From 401a74ac1346d16277f5c8e97e899b641adfecff Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 27 Jul 2026 21:23:50 +0000 Subject: [PATCH] Restore compatible brace expansion versions --- dist/cleanup/index.js | 641 ++++++++++++++++++++---------------------- dist/setup/index.js | 641 ++++++++++++++++++++---------------------- package-lock.json | 57 ++++ package.json | 5 +- 4 files changed, 670 insertions(+), 674 deletions(-) diff --git a/dist/cleanup/index.js b/dist/cleanup/index.js index 50117ea1..6e93cdde 100644 --- a/dist/cleanup/index.js +++ b/dist/cleanup/index.js @@ -1,6 +1,291 @@ import { createRequire as __WEBPACK_EXTERNAL_createRequire } from "module"; /******/ var __webpack_modules__ = ({ +/***/ 8638: +/***/ ((module) => { + + +module.exports = balanced; +function balanced(a, b, str) { + if (a instanceof RegExp) a = maybeMatch(a, str); + if (b instanceof RegExp) b = maybeMatch(b, str); + + var r = range(a, b, str); + + return r && { + start: r[0], + end: r[1], + pre: str.slice(0, r[0]), + body: str.slice(r[0] + a.length, r[1]), + post: str.slice(r[1] + b.length) + }; +} + +function maybeMatch(reg, str) { + var m = str.match(reg); + return m ? m[0] : null; +} + +balanced.range = range; +function range(a, b, str) { + var begs, beg, left, right, result; + var ai = str.indexOf(a); + var bi = str.indexOf(b, ai + 1); + var i = ai; + + if (ai >= 0 && bi > 0) { + if(a===b) { + return [ai, bi]; + } + begs = []; + left = str.length; + + while (i >= 0 && !result) { + if (i == ai) { + begs.push(i); + ai = str.indexOf(a, i + 1); + } else if (begs.length == 1) { + result = [ begs.pop(), bi ]; + } else { + beg = begs.pop(); + if (beg < left) { + left = beg; + right = bi; + } + + bi = str.indexOf(b, i + 1); + } + + i = ai < bi && ai >= 0 ? ai : bi; + } + + if (begs.length) { + result = [ left, right ]; + } + } + + return result; +} + + +/***/ }), + +/***/ 6533: +/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { + +var concatMap = __nccwpck_require__(7087); +var balanced = __nccwpck_require__(8638); + +module.exports = expandTop; + +var escSlash = '\0SLASH'+Math.random()+'\0'; +var escOpen = '\0OPEN'+Math.random()+'\0'; +var escClose = '\0CLOSE'+Math.random()+'\0'; +var escComma = '\0COMMA'+Math.random()+'\0'; +var escPeriod = '\0PERIOD'+Math.random()+'\0'; + +function numeric(str) { + return parseInt(str, 10) == str + ? parseInt(str, 10) + : str.charCodeAt(0); +} + +function escapeBraces(str) { + return str.split('\\\\').join(escSlash) + .split('\\{').join(escOpen) + .split('\\}').join(escClose) + .split('\\,').join(escComma) + .split('\\.').join(escPeriod); +} + +function unescapeBraces(str) { + return str.split(escSlash).join('\\') + .split(escOpen).join('{') + .split(escClose).join('}') + .split(escComma).join(',') + .split(escPeriod).join('.'); +} + + +// Basically just str.split(","), but handling cases +// where we have nested braced sections, which should be +// treated as individual members, like {a,{b,c},d} +function parseCommaParts(str) { + if (!str) + return ['']; + + var parts = []; + var m = balanced('{', '}', str); + + if (!m) + return str.split(','); + + var pre = m.pre; + var body = m.body; + var post = m.post; + var p = pre.split(','); + + p[p.length-1] += '{' + body + '}'; + var postParts = parseCommaParts(post); + if (post.length) { + p[p.length-1] += postParts.shift(); + p.push.apply(p, postParts); + } + + parts.push.apply(parts, p); + + return parts; +} + +function expandTop(str, options) { + if (!str) + return []; + + options = options || {}; + var max = options.max == null ? Infinity : options.max; + + // I don't know why Bash 4.3 does this, but it does. + // Anything starting with {} will have the first two bytes preserved + // but *only* at the top level, so {},a}b will not expand to anything, + // but a{},b}c will be expanded to [a}c,abc]. + // One could argue