEX":
+                            if ("\\" === char) state = "ESCAPE_REGEX";
+                            else if ("[" === char) state = "REGEX_CLASS";
+                            else if ("/" === char) state = "EXPR";
+                            buffer += char;
+                            break;
+                        case "REGEX_CLASS":
+                            if ("\\" === char) state = "ESCAPE_REGEX";
+                            else if ("]" === char) state = "REGEX";
+                            buffer += char;
+                            break;
                         case "ESCAPE_SQ":
                             buffer += char;
                             state = "STRING_SQ";
@@ -1282,6 +1387,10 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                             buffer += char;
                             state = "TEMPLATE";
                             break;
+                        case "ESCAPE_REGEX":
+                            buffer += char;
+                            state = "REGEX";
+                            break;
                         case "ESCAPE_EXPR":
                             buffer += char;
                             state = "EXPR";
@@ -1307,6 +1416,12 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                 return tokens;
             }
         },
+        {
+            key: "_isRegexPosition",
+            value: function(prev) {
+                return "" === prev || "(,=:[!&|?{};+-*%^~<>".includes(prev);
+            }
+        },
         {
             key: "_isMatch",
             value: function(pos, template, sequence) {