typescript-virtual-container 1.4.3 → 1.4.5

package/src/types/commands.ts

@@ -60,7 +60,7 @@ export interface SudoChallenge {
 	 * Returns a `CommandResult` written to the terminal, or `null` to show
 	 * another prompt (pass `nextPrompt` to change the prompt text).
 	 */
-	onPassword?: (input: string, shell: import("../VirtualShell").VirtualShell) => Promise<{
+	onPassword?: (input: string, shell: VirtualShell) => Promise<{
 		result: CommandResult | null;
 		nextPrompt?: string;
 	}>;

package/src/utils/expand.ts

@@ -20,35 +20,152 @@
 
 // ─── arithmetic evaluator ────────────────────────────────────────────────────
 
+type ArithToken =
+	| { type: "number"; value: number }
+	| { type: "plus" | "minus" | "mul" | "div" | "mod" | "pow" | "lparen" | "rparen" };
+
+function tokenizeArith(expr: string, env: Record<string, string>): ArithToken[] {
+	const tokens: ArithToken[] = [];
+	let i = 0;
+	while (i < expr.length) {
+		const ch = expr[i]!;
+		if (/\s/.test(ch)) {
+			i++;
+			continue;
+		}
+		if (ch === "+") { tokens.push({ type: "plus" }); i++; continue; }
+		if (ch === "-") { tokens.push({ type: "minus" }); i++; continue; }
+		if (ch === "*") {
+			if (expr[i + 1] === "*") { tokens.push({ type: "pow" }); i += 2; continue; }
+			tokens.push({ type: "mul" });
+			i++;
+			continue;
+		}
+		if (ch === "/") { tokens.push({ type: "div" }); i++; continue; }
+		if (ch === "%") { tokens.push({ type: "mod" }); i++; continue; }
+		if (ch === "(") { tokens.push({ type: "lparen" }); i++; continue; }
+		if (ch === ")") { tokens.push({ type: "rparen" }); i++; continue; }
+		if (/\d/.test(ch)) {
+			let j = i + 1;
+			while (j < expr.length && /\d/.test(expr[j]!)) j++;
+			tokens.push({ type: "number", value: Number(expr.slice(i, j)) });
+			i = j;
+			continue;
+		}
+		if (/[A-Za-z_]/.test(ch)) {
+			let j = i + 1;
+			while (j < expr.length && /[A-Za-z0-9_]/.test(expr[j]!)) j++;
+			const name = expr.slice(i, j);
+			const raw = env[name];
+			const value = raw === undefined || raw === "" ? 0 : Number(raw);
+			tokens.push({ type: "number", value: Number.isFinite(value) ? value : 0 });
+			i = j;
+			continue;
+		}
+		return [];
+	}
+	return tokens;
+}
+
 /**
- * Evaluate a simple integer arithmetic expression.
+ * Evaluate a simple integer arithmetic expression with a bounded parser.
  * Supports: +  -  *  /  %  **  unary-  ( )
- * Variables are resolved from `env` before evaluation.
+ * Variables are resolved from `env`.
  * Returns NaN on syntax error.
  */
 export function evalArith(expr: string, env: Record<string, string>): number {
-	// Substitute variable names before evaluating
-	const substituted = expr.replace(
-		/\b([A-Za-z_][A-Za-z0-9_]*)\b/g,
-		(_, name) => {
-			const val = env[name];
-			return val !== undefined && val !== "" ? val : "0";
-		},
-	);
-
-	// Whitelist: only digits, operators, spaces, parens
-	if (!/^[\d\s+\-*/%()^!&|<>=,. ]+$/.test(substituted)) return NaN;
+	const trimmed = expr.trim();
+	if (trimmed.length === 0 || trimmed.length > 1024) return NaN;
+	const tokens = tokenizeArith(trimmed, env);
+	if (tokens.length === 0) return NaN;
 