that this is a bug in Bash, but since the goal of + // this module is to match Bash's rules, we escape a leading {} + if (str.substr(0, 2) === '{}') { + str = '\\{\\}' + str.substr(2); + } + + return expand(escapeBraces(str), max, true).map(unescapeBraces); +} + +function identity(e) { + return e; +} + +function embrace(str) { + return '{' + str + '}'; +} +function isPadded(el) { + return /^-?0\d/.test(el); +} + +function lte(i, y) { + return i <= y; +} +function gte(i, y) { + return i >= y; +} + +function expand(str, max, isTop) { + var expansions = []; + + // The `{a},b}` rewrite below restarts expansion on a rewritten string with + // the same `max` and `isTop = true`. Loop instead of recursing so a long run + // of non-expanding `{}` groups can't exhaust the call stack. + for (;;) { + var m = balanced('{', '}', str); + if (!m || /\$$/.test(m.pre)) return [str]; + + var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); + var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); + var isSequence = isNumericSequence || isAlphaSequence; + var isOptions = m.body.indexOf(',') >= 0; + if (!isSequence && !isOptions) { + // {a},b} + if (m.post.match(/,(?!,).*\}/)) { + str = m.pre + '{' + m.body + escClose + m.post; + isTop = true + continue + } + return [str]; + } + + var n; + if (isSequence) { + n = m.body.split(/\.\./); + } else { + n = parseCommaParts(m.body); + if (n.length === 1) { + // x{{a,b}}y ==> x{a}y x{b}y + n = expand(n[0], max, false).map(embrace); + if (n.length === 1) { + var post = m.post.length + ? expand(m.post, max, false) + : ['']; + return post.map(function(p) { + return m.pre + n[0] + p; + }); + } + } + } + + // at this point, n is the parts, and we know it's not a comma set + // with a single entry. + + // no need to expand pre, since it is guaranteed to be free of brace-sets + var pre = m.pre; + var post = m.post.length + ? expand(m.post, max, false) + : ['']; + + var N; + + if (isSequence) { + var x = numeric(n[0]); + var y = numeric(n[1]); + var width = Math.max(n[0].length, n[1].length) + var incr = n.length == 3 + ? Math.max(Math.abs(numeric(n[2])), 1) + : 1; + var test = lte; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte; + } + var pad = n.some(isPadded); + + N = []; + + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === '\\') + c = ''; + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join('0'); + if (i < 0) + c = '-' + z + c.slice(1); + else + c = z + c; + } + } + } + N.push(c); + } + } else { + N = concatMap(n, function(el) { return expand(el, max, false) }); + } + + for (var j = 0; j < N.length; j++) { + for (var k = 0; k < post.length && expansions.length < max; k++) { + var expansion = pre + N[j] + post[k]; + if (!isTop || isSequence || expansion) + expansions.push(expansion); + } + } + + return expansions; + } +} + + +/***/ }), + /***/ 2593: /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { @@ -13,7 +298,7 @@ var path = (function () { try { return __nccwpck_require__(6928) } catch (e) {}} minimatch.sep = path.sep var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {} -var expand = __nccwpck_require__(8968) +var expand = __nccwpck_require__(6533) var plTypes = { '!': { open: '(?:(?!(?:', close: '))[^/]*?)'}, @@ -6164,6 +6449,26 @@ class Agent extends http.Agent { exports.Agent = Agent; //# sourceMappingURL=index.js.map +/***/ }), + +/***/ 7087: +/***/ ((module) => { + +module.exports = function (xs, fn) { + var res = []; + for (var i = 0; i < xs.length; i++) { + var x = fn(xs[i], i); + if (isArray(x)) res.push.apply(res, x); + else res.push(x); + } + return res; +}; + +var isArray = Array.isArray || function (xs) { + return Object.prototype.toString.call(xs) === '[object Array]'; +}; + + /***/ }), /***/ 6110: @@ -38707,340 +39012,6 @@ exports.w = { /***/ }), -/***/ 2649: -/***/ ((__unused_webpack_module, exports) => { - - -Object.defineProperty(exports, "__esModule", ({ value: true })); -exports.range = exports.balanced = void 0; -const balanced = (a, b, str) => { - const ma = a instanceof RegExp ? maybeMatch(a, str) : a; - const mb = b instanceof RegExp ? maybeMatch(b, str) : b; - const r = ma !