glslh 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -0,0 +1,16 @@
+## 📋 `glslh` Changelog
+
+### **v1.0.1** (Latest)
+
+- **Strict File Extension Whitelisting**: Added validation checks inside `GLSLHParser` to restrict `#include` directives exclusively to valid shader extensions (`.glsl`, `.glslh`, `.frag`, `.vert`, `.frag.glsl`, `.vert.glsl`), preventing security risks and unauthorized inclusions of non-shader files (e.g., `.py`, `.cpp`, `.txt`).
+- **Compound Header Support**: Enhanced path checking to natively support complex shader extension combinations like `.frag.glslh` and `.vert.glslh`.
+- **Robust Error Messaging**: Improved failure handling and descriptive console warnings/errors when file resolution or extension validation fails.
+
+---
+
+### **v1.0.0**
+
+- **Recursive C-Style `#include` Preprocessor**: Introduced core parsing logic enabling `.glslh` and `.glsl` files to modularly include other shader headers recursively with built-in circular dependency protection.
+- **Dynamic JavaScript Math Constant Injection**: Added automatic replacement of JS math expressions (such as `Math.PI` and `Math.TAU`) directly into clean GLSL numeric floats.
+- **Metadata Uniforms Block (`@uniforms`)**: Implemented support for JSON-parsed `@uniforms` comment blocks to automatically generate and format Three.js uniform maps.
+- **Zero-Config DOM Canvas Integration (`GLSLHDomCanvas`)**: Released `autoInitGlslCanvases()` to instantly bind canvas elements to Three.js WebGL renderers with automatic shader loading and animation loops.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glslh",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "A lightweight GLSL preprocessor and runtime bridge for modular shader development.",
   "type": "module",
   "main": "./src/dom-canvas.js",

package/src/parser.js

@@ -11,18 +11,36 @@ export class GLSLHParser {
         return await res.text();
       });
     this.includeCache = new Map();
+
+    this.allowedExtensions = [
+      ".glsl",
+      ".glslh",
+      ".frag",
+      ".vert",
+      ".frag.glsl",
+      ".vert.glsl",
+    ];
+  }
+
+  validateExtension(filePath) {
+    const lowerPath = filePath.toLowerCase();
+    const isValid = this.allowedExtensions.some((ext) =>
+      lowerPath.endsWith(ext),
+    );
+    if (!isValid) {
+      throw new Error(
+        `GLSLH Security Error: Unsupported file extension for include -> '${filePath}'. Allowed extensions: ${this.allowedExtensions.join(", ")}`,
+      );
+    }
   }
 
-  // Robust path resolution that correctly handles subdirectory nesting
   resolvePath(parentPath, relativePath) {
     if (!parentPath) return relativePath;
 
-    // Extract directory from parent path (e.g., "./src/examples/shaders/header.glslh" -> "./src/examples/shaders")
     const lastSlash = parentPath.lastIndexOf("/");
     if (lastSlash === -1) return relativePath;
     const parentDir = parentPath.substring(0, lastSlash);
 
-    // If relative path starts with ./, strip it to join cleanly
     const cleanRelative = relativePath.startsWith("./")
       ? relativePath.substring(2)
       : relativePath;
@@ -36,8 +54,6 @@ export class GLSLHParser {
 
   async _parseRecursive(sourceCode, currentFilePath, includedFiles) {
     let processed = sourceCode;
-
-    // 1. Extract and parse the @uniforms metadata block
     const uniformRegex = /\/\*\s*@uniforms([\s\S]*?)\*\//;
     const match = processed.match(uniformRegex);
     let uniformsDefinition = {};
@@ -54,7 +70,6 @@ export class GLSLHParser {
       }
     }
 
-    // 2. Resolve C-style #include directives recursively
     const includeRegex = /^#include\s+["<](.+)[">]/gm;
     let includeMatch;
     let includes = [];
@@ -66,6 +81,8 @@ export class GLSLHParser {
     for (const inc of includes) {
       const resolvedPath = this.resolvePath(currentFilePath, inc.path);
 
+      this.validateExtension(resolvedPath);
+
       if (includedFiles.has(resolvedPath)) {
         processed = processed.replace(
           inc.fullMatch,
@@ -93,7 +110,6 @@ export class GLSLHParser {
       );
     }
 
-    // 3. Dynamically inject JS Math constants directly into GLSL syntax
     processed = processed.replace(
       /Math\.([A-Z0-9_]+)/g,
       (match, constantName) => {