madr-lint 0.4.2 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.5.0
+
+### Minor Changes
+
+- [#200](https://github.com/knktkc/madr-lint/pull/200) [`c67293d`](https://github.com/knktkc/madr-lint/commit/c67293dc6f3f94afe6e32180f4c86221f0d21d6d) Thanks [@knktkc](https://github.com/knktkc)! - Read `---js` and `---javascript` frontmatter that is a static object literal: strings, numbers, booleans, null, arrays, and nested objects, with comments, unquoted keys, and trailing commas. The block is parsed as data and never executed, so calls, variables, expressions, template literals, getters, methods, spread, and computed keys still fail with an error. `madr/supersedes-bidirectional` no longer offers a `--fix` for targets whose frontmatter is `---js` or `---json`, because inserting a YAML line would corrupt them.
+
+## 0.4.3
+
+### Patch Changes
+
+- [`f854ca3`](https://github.com/knktkc/madr-lint/commit/f854ca3a84e2694307356117bfd23c9d5db3ef2c) Thanks [@knktkc](https://github.com/knktkc)! - Reject JavaScript frontmatter instead of evaluating it. A document that opens with `---js` or `---javascript` now fails with an error, and its frontmatter block is not executed.
+
 ## 0.4.2
 
 ### Patch Changes

package/dist/cli.d.ts

@@ -1,2 +1,2 @@
 
-export {  }
+export { };

package/dist/cli.js

@@ -131,13 +131,60 @@ import { fromMarkdown } from "mdast-util-from-markdown";
 import { toString } from "mdast-util-to-string";
 import grayMatter from "gray-matter";
 
+// src/core/js-frontmatter.ts
+import { createRequire } from "module";
+var MAX_DEPTH = 64;
+var json5;
+function loadJson5() {
+  json5 ??= createRequire(import.meta.url)("json5");
+  return json5;
+}
+function invalid(reason) {
+  return new Error(
+    `Invalid JavaScript frontmatter (---js): ${reason}. Only a static object literal is allowed (strings, numbers, booleans, null, arrays, objects). Use YAML frontmatter for anything else.`
+  );
+}
+function parseStaticJsFrontmatter(block) {
+  let root;
+  try {
+    root = loadJson5().parse(block);
+  } catch (error) {
+    throw invalid(error instanceof Error ? error.message : "parse failed");
+  }
+  if (root === null || typeof root !== "object" || Array.isArray(root)) {
+    throw invalid("the top level must be an object");
+  }
+  const pending = [
+    { value: root, depth: 1 }
+  ];
+  for (let next = pending.pop(); next; next = pending.pop()) {
+    const { value, depth } = next;
+    if (typeof value === "number" && !Number.isFinite(value)) {
+      throw invalid("Infinity and NaN are not allowed");
+    }
+    if (value === null || typeof value !== "object") continue;
+    if (depth > MAX_DEPTH) {
+      throw invalid(`nesting is limited to ${MAX_DEPTH} levels`);
+    }
+    for (const [key, child] of Object.entries(value)) {
+      if (key === "__proto__") throw invalid("the __proto__ key is not allowed");
+      pending.push({ value: child, depth: depth + 1 });
+    }
+  }
+  return root;
+}
+
 // src/core/null-proto-map.ts
 function nullProtoMap() {
   return /* @__PURE__ */ Object.create(null);
 }
 
 // src/core/parser.ts
-var GRAY_MATTER_OPTIONS = Object.freeze({});
+var GRAY_MATTER_OPTIONS = Object.freeze({
+  engines: {
+    javascript: parseStaticJsFrontmatter
+  }
+});
 function frontmatterOffset(content) {
   return content.length - grayMatter(content, GRAY_MATTER_OPTIONS).content.length;
 }
@@ -2197,6 +2244,7 @@ function frontmatterInsertEdit(content, key, value) {
   const fmEnd = frontmatterOffset(content);
   if (fmEnd === 0) return null;
   const fmBlock = content.slice(0, fmEnd);
+  if (!/^\uFEFF?---[ \t]*\r?\n/.test(fmBlock)) return null;
   const closeMatch = /\r?\n(---[ \t]*\r?\n)$/.exec(fmBlock);
   if (!closeMatch) return null;
   const fenceLine = closeMatch[1];