poe-code 14.0.29 → 14.0.30

package/packages/safe-js/dist/browser/safe-fs-core.js

@@ -32,7 +32,7 @@ import {
   toFsError,
   validatePath,
   withFileSystemQuota
-} from "./chunks/chunk-FX3SOWQN.js";
+} from "./chunks/chunk-BB4KTS26.js";
 export {
   ACCESS_MODES,
   FileSystemQuotaError,

package/packages/safe-js/dist/browser/safe-fs.js

@@ -32,7 +32,7 @@ import {
   toFsError,
   validatePath,
   withFileSystemQuota
-} from "./chunks/chunk-FX3SOWQN.js";
+} from "./chunks/chunk-BB4KTS26.js";
 export {
   ACCESS_MODES,
   FileSystemQuotaError,

package/packages/safe-js/dist/chunks/{chunk-EGTPUJGO.js → chunk-FOWKJRPH.js}

@@ -34,11 +34,11 @@ import {
   createNodeFsBridge,
   readConfigRecord,
   validateFileSystemConfig
-} from "./chunk-47R6V3XW.js";
+} from "./chunk-OXQ2XP74.js";
 import {
   FsError,
   isPathWithin
-} from "./chunk-X2BJ2VDZ.js";
+} from "./chunk-LRWPYBOU.js";
 
 // packages/safe-js/src/migrate.ts
 import { createHash } from "node:crypto";
@@ -8245,4 +8245,4 @@ export {
   parseMcpConfig,
   makeMcpModule
 };
-//# sourceMappingURL=chunk-EGTPUJGO.js.map
+//# sourceMappingURL=chunk-FOWKJRPH.js.map

package/packages/safe-js/dist/chunks/{chunk-X2BJ2VDZ.js → chunk-LRWPYBOU.js}

@@ -1054,6 +1054,8 @@ function composeAbortSignals(signals) {
 }
 
 // packages/safe-fs/src/fs/webdav/xml.ts
+var XmlResponseLimitError = class extends SyntaxError {
+};
 var xmlNamespace = "http://www.w3.org/XML/1998/namespace";
 var xmlnsNamespace = "http://www.w3.org/2000/xmlns/";
 function invalid(message) {
@@ -1106,7 +1108,7 @@ function parseXml(input, limits = {}) {
   const maxDepth = limits.maxDepth ?? 64;
   const maxNodes = limits.maxNodes ?? 1e5;
   const maxAttributes = limits.maxAttributes ?? 1e4;
-  for (const limit of [maxDepth, maxNodes, maxAttributes]) {
+  for (const limit of [maxDepth, maxNodes, maxAttributes, ...limits.maxResponses === void 0 ? [] : [limits.maxResponses]]) {
     if (!Number.isSafeInteger(limit) || limit < 1) throw new RangeError("XML limits must be positive integers");
   }
   for (const character of input) {
@@ -1118,6 +1120,7 @@ function parseXml(input, limits = {}) {
   let offset = 0;
   let nodes = 0;
   let attributeCount = 0;
+  let responses2 = 0;
   const whitespace = () => {
     while (offset < source.length && " 	\n\r".includes(source[offset])) offset++;
   };
@@ -1215,8 +1218,12 @@ function parseXml(input, limits = {}) {
       }
       const [prefix, localName] = qualifiedName(name);
       if (prefix === "xmlns" || prefix && !namespaces.has(prefix)) invalid("unbound element prefix");
-      const element = { namespace: namespaces.get(prefix) ?? "", localName, children: [], text: "" };
       if (++nodes > maxNodes || stack.length + 1 > maxDepth) invalid("XML resource limit exceeded");
+      const namespace = namespaces.get(prefix) ?? "";
+      if (limits.maxResponses !== void 0 && stack.length === 1 && root?.namespace === "DAV:" && root.localName === "multistatus" && namespace === "DAV:" && localName === "response" && ++responses2 > limits.maxResponses) {
+        throw new XmlResponseLimitError("WebDAV XML response limit exceeded");
+      }
+      const element = { namespace, localName, children: [], text: "" };
       const parent = stack.at(-1);
       if (parent) parent.element.children.push(element);
       else if (root) invalid("multiple root elements");
@@ -1719,20 +1726,23 @@ var WebDavFileSystem = class {
       reader.releaseLock();
     }
   }
-  async xml(response, signal) {
+  async xml(response, signal, maxResponses) {
     const data = await this.bytes(response, this.maxXmlBytes, signal);
     const encoding = data[0] === 255 && data[1] === 254 || data[0] === 60 && data[1] === 0 ? "utf-16le" : data[0] === 254 && data[1] === 255 || data[0] === 0 && data[1] === 60 ? "utf-16be" : "utf-8";
-    return parseXml(new TextDecoder(encoding, { fatal: true }).decode(data), {
-      maxNodes: this.maxXmlBytes,
-      maxAttributes: this.maxXmlBytes
-    });
+    return parseXml(new TextDecoder(encoding, { fatal: true }).decode(data), maxResponses === void 0 ? void 0 : { maxResponses });
   }
   async multistatus(response, signal, method = "PROPFIND", path = "") {
     const link = response.headers.get("link");
     if (link && /\brel\s*=\s*(?:"[^"]*\bnext\b[^"]*"|'[^']*\bnext\b[^']*'|next\b)/i.test(link)) {
       fail("ENOTSUP", method, path, "paginated WebDAV responses are unsupported");
     }
-    const root = await this.xml(response, signal);
+    let root;
+    try {
+      root = await this.xml(response, signal, this.maxEntries);
+    } catch (error) {
+      if (error instanceof XmlResponseLimitError) fail("EFBIG", method, path, "response exceeds entry limit");
+      throw error;
+    }
     if (root.namespace !== "DAV:" || root.localName !== "multistatus") throw new Error("expected DAV:multistatus");
     const responses2 = davChildren(root, "response");
     if (responses2.length > this.maxEntries) fail("EFBIG", method, path, "response exceeds entry limit");
@@ -4694,4 +4704,4 @@ export {
   withFileSystemQuota,
   FileSystemBridge
 };
-//# sourceMappingURL=chunk-X2BJ2VDZ.js.map
+//# sourceMappingURL=chunk-LRWPYBOU.js.map