shelving 1.267.0 → 1.267.2

package/cloudflare/CloudflareKVProvider.js

@@ -79,5 +79,8 @@ export class CloudflareKVProvider extends DBProvider {
     }
 }
 function _getKey(collection, id) {
-    return `${collection}:${id}`;
+    // Percent-encode both parts so the `:` separator is unambiguous: without this, an `id` containing `:`
+    // (e.g. collection `a` + id `b:c`) collides with a different collection/id pair (collection `a:b` + id `c`).
+    // Plain identifiers (letters, digits, `-`, `_`, `.`) are left unchanged, so keys for typical names/UUIDs are stable.
+    return `${encodeURIComponent(collection)}:${encodeURIComponent(id)}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "shelving",
-	"version": "1.267.0",
+	"version": "1.267.2",
 	"author": "Dave Houlbrooke <dave@shax.com>",
 	"repository": {
 		"type": "git",
@@ -9,13 +9,13 @@
 	"main": "./index.js",
 	"module": "./index.js",
 	"devDependencies": {
-		"@biomejs/biome": "^2.5.1",
+		"@biomejs/biome": "^2.5.2",
 		"@google-cloud/firestore": "^8.6.0",
 		"@heroicons/react": "^2.2.0",
 		"@types/bun": "^1.3.14",
 		"@types/react": "^19.2.17",
 		"@types/react-dom": "^19.2.3",
-		"@typescript/native-preview": "^7.0.0-dev.20260627.2",
+		"@typescript/native-preview": "^7.0.0-dev.20260704.1",
 		"firebase": "^12.15.0",
 		"react": "^19.3.0-canary-fef12a01-20260413",
 		"react-dom": "^19.3.0-canary-fef12a01-20260413",

package/schema/StringSchema.js

@@ -31,12 +31,15 @@ export class StringSchema extends Schema {
         if (typeof str !== "string")
             throw value ? `Must be ${this.one}` : "Required";
         const sane = this.sanitize(str);
+        // Enforce `max` before running `match`, so an over-length string is rejected without ever being handed to
+        // the (potentially expensive) regex — a length cap can't shield the pattern otherwise. `min` stays after
+        // `match` to preserve the existing "Invalid" precedence for short-but-malformed values.
+        if (sane.length > this.max)
+            throw `Maximum ${this.max} characters`;
         if (this.match && !this.match.test(sane))
             throw str.length ? `Invalid ${this.one}` : "Required";
         if (sane.length < this.min)
             throw str.length ? `Minimum ${this.min} characters` : "Required";
-        if (sane.length > this.max)
-            throw `Maximum ${this.max} characters`;
         return sane;
     }
     /**

package/util/crypto.js

@@ -4,6 +4,7 @@ import { requireBytes } from "./bytes.js";
 // Constants.
 const ALGORITHM = { name: "PBKDF2", hash: "SHA-512" };
 const ITERATIONS = 500000;
+const MAX_ITERATIONS = 10000000; // Upper bound on iterations accepted from a stored hash — guards against a malicious hash forcing an arbitrarily expensive derivation (DoS). Comfortably above the 500k default.
 const SALT_LENGTH = 16; // 16 bytes = 128 bits
 const HASH_LENGTH = 64; // 64 bytes = 512 bits
 const PASSWORD_LENGTH = 6;
@@ -42,8 +43,8 @@ export async function hashPassword(password, iterations = ITERATIONS) {
             received: password.length,
             caller: hashPassword,
         });
-    if (iterations < 1)
-        throw new ValueError("Iterations must be number greater than 0", { received: iterations, caller: hashPassword });
+    if (iterations < 1 || iterations > MAX_ITERATIONS)
+        throw new ValueError(`Iterations must be between 1 and ${MAX_ITERATIONS}`, { received: iterations, caller: hashPassword });
     // Hash the password.
     const key = await _getKey(password);
     const salt = getRandomBytes(SALT_LENGTH);
@@ -70,7 +71,7 @@ export async function verifyPassword(password, hash) {
     const hashBytes = decodeBase64URLBytes(h);
     // Check iterations.
     const iterations = Number.parseInt(i, 10);
-    if (!Number.isFinite(iterations) || iterations < 1)
+    if (!Number.isFinite(iterations) || iterations < 1 || iterations > MAX_ITERATIONS)
         return false;
     // Derive the hash.
     const key = await _getKey(password);

package/util/validate.js

@@ -124,7 +124,10 @@ export function validateArray(unsafeArray, validator) {
  */
 export function validateDictionary(unsafeDictionary, validator) {
     let changed = false;
-    const safeDictionary = {};
+    // Null-prototype accumulator: an untrusted `"__proto__"` key (or `"constructor"`) then becomes an inert own
+    // property instead of invoking the inherited `__proto__` setter, so a crafted `{ "__proto__": … }` input can't
+    // reassign the returned dictionary's prototype, and the entry stays enumerable so `min`/`max` counts are correct.
+    const safeDictionary = Object.create(null);
     const messages = [];
     for (const [key, unsafeValue] of getDictionaryItems(unsafeDictionary)) {
         try {