ecma-evaluator 2.0.10 → 2.1.0

package/dist/esm/index.mjs

@@ -35,6 +35,7 @@ var mutableMethods = [
     "Array.prototype.sort",
     "Array.prototype.fill",
     "Array.prototype.copyWithin",
+    "Object.create",
     "Object.defineProperty",
     "Object.defineProperties",
     "Object.preventExtensions",
@@ -338,6 +339,18 @@ var MAX_STRING_LENGTH = 100000;
 var MAX_DATA_NODES = 100000;
 var MAX_BIGINT_EXPONENT = 256n;
 var MAX_BIGINT_BITS = 65536;
+var DEFAULT_MAX_DEPTH = 1000;
+var MAX_CONFIGURABLE_DEPTH = 2000;
+var MAX_REGEXP_SOURCE_LENGTH = 1000;
+var MAX_REGEXP_FLAGS_LENGTH = 32;
+var NON_SANDBOX_GLOBALS = new Set([
+    "WeakRef",
+    "FinalizationRegistry",
+    "Iterator",
+    "SharedArrayBuffer",
+    "escape",
+    "unescape"
+]);
 var TYPED_ARRAY_CONSTRUCTORS = new Set([
     Int8Array,
     Uint8Array,
@@ -346,6 +359,7 @@ var TYPED_ARRAY_CONSTRUCTORS = new Set([
     Uint16Array,
     Int32Array,
     Uint32Array,
+    "function" == typeof Float16Array ? Float16Array : null,
     Float32Array,
     Float64Array,
     "function" == typeof BigInt64Array ? BigInt64Array : null,
@@ -353,6 +367,39 @@ var TYPED_ARRAY_CONSTRUCTORS = new Set([
 ].filter(function(constructor) {
     return "function" == typeof constructor;
 }));
+function isTypedArrayConstructor(value) {
+    return TYPED_ARRAY_CONSTRUCTORS.has(value) || "function" == typeof value && "number" == typeof value.BYTES_PER_ELEMENT;
+}
+var TYPED_ARRAY_MUTATORS = function() {
+    var map = new Map();
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;
+    try {
+        for(var _iterator = TYPED_ARRAY_CONSTRUCTORS[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var constructor = _step.value;
+            for(var _i = 0, _iter = [
+                "set",
+                "fill",
+                "reverse",
+                "sort",
+                "copyWithin"
+            ]; _i < _iter.length; _i++){
+                var name = _iter[_i];
+                var method = constructor.prototype[name];
+                if ("function" == typeof method && !map.has(method)) map.set(method, name);
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && null != _iterator.return) _iterator.return();
+        } finally{
+            if (_didIteratorError) throw _iteratorError;
+        }
+    }
+    return map;
+}();
 var NO_OBJECT = Symbol("no-object");
 var renderErrorMessage = function(template) {
     var context = arguments.length > 1 && void 0 !== arguments[1] ? arguments[1] : {};
@@ -517,14 +564,20 @@ var BINARY_OPERATION_MAP = {
 function createGlobalScope() {
     var scope = Object.create(null);
     var builtin = globals.builtin;
-    for(var key in builtin)if (!blockedGlobalBuiltIns.includes(key)) {
-        var isWritable = builtin[key];
-        Object.defineProperty(scope, key, {
-            value: globalThis[key],
-            writable: isWritable,
-            enumerable: false,
-            configurable: false
-        });
+    for(var key in builtin){
+        if (!blockedGlobalBuiltIns.includes(key)) {
+            if (!NON_SANDBOX_GLOBALS.has(key)) {
+                if (Object.hasOwn(globalThis, key)) {
+                    var isWritable = builtin[key];
+                    Object.defineProperty(scope, key, {
+                        value: globalThis[key],
+                        writable: isWritable,
+                        enumerable: false,
+                        configurable: false
+                    });
+                }
+            }
+        }
     }
     Object.defineProperty(scope, "globalThis", {
         value: scope,
@@ -534,6 +587,7 @@ function createGlobalScope() {
     });
     return scope;
 }
+var GLOBAL_SCOPE = createGlobalScope();
 var getBlockedMethods = function() {
     var BLOCKED_METHODS = null;
     return function() {
@@ -588,11 +642,12 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
         _class_call_check(this, Evaluator);
         this.maxInputLength = validateLimit(null == options ? void 0 : options.maxInputLength, "maxInputLength", DEFAULT_MAX_INPUT_LENGTH, MAX_CONFIGURABLE_INPUT_LENGTH);
         this.maxEvaluationSteps = validateLimit(null == options ? void 0 : options.maxEvaluationSteps, "maxEvaluationSteps", DEFAULT_MAX_EVALUATION_STEPS, MAX_CONFIGURABLE_EVALUATION_STEPS);
+        this.maxDepth = validateLimit(null == options ? void 0 : options.maxDepth, "maxDepth", DEFAULT_MAX_DEPTH, MAX_CONFIGURABLE_DEPTH);
         assertBoundedData(variables, "Evaluation context");
         var clonedVariables = structuredClone(variables);
         this.scopes = [
             clonedVariables,
-            createGlobalScope()
+            GLOBAL_SCOPE
         ].filter(function(scope) {
             return null != scope;
         });
@@ -600,6 +655,7 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
         this.remainingEvaluationSteps = 0;
         this.remainingDataSize = MAX_BUFFER_BYTES;
         this.remainingDataNodes = MAX_DATA_NODES;
+        this.evaluationDepth = 0;
     }
     _create_class(Evaluator, [
         {
@@ -613,9 +669,16 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                 this.remainingEvaluationSteps = this.maxEvaluationSteps;