== null && mb != null && (0, exports.range)(ma, mb, str); - return (r && { - start: r[0], - end: r[1], - pre: str.slice(0, r[0]), - body: str.slice(r[0] + ma.length, r[1]), - post: str.slice(r[1] + mb.length), - }); -}; -exports.balanced = balanced; -const maybeMatch = (reg, str) => { - const m = str.match(reg); - return m ? m[0] : null; -}; -const range = (a, b, str) => { - let begs, beg, left, right = undefined, result; - let ai = str.indexOf(a); - let bi = str.indexOf(b, ai + 1); - let i = ai; - if (ai >= 0 && bi > 0) { - if (a === b) { - return [ai, bi]; - } - begs = []; - left = str.length; - while (i >= 0 && !result) { - if (i === ai) { - begs.push(i); - ai = str.indexOf(a, i + 1); - } - else if (begs.length === 1) { - const r = begs.pop(); - if (r !== undefined) - result = [r, bi]; - } - else { - beg = begs.pop(); - if (beg !== undefined && beg < left) { - left = beg; - right = bi; - } - bi = str.indexOf(b, i + 1); - } - i = ai < bi && ai >= 0 ? ai : bi; - } - if (begs.length && right !== undefined) { - result = [left, right]; - } - } - return result; -}; -exports.range = range; -//# sourceMappingURL=index.js.map - -/***/ }), - -/***/ 8968: -/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { - - -Object.defineProperty(exports, "__esModule", ({ value: true })); -exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0; -exports.expand = expand; -const balanced_match_1 = __nccwpck_require__(2649); -const escSlash = '\0SLASH' + Math.random() + '\0'; -const escOpen = '\0OPEN' + Math.random() + '\0'; -const escClose = '\0CLOSE' + Math.random() + '\0'; -const escComma = '\0COMMA' + Math.random() + '\0'; -const escPeriod = '\0PERIOD' + Math.random() + '\0'; -const escSlashPattern = new RegExp(escSlash, 'g'); -const escOpenPattern = new RegExp(escOpen, 'g'); -const escClosePattern = new RegExp(escClose, 'g'); -const escCommaPattern = new RegExp(escComma, 'g'); -const escPeriodPattern = new RegExp(escPeriod, 'g'); -const slashPattern = /\\\\/g; -const openPattern = /\\{/g; -const closePattern = /\\}/g; -const commaPattern = /\\,/g; -const periodPattern = /\\\./g; -exports.EXPANSION_MAX = 100_000; -// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An -// input like `'{a,b}'.repeat(1500)` stays under that count - its output is -// truncated to 100k results - while making every result ~1500 characters -// long. The result set, and the intermediate arrays built while combining -// brace sets, then grow large enough to exhaust memory and crash the process -// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of -// characters the accumulator may hold at any point, so memory stays flat no -// matter how many brace groups are chained. The limit sits well above any -// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M -// characters) so legitimate input is unaffected. -exports.EXPANSION_MAX_LENGTH = 4_000_000; -function numeric(str) { - return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); -} -function escapeBraces(str) { - return str - .replace(slashPattern, escSlash) - .replace(openPattern, escOpen) - .replace(closePattern, escClose) - .replace(commaPattern, escComma) - .replace(periodPattern, escPeriod); -} -function unescapeBraces(str) { - return str - .replace(escSlashPattern, '\\') - .replace(escOpenPattern, '{') - .replace(escClosePattern, '}') - .replace(escCommaPattern, ',') - .replace(escPeriodPattern, '.'); -} -/** - * Basically just str.split(","), but handling cases - * where we have nested braced sections, which should be - * treated as individual members, like {a,{b,c},d} - */ -function