-	try {
-		// Use Function constructor for safe subset (no identifiers remain)
-		// eslint-disable-next-line no-new-func
-		const result = Function(
-			`"use strict"; return (${substituted.replace(/\*\*/g, "**")});`,
-		)();
-		return typeof result === "number" ? Math.trunc(result) : NaN;
-	} catch {
+	let index = 0;
+
+	const peek = () => tokens[index];
+	const consume = () => tokens[index++];
+
+	const parsePrimary = (): number => {
+		const token = consume();
+		if (!token) return NaN;
+		if (token.type === "number") return token.value;
+		if (token.type === "lparen") {
+			const value = parseExpression();
+			if (tokens[index]?.type !== "rparen") return NaN;
+			index++;
+			return value;
+		}
 		return NaN;
-	}
+	};
+
+	const parseUnary = (): number => {
+		const token = peek();
+		if (token?.type === "plus") {
+			consume();
+			return parseUnary();
+		}
+		if (token?.type === "minus") {
+			consume();
+			return -parseUnary();
+		}
+		return parsePrimary();
+	};
+
+	const parsePower = (): number => {
+		let left = parseUnary();
+		while (peek()?.type === "pow") {
+			consume();
+			const right = parseUnary();
+			left = left ** right;
+		}
+		return left;
+	};
+
+	const parseTerm = (): number => {
+		let left = parsePower();
+		while (true) {
+			const token = peek();
+			if (token?.type === "mul") {
+				consume();
+				left *= parsePower();
+				continue;
+			}
+			if (token?.type === "div") {
+				consume();
+				const right = parsePower();
+				left = right === 0 ? NaN : left / right;
+				continue;
+			}
+			if (token?.type === "mod") {
+				consume();
+				const right = parsePower();
+				left = right === 0 ? NaN : left % right;
+				continue;
+			}
+			return left;
+		}
+	};
+
+	const parseExpression = (): number => {
+		let left = parseTerm();
+		while (true) {
+			const token = peek();
+			if (token?.type === "plus") {
+				consume();
+				left += parseTerm();
+				continue;
+			}
+			if (token?.type === "minus") {
+				consume();
+				left -= parseTerm();
+				continue;
+			}
+			return left;
+		}
+	};
+
+	const result = parseExpression();
+	if (!Number.isFinite(result) || index !== tokens.length) return NaN;
+	return Math.trunc(result);
 }
 
 // ─── synchronous expansion ───────────────────────────────────────────────────
@@ -105,67 +222,121 @@ function outsideSingleQuotes(
  * Returns a single-element array when no brace expansion applies.
  */
 export function expandBraces(token: string): string[] {
-	// Find the first { not preceded by $
-	let depth = 0;
-	let start = -1;
-	for (let i = 0; i < token.length; i++) {
-		const ch = token[i]!;
-		if (ch === "{" && token[i - 1] !== "$") {
-			if (depth === 0) start = i;
-			depth++;
-		} else if (ch === "}") {
-			depth--;
-			if (depth === 0 && start !== -1) {
-				const prefix  = token.slice(0, start);
-				const inner   = token.slice(start + 1, i);
-				const suffix  = token.slice(i + 1);
-
-				// Range: {1..5} or {a..e}
-				const rangeMatch = inner.match(/^(-?\d+)\.\.(-?\d+)(?:\.\.-?(\d+))?$/) ||
-				                   inner.match(/^([a-z])\.\.([a-z])$/);
-				if (rangeMatch) {
-					const items: string[] = [];
-					if (/\d/.test(rangeMatch[1]!)) {
-						const from = parseInt(rangeMatch[1]!, 10);
-						const to   = parseInt(rangeMatch[2]!, 10);
-						const step = rangeMatch[3] ? parseInt(rangeMatch[3], 10) : 1;
-						const inc  = from <= to ? step : -step;
-						for (let n = from; from <= to ? n <= to : n >= to; n += inc) {
-							items.push(String(n));
+	const MaxBraceDepth = 8;
+	const MaxBraceExpansions = 256;
+
+	function expandBracesInternal(value: string, depth: number): string[] {
+		if (depth > MaxBraceDepth) return [value];
+		// Find the first { not preceded by $
+		let braceDepth = 0;
+		let start = -1;
+		for (let i = 0; i < value.length; i++) {
+			const ch = value[i]!;
+			if (ch === "{" && value[i - 1] !== "$") {
+				if (braceDepth === 0) start = i;
+				braceDepth++;
+			} else if (ch === "}") {
+				braceDepth--;
+				if (braceDepth === 0 && start !== -1) {
+					const prefix = value.slice(0, start);
+					const inner = value.slice(start + 1, i);
+					const suffix = value.slice(i + 1);
+
+					// Range: {1..5} or {a..e}
+					const rangeMatch = inner.match(/^(-?\d+)\.\.(-?\d+)(?:\.\.-?(\d+))?$/) ||
+					                   inner.match(/^([a-z])\.\.([a-z])$/);
+					if (rangeMatch) {
+						const items: string[] = [];
+						if (/\d/.test(rangeMatch[1]!)) {
+							const from = parseInt(rangeMatch[1]!, 10);
+							const to = parseInt(rangeMatch[2]!, 10);
+							const step = rangeMatch[3] ? parseInt(rangeMatch[3], 10) : 1;
+							const inc = from <= to ? step : -step;
+							for (let n = from; from <= to ? n <= to : n >= to; n += inc) {
+								items.push(String(n));
+							}
+						} else {
+							const from = rangeMatch[1]!.charCodeAt(0);
+							const to = rangeMatch[2]!.charCodeAt(0);
+							const inc = from <= to ? 1 : -1;
+							for (let c = from; from <= to ? c <= to : c >= to; c += inc) {
+								items.push(String.fromCharCode(c));
+							}
 						}
-					} else {
-						const from = rangeMatch[1]!.charCodeAt(0);
-						const to   = rangeMatch[2]!.charCodeAt(0);
-						const inc  = from <= to ? 1 : -1;
-						for (let c = from; from <= to ? c <= to : c >= to; c += inc) {
-							items.push(String.fromCharCode(c));
+
+						const expanded = items.map((v) => `${prefix}${v}${suffix}`);
+						const output: string[] = [];
+						for (const item of expanded) {
+							output.push(...expandBracesInternal(item, depth + 1));
+							if (output.length > MaxBraceExpansions) return [value];
 						}
+						return output;
 					}
-					const expanded = items.map((v) => `${prefix}${v}${suffix}`);
-					return expanded.flatMap(expandBraces);
-				}
 