                 this.remainingDataSize = MAX_BUFFER_BYTES;
                 this.remainingDataNodes = MAX_DATA_NODES;
-                var ast = external_acorn_parse(expression, {
-                    ecmaVersion: "latest"
-                });
+                this.evaluationDepth = 0;
+                var ast;
+                try {
+                    ast = external_acorn_parse(expression, {
+                        ecmaVersion: "latest"
+                    });
+                } catch (error) {
+                    if (_instanceof(error, RangeError) && /call stack/i.test(error.message)) throw new SyntaxError("Expression nesting is too deep to parse");
+                    throw error;
+                }
                 try {
                     return this.execute(ast.body);
                 } finally{
@@ -668,9 +731,24 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
         {
             key: "visit",
             value: function(node) {
-                var _this = this;
                 this.remainingEvaluationSteps--;
                 if (this.remainingEvaluationSteps < 0) throw new RangeError("Evaluation step limit exceeded");
+                this.evaluationDepth++;
+                if (this.evaluationDepth > this.maxDepth) {
+                    this.evaluationDepth--;
+                    throw new RangeError("Maximum evaluation depth exceeded");
+                }
+                try {
+                    return this.visitNode(node);
+                } finally{
+                    this.evaluationDepth--;
+                }
+            }
+        },
+        {
+            key: "visitNode",
+            value: function(node) {
+                var _this = this;
                 switch(node.type){
                     case "ExpressionStatement":
                         return this.visit(node.expression);
@@ -756,10 +834,18 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                 throw new SyntaxError("Unsupported operator: ".concat(node.operator));
             }
         },
+        {
+            key: "assertBoundedRegExp",
+            value: function(args) {
+                if ("string" == typeof args[0] && args[0].length > MAX_REGEXP_SOURCE_LENGTH) throw new RangeError("RegExp source exceeds the maximum allowed length");
+                if ("string" == typeof args[1] && args[1].length > MAX_REGEXP_FLAGS_LENGTH) throw new RangeError("RegExp flags exceed the maximum allowed length");
+            }
+        },
         {
             key: "assertBoundedConstruction",
             value: function(Constructor, args) {
                 var _args_;
+                if (Constructor === RegExp) this.assertBoundedRegExp(args);
                 var size = args[0];
                 if (Constructor === Array && 1 === args.length && "number" == typeof size && size > MAX_ARRAY_LENGTH) throw new RangeError("Array length exceeds the maximum allowed length");
                 if (Constructor === ArrayBuffer && (size > MAX_BUFFER_BYTES || (null == (_args_ = args[1]) ? void 0 : _args_.maxByteLength) > MAX_BUFFER_BYTES)) throw new RangeError("ArrayBuffer size exceeds the maximum allowed size");
@@ -769,7 +855,7 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                     var collectionSize = "string" == typeof size || Array.isArray(size) ? size.length : null != (_size_size = null == size ? void 0 : size.size) ? _size_size : null == size ? void 0 : size.length;
                     if ("number" == typeof collectionSize && collectionSize > MAX_ARRAY_LENGTH) throw new RangeError("Collection source exceeds the maximum allowed size");
                 }
-                if (TYPED_ARRAY_CONSTRUCTORS.has(Constructor)) {
+                if (isTypedArrayConstructor(Constructor)) {
                     var byteLength;
                     if (_instanceof(size, ArrayBuffer)) {
                         var _args_1;
@@ -864,7 +950,7 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                 if ("stack" === property && _instanceof(object, Error)) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
                     "Accessing error stack"
                 ]));
-                if (null != object && object[property] === (null == object ? void 0 : object.__proto__)) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                if (null != object && void 0 !== object.__proto__ && object[property] === object.__proto__) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
                     "Accessing prototype properties"
                 ]));
                 if (null == object) {
@@ -1006,6 +1092,9 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                         path
                     ]));
                 }
+                if (TYPED_ARRAY_MUTATORS.has(func)) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                    "TypedArray.prototype.".concat(TYPED_ARRAY_MUTATORS.get(func))
+                ]));
                 var args = function() {
                     if (0 === node.arguments.length) return [];
                     var result = [];