parseCommaParts(str) { - if (!str) { - return ['']; - } - const parts = []; - const m = (0, balanced_match_1.balanced)('{', '}', str); - if (!m) { - return str.split(','); - } - const { pre, body, post } = m; - const p = pre.split(','); - p[p.length - 1] += '{' + body + '}'; - const postParts = parseCommaParts(post); - if (post.length) { - ; - p[p.length - 1] += postParts.shift(); - p.push.apply(p, postParts); - } - parts.push.apply(parts, p); - return parts; -} -function expand(str, options = {}) { - if (!str) { - return []; - } - const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options; - // I don't know why Bash 4.3 does this, but it does. - // Anything starting with {} will have the first two bytes preserved - // but *only* at the top level, so {},a}b will not expand to anything, - // but a{},b}c will be expanded to [a}c,abc]. - // One could argue that this is a bug in Bash, but since the goal of - // this module is to match Bash's rules, we escape a leading {} - if (str.slice(0, 2) === '{}') { - str = '\\{\\}' + str.slice(2); - } - return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); -} -function embrace(str) { - return '{' + str + '}'; -} -function isPadded(el) { - return /^-?0\d/.test(el); -} -function lte(i, y) { - return i <= y; -} -function gte(i, y) { - return i >= y; -} -// Build `{ acc[a] + pre + values[v] }` for every combination, capping the -// number of results at `max` and the total number of characters at `maxLength`. -// This is the one place output grows, so bounding it here keeps the single -// accumulator - and therefore memory - flat regardless of how many brace groups -// are combined (CVE-2026-14257). -function combine(acc, pre, values, max, maxLength, dropEmpties) { - const out = []; - let length = 0; - for (let a = 0; a < acc.length; a++) { - for (let v = 0; v < values.length; v++) { - if (out.length >= max) - return out; - const expansion = acc[a] + pre + values[v]; - // Bash drops empty results at the top level. Skip them before they count - // against `max`, so `max` bounds the number of *kept* results. - if (dropEmpties && !expansion) - continue; - if (length + expansion.length > maxLength) - return out; - out.push(expansion); - length += expansion.length; - } - } - return out; -} -// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`) -// sequence body. -function expandSequence(body, isAlphaSequence, max) { - const n = body.split(/\.\./); - const N = []; - // A sequence body always splits into two or three parts, but the compiler - // can't know that. - /* c8 ignore start */ - if (n[0] === undefined || n[1] === undefined) { - return N; - } - /* c8 ignore stop */ - const x = numeric(n[0]); - const y = numeric(n[1]); - const width = Math.max(n[0].length, n[1].length); - let incr = n.length === 3 && n[2] !== undefined ? - Math.max(Math.abs(numeric(n[2])), 1) - : 1; - let test = lte; - const reverse = y < x; - if (reverse) { - incr *= -1; - test = gte; - } - const pad = n.some(isPadded); - for (let i = x; test(i, y) && N.length < max; i += incr) { - let c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === '\\') { - c = ''; - } - } - else { - c = String(i); - if (pad) { - const need = width - c.length; - if (need > 0) { - const z = new Array(need + 1).join('0'); - if (i < 0) { - c = '-' + z + c.slice(1); - } - else { - c = z + c; - } - } - } - } - N.push(c); - } - return N; -} -function expand_(str, max, maxLength, isTop) { - // Consume the string's top-level brace groups left to right, threading a - // running set of combined prefixes (`acc`). Expanding the tail iteratively - - // rather than recursing on `m.post` once per group - keeps the native stack - // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no - // longer overflow the stack, and leaves a single accumulator whose size - // `maxLength` bounds directly (CVE-2026-14257). - let