-				// Comma list: {a,b,c} — split respecting nested braces
-				const parts: string[] = [];
-				let cur = "";
-				let d2 = 0;
-				for (const ch2 of inner) {
-					if (ch2 === "{") { d2++; cur += ch2; }
-					else if (ch2 === "}") { d2--; cur += ch2; }
-					else if (ch2 === "," && d2 === 0) { parts.push(cur); cur = ""; }
-					else { cur += ch2; }
+					// Comma list: {a,b,c} — split respecting nested braces
+					const parts: string[] = [];
+					let cur = "";
+					let innerDepth = 0;
+					for (const ch2 of inner) {
+						if (ch2 === "{") { innerDepth++; cur += ch2; }
+						else if (ch2 === "}") { innerDepth--; cur += ch2; }
+						else if (ch2 === "," && innerDepth === 0) { parts.push(cur); cur = ""; }
+						else { cur += ch2; }
+					}
+					parts.push(cur);
+
+					if (parts.length > 1) {
+						const output: string[] = [];
+						for (const part of parts) {
+							output.push(...expandBracesInternal(`${prefix}${part}${suffix}`, depth + 1));
+							if (output.length > MaxBraceExpansions) return [value];
+						}
+						return output;
+					}
+					break;
 				}
-				parts.push(cur);
+			}
+		}
+		return [value];
+	}
+
+	return expandBracesInternal(token, 0);
+}
 
-				if (parts.length > 1) {
-					const expanded = parts.map((p) => `${prefix}${p}${suffix}`);
-					return expanded.flatMap(expandBraces);
+function expandArithmeticChunks(input: string, env: Record<string, string>): string {
+	let result = "";
+	let index = 0;
+	while (index < input.length) {
+		if (input[index] === "$" && input[index + 1] === "(" && input[index + 2] === "(") {
+			let scan = index + 3;
+			let depth = 0;
+			while (scan < input.length) {
+				const ch = input[scan]!;
+				if (ch === "(") {
+					depth++;
+				} else if (ch === ")") {
+					if (depth > 0) {
+						depth--;
+					} else if (input[scan + 1] === ")") {
+						const expr = input.slice(index + 3, scan);
+						const value = evalArith(expr, env);
+						result += Number.isNaN(value) ? "0" : String(value);
+						index = scan + 2;
+						break;
+					}
 				}
+				scan++;
+			}
+			if (scan >= input.length) {
+				result += input.slice(index);
 				break;
 			}
+			continue;
 		}
+		result += input[index]!
+		index++;
 	}
-	return [token];
+	return result;
 }
 
 export function expandSync(
@@ -191,10 +362,7 @@ export function expandSync(
 		s = s.replace(/\$#/g, "0");
 
 		// $(( arithmetic )) — must come before ${ and $VAR to avoid conflicts
-		s = s.replace(/\$\(\(([^)]+(?:\([^)]*\)[^)]*)*)\)\)/g, (_, expr) => {
-			const result = evalArith(expr, env);
-			return Number.isNaN(result) ? "0" : String(result);
-		});
+		s = expandArithmeticChunks(s, env);
 
 		// ${#VAR} — string length
 		s = s.replace(/\$\{#([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, name) =>
@@ -254,6 +422,14 @@ export async function expandAsync(
 	lastExit: number,
 	runCmd: (cmd: string) => Promise<string>,
 ): Promise<string> {
+	const depthKey = "__shellExpandDepth";
+	const maxDepth = 8;
+	const currentDepth = Number(env[depthKey] ?? "0");
+	if (currentDepth >= maxDepth) {
+		return expandSync(input, env, lastExit);
+	}
+	env[depthKey] = String(currentDepth + 1);
+	try {
 	// $(cmd) substitution — skip content inside single quotes
 	if (input.includes("$(")) {
 		let result = "";
@@ -308,4 +484,8 @@ export async function expandAsync(
 	}
 
 	return expandSync(input, env, lastExit);
+	} finally {
+		if (currentDepth <= 0) delete env[depthKey];
+		else env[depthKey] = String(currentDepth);
+	}
 }

package/tests/command-helpers.test.ts

@@ -8,6 +8,21 @@ describe("command-helpers", () => {
 		expect(ifFlag(["docs"], ["-l", "--long"])).toBe(false);
 	});
 