@@ -1047,7 +1136,8 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                         if ("string" == typeof args[0] && "" !== args[0] && countLiteralMatches(target, args[0], true) >= MAX_ARRAY_LENGTH) throw new RangeError("Split result exceeds the maximum allowed length");
                     }
                 }
-                if ((target === Array || TYPED_ARRAY_CONSTRUCTORS.has(target)) && func === target.from) {
+                if (func === RegExp) this.assertBoundedRegExp(args);
+                if ((target === Array || isTypedArrayConstructor(target)) && func === target.from) {
                     var source = args[0];
                     var _source_size;
                     var size = "string" == typeof source || Array.isArray(source) ? source.length : null != (_source_size = null == source ? void 0 : source.size) ? _source_size : null == source ? void 0 : source.length;
@@ -1097,7 +1187,7 @@ function getNodeString(node) {
             return node.raw;
         case "ArrayExpression":
             return "[".concat(node.elements.map(function(child) {
-                return getNodeString(child);
+                return null === child ? "" : getNodeString(child);
             }).join(","), "]");
         case "ObjectExpression":
             if (0 === node.properties.length) return "{}";
@@ -1170,6 +1260,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                 var buffer = "";
                 var exprStartPos = 0;
                 var pos = 0;
+                var prevExprChar = "";
                 while(pos < length){
                     var char = template[pos];
                     var nextChar = template[pos + 1];
@@ -1187,6 +1278,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                                 }
                                 state = "EXPR";
                                 exprStartPos = pos;
+                                prevExprChar = "";
                                 pos += this.startLen;
                                 continue;
                             }
@@ -1196,6 +1288,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                             if ("'" === char) state = "STRING_SQ";
                             else if ('"' === char) state = "STRING_DQ";
                             else if ("`" === char) state = "TEMPLATE";
+                            else if ("/" === char && this._isRegexPosition(prevExprChar)) state = "REGEX";
                             else if ("\\" === char) state = "'" === nextChar ? "ESCAPE_SQ" : '"' === nextChar ? "ESCAPE_DQ" : "`" === nextChar ? "ESCAPE_TEMPLATE" : "ESCAPE_EXPR";
                             else if (this._isMatch(pos, template, this.exprEnd)) {
                                 var exprValue = this.preserveWhitespace ? buffer : buffer.trim();
@@ -1212,6 +1305,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                                 pos += this.endLen;
                                 continue;
                             }
+                            if (!RegExp("\\s", "u").test(char)) prevExprChar = char;
                             buffer += char;
                             break;
                         case "STRING_SQ":
@@ -1229,6 +1323,17 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                             else if ("`" === char) state = "EXPR";
                             buffer += char;
                             break;
+                        case "REGEX":
+                            if ("\\" === char) state = "ESCAPE_REGEX";
+                            else if ("[" === char) state = "REGEX_CLASS";
+                            else if ("/" === char) state = "EXPR";
+                            buffer += char;
+                            break;
+                        case "REGEX_CLASS":
+                            if ("\\" === char) state = "ESCAPE_REGEX";
+                            else if ("]" === char) state = "REGEX";
+                            buffer += char;
+                            break;
                         case "ESCAPE_SQ":
                             buffer += char;
                             state = "STRING_SQ";
@@ -1241,6 +1346,10 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                             buffer += char;
                             state = "TEMPLATE";
                             break;
+                        case "ESCAPE_REGEX":
+                            buffer += char;
+                            state = "REGEX";
+                            break;
                         case "ESCAPE_EXPR":
                             buffer += char;
                             state = "EXPR";
@@ -1266,6 +1375,12 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                 return tokens;
             }
         },
+        {
+            key: "_isRegexPosition",
+            value: function(prev) {
+                return "" === prev || "(,=:[!&|?{};+-*%^~<>".includes(prev);
+            }
+        },
         {
             key: "_isMatch",
             value: function(pos, template, sequence) {