acc = ['']; - // Bash drops empty results, but only when the *first* top-level group is a - // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop - // is on the final strings, so it is applied to whichever `combine` produces - // them (the one with no brace set left in the tail). - let dropEmpties = false; - let firstGroup = true; - for (;;) { - const m = (0, balanced_match_1.balanced)('{', '}', str); - // No brace set left: the rest of the string is literal. - if (!m) { - return combine(acc, str, [''], max, maxLength, dropEmpties); - } - // no need to expand pre, since it is guaranteed to be free of brace-sets - const pre = m.pre; - if (/\$$/.test(pre)) { - acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length); - firstGroup = false; - if (!m.post.length) - break; - str = m.post; - continue; - } - const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); - const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); - const isSequence = isNumericSequence || isAlphaSequence; - const isOptions = m.body.indexOf(',') >= 0; - if (!isSequence && !isOptions) { - // {a},b} - if (m.post.match(/,(?!,).*\}/)) { - str = m.pre + '{' + m.body + escClose + m.post; - isTop = true; - continue; - } - // Nothing here expands, so the whole remaining string is literal. - return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties); - } - if (firstGroup) { - dropEmpties = isTop && !isSequence; - firstGroup = false; - } - let values; - if (isSequence) { - values = expandSequence(m.body, isAlphaSequence, max); - } - else { - let n = parseCommaParts(m.body); - if (n.length === 1 && n[0] !== undefined) { - // x{{a,b}}y ==> x{a}y x{b}y - n = expand_(n[0], max, maxLength, false).map(embrace); - //XXX is this necessary? Can't seem to hit it in tests. - /* c8 ignore start */ - if (n.length === 1) { - acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length); - if (!m.post.length) - break; - str = m.post; - continue; - } - /* c8 ignore stop */ - } - values = []; - for (let j = 0; j < n.length; j++) { - values.push.apply(values, expand_(n[j], max, maxLength, false)); - } - } - acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); - if (!m.post.length) - break; - str = m.post; - } - return acc; -} -//# sourceMappingURL=index.js.map - -/***/ }), - /***/ 8658: /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { diff --git a/dist/setup/index.js b/dist/setup/index.js index 6a54d1ed..d351f277 100644 --- a/dist/setup/index.js +++ b/dist/setup/index.js @@ -1,6 +1,291 @@ import { createRequire as __WEBPACK_EXTERNAL_createRequire } from "module"; /******/ var __webpack_modules__ = ({ +/***/ 8638: +/***/ ((module) => { + + +module.exports = balanced; +function balanced(a, b, str) { + if (a instanceof RegExp) a = maybeMatch(a, str); + if (b instanceof RegExp) b = maybeMatch(b, str); + + var r = range(a, b, str); + + return r && { + start: r[0], + end: r[1], + pre: str.slice(0, r[0]), + body: str.slice(r[0] + a.length, r[1]), + post: str.slice(r[1] + b.length) + }; +} + +function maybeMatch(reg, str) { + var m = str.match(reg); + return m ? m[0] : null; +} + +balanced.range = range; +function range(a, b, str) { + var begs, beg, left, right, result; + var ai = str.indexOf(a); + var bi = str.indexOf(b, ai + 1); + var i = ai; + + if (ai >= 0 && bi > 0) { + if(a===b) { + return [ai, bi]; + } + begs = []; + left = str.length; + + while (i >= 0 && !result) { + if (i == ai) { + begs.push(i); + ai = str.indexOf(a, i + 1); + } else if (begs.length == 1) { + result = [ begs.pop(), bi ]; + } else { + beg = begs.pop(); + if (beg < left) { + left = beg; + right = bi; + } + + bi = str.indexOf(b, i + 1); + } + + i = ai < bi && ai >= 0 ? ai : bi; + } + + if (begs.length) { + result = [ left, right ]; + } + } + + return result; +} + + +/***/ }), + +/***/ 6533: +/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { + +var concatMap = __nccwpck_require__(7087); +var balanced = __nccwpck_require__(8638); + +module.exports = expandTop; + +var escSlash = '\0SLASH'+Math.random()+'\0'; +var escOpen = '\0OPEN'+Math.random()+'\0'; +var escClose = '\0CLOSE'+Math.random()+'\0'; +var escComma = '\0COMMA'+Math.random()+'\0'; +var escPeriod = '\0PERIOD'+Math.random()+'\0'; + +function numeric(str) { + return parseInt(str, 10) == str + ? parseInt(str, 10) + : str.charCodeAt(0); +} + +function escapeBraces(str) { + return str.split('\\\\').join(escSlash) + .split('\\{').join(escOpen) + .split('\\}').join(escClose) + .split('\\,').join(escComma) + .split('\\.').join(escPeriod); +} + +function unescapeBraces(str) { + return str.split(escSlash).join('\\') + .split(escOpen).join('{') + .split(escClose).join('}') + .split(escComma).join(',') + .split(escPeriod).join('.'); +} + + +// Basically just str.split(","), but handling cases +// where we have nested braced sections, which should be +// treated as individual members, like {a,{b,c},d} +function parseCommaParts(str) { + if (!str) + return ['']; + + var parts = []; + var m = balanced('{', '}', str); + + if (!m) + return str.split(','); + + var pre = m.pre; + var body = m.body; + var post = m.post; + var p = pre.split(','); + + p[p.length-1] += '{' + body + '}'; + var postParts = parseCommaParts(post); + if (post.length) { + p[p.length-1] += postParts.shift(); + p.push.apply(p, postParts); + } + + parts.push.apply(parts, p); + + return parts; +} + +function expandTop(str, options) { + if (!str) + return []; + + options = options || {}; + var max = options.max == null ? Infinity : options.max; + + // I don't know why Bash 4.3 does this, but it does. + // Anything starting with {} will have the first two bytes preserved + // but *only* at the top level, so {},a}b will not expand to anything, + // but a{},b}c will be expanded to [a}c,abc]. + // One could argue that this is a bug in Bash, but since the goal of + // this module is to match Bash's rules, we escape a leading {} + if (str.substr(0, 2) === '{}') { + str = '\\{\\}' + str.substr(2); + } + + return expand(escapeBraces(str), max, true).map(unescapeBraces); +} + +function identity(e) { + return e; +} + +function embrace(str) { + return '{' + str + '}'; +} +function isPadded(el) { + return /^-?0\d/.test(el); +} + +function lte(i, y) { + return i <= y; +} +function gte(i, y) { + return i >= y; +} + +function expand(str, max, isTop) { + var expansions = []; + + // The `{a},b}` rewrite below restarts expansion on a rewritten string with + // the same `max` and `isTop = true`. Loop instead of recursing so a long run + // of non-expanding `{}` groups can't exhaust the call stack. + for (;;) { + var m = balanced('{', '}', str); + if (!m || /\$$/.test(m.pre)) return [str]; + + var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); + var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); + var isSequence = isNumericSequence || isAlphaSequence; + var isOptions = m.body.indexOf(',') >= 0; + if (!isSequence && !isOptions) { + // {a},b} + if (m.post.match(/,(?!,).*\}/)) { + str = m.pre + '{' + m.body + escClose + m.post; + isTop = true + continue + } + return [str]; + } + + var n; + if (isSequence) { + n = m.body.split(/\.\./); + } else { + n = parseCommaParts(m.body); + if (n.length === 1) { + // x{{a,b}}y ==> x{a}y x{b}y + n = expand(n[0], max, false).map(embrace); + if (n.length === 1) { + var post = m.post.length + ? expand(m.post, max, false) + : ['']; + return post.map(function(p) { + return m.pre + n[0] + p; + }); + } + } + } + + // at this point, n is the parts, and we know it's not a comma set + // with a single entry. + + // no need to expand pre, since it is guaranteed to be free of brace-sets + var pre = m.pre; + var post = m.post.length + ? expand(m.post, max, false) + : ['']; + + var N; + + if (isSequence) { + var