+	test("ifFlag with multiple flags checks all", () => {
+		expect(ifFlag(["-l", "-h"], ["-l", "--long"])).toBe(true);
+		expect(ifFlag(["-h"], ["-l", "--long"])).toBe(false);
+		expect(ifFlag(["-l"], ["-l", "--long"])).toBe(true);
+	});
+
+	test("ifFlag empty args returns false", () => {
+		expect(ifFlag([], ["-l", "--long"])).toBe(false);
+	});
+
+	test("ifFlag single flag array", () => {
+		expect(ifFlag(["-n"], "-n")).toBe(true);
+		expect(ifFlag(["-m"], "-n")).toBe(false);
+	});
+
 	test("getFlag returns value for adjacent and inline forms", () => {
 		expect(getFlag(["-u", "root", "id"], ["-u", "--user"])).toBe("root");
 		expect(getFlag(["--user=alice", "id"], ["-u", "--user"])).toBe("alice");
@@ -16,6 +31,26 @@ describe("command-helpers", () => {
 		expect(getFlag(["pwd"], ["-u", "--user"])).toBeUndefined();
 	});
 
+	test("getFlag with multiple flag aliases", () => {
+		expect(getFlag(["-u", "john"], ["-u", "--user", "-U"])).toBe("john");
+		expect(getFlag(["--user=mary"], ["-u", "--user"])).toBe("mary");
+		expect(getFlag(["-U", "admin"], ["-u", "--user", "-U"])).toBe("admin");
+	});
+
+	test("getFlag inline with equals", () => {
+		expect(getFlag(["--option=value"], "--option")).toBe("value");
+		expect(getFlag(["--opt=123"], "--opt")).toBe("123");
+	});
+
+	test("getFlag first occurrence", () => {
+		expect(getFlag(["-u", "first", "-u", "second"], "-u")).toBe("first");
+	});
+
+	test("getFlag with boolean flag", () => {
+		expect(getFlag(["-v"], "-v")).toBe(true);
+		expect(getFlag(["-v", "file.txt"], "-v")).toBe("file.txt");
+	});
+
 	test("getArg skips bool and value flags", () => {
 		const args = ["-i", "-u", "root", "sh", "-c", "whoami"];
 		const options = { flags: ["-i"], flagsWithValue: ["-u"] };
@@ -26,6 +61,29 @@ describe("command-helpers", () => {
 		expect(getArg(args, 3, options)).toBeUndefined();
 	});
 
+	test("getArg with no flags", () => {
+		const args = ["file1", "file2", "file3"];
+		const options = { flags: [], flagsWithValue: [] };
+
+		expect(getArg(args, 0, options)).toBe("file1");
+		expect(getArg(args, 1, options)).toBe("file2");
+		expect(getArg(args, 2, options)).toBe("file3");
+	});
+
+	test("getArg empty args", () => {
+		const args: string[] = [];
+		const options = { flags: ["-n"] };
+
+		expect(getArg(args, 0, options)).toBeUndefined();
+	});
+
+	test("getArg skips values for flagsWithValue", () => {
+		const args = ["-d", ":", "-f", "1", "input.txt"];
+		const options = { flagsWithValue: ["-d", "-f"] };
+
+		expect(getArg(args, 0, options)).toBe("input.txt");
+	});
+
 	test("getArg keeps tokens after -- as positional", () => {
 		const args = ["-n", "--", "-n", "hello"];
 		const options = { flags: ["-n"] };
@@ -33,4 +91,26 @@ describe("command-helpers", () => {
 		expect(getArg(args, 0, options)).toBe("-n");
 		expect(getArg(args, 1, options)).toBe("hello");
 	});
+
+	test("getArg -- blocks all flag processing", () => {
+		const args = ["-a", "--", "-a", "-b", "-c"];
+		const options = { flags: ["-a", "-b", "-c"] };
+
+		expect(getArg(args, 0, options)).toBe("-a");
+		expect(getArg(args, 1, options)).toBe("-b");
+		expect(getArg(args, 2, options)).toBe("-c");
+	});
+
+	test("getArg with mixed flags and positionals", () => {
+		const args = ["-v", "file1", "-o", "output.txt", "file2"];
+		const options = { flags: ["-v"], flagsWithValue: ["-o"] };
+
+		expect(getArg(args, 0, options)).toBe("file1");
+		expect(getArg(args, 1, options)).toBe("file2");
+	});
+
+	test("getArg at end of args", () => {
+		const args = ["a", "b", "c"];
+		expect(getArg(args, 5, {})).toBeUndefined();
+	});
 });