x = numeric(n[0]); + var y = numeric(n[1]); + var width = Math.max(n[0].length, n[1].length) + var incr = n.length == 3 + ? Math.max(Math.abs(numeric(n[2])), 1) + : 1; + var test = lte; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte; + } + var pad = n.some(isPadded); + + N = []; + + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === '\\') + c = ''; + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join('0'); + if (i < 0) + c = '-' + z + c.slice(1); + else + c = z + c; + } + } + } + N.push(c); + } + } else { + N = concatMap(n, function(el) { return expand(el, max, false) }); + } + + for (var j = 0; j < N.length; j++) { + for (var k = 0; k < post.length && expansions.length < max; k++) { + var expansion = pre + N[j] + post[k]; + if (!isTop || isSequence || expansion) + expansions.push(expansion); + } + } + + return expansions; + } +} + + +/***/ }), + /***/ 2593: /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { @@ -13,7 +298,7 @@ var path = (function () { try { return __nccwpck_require__(6928) } catch (e) {}} minimatch.sep = path.sep var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {} -var expand = __nccwpck_require__(8968) +var expand = __nccwpck_require__(6533) var plTypes = { '!': { open: '(?:(?!(?:', close: '))[^/]*?)'}, @@ -27668,6 +27953,26 @@ class Agent extends http.Agent { exports.Agent = Agent; //# sourceMappingURL=index.js.map +/***/ }), + +/***/ 7087: +/***/ ((module) => { + +module.exports = function (xs, fn) { + var res = []; + for (var i = 0; i < xs.length; i++) { + var x = fn(xs[i], i); + if (isArray(x)) res.push.apply(res, x); + else res.push(x); + } + return res; +}; + +var isArray = Array.isArray || function (xs) { + return Object.prototype.toString.call(xs) === '[object Array]'; +}; + + /***/ }), /***/ 6110: @@ -64270,340 +64575,6 @@ exports.w = { /***/ }), -/***/ 2649: -/***/ ((__unused_webpack_module, exports) => { - - -Object.defineProperty(exports, "__esModule", ({ value: true })); -exports.range = exports.balanced = void 0; -const balanced = (a, b, str) => { - const ma = a instanceof RegExp ? maybeMatch(a, str) : a; - const mb = b instanceof RegExp ? maybeMatch(b, str) : b; - const r = ma !== null && mb != null && (0, exports.range)(ma, mb, str); - return (r && { - start: r[0], - end: r[1], - pre: str.slice(0, r[0]), - body: str.slice(r[0] + ma.length, r[1]), - post: str.slice(r[1] + mb.length), - }); -}; -exports.balanced = balanced; -const maybeMatch = (reg, str) => { - const m = str.match(reg); - return m ? m[0] : null; -}; -const range = (a, b, str) => { - let begs, beg, left, right = undefined, result; - let ai = str.indexOf(a); - let bi = str.indexOf(b, ai + 1); - let i = ai; - if (ai >= 0 && bi > 0) { - if (a === b) { - return [ai, bi]; - } - begs = []; - left = str.length; - while (i >= 0 && !result) { - if (i === ai) { - begs.push(i); - ai = str.indexOf(a, i + 1); - } - else if (begs.length === 1) { - const r = begs.pop(); - if (r !== undefined) - result = [r, bi]; - } - else { - beg = begs.pop(); - if (beg !== undefined && beg < left) { - left = beg; - right = bi; - } - bi = str.indexOf(b, i + 1); - } - i = ai < bi && ai >= 0 ? ai : bi; - } - if (begs.length && right !== undefined) { - result = [left, right]; - } - } - return result; -}; -exports.range = range; -//# sourceMappingURL=index.js.map - -/***/ }), - -/***/ 8968: -/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { - - -Object.defineProperty(exports, "__esModule", ({ value: true })); -exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0; -exports.expand = expand; -const balanced_match_1 = __nccwpck_require__(2649); -const escSlash = '\0SLASH' + Math.random() + '\0'; -const escOpen = '\0OPEN' + Math.random() + '\0'; -const escClose = '\0CLOSE' + Math.random() + '\0'; -const escComma = '\0COMMA' + Math.random() + '\0'; -const escPeriod = '\0PERIOD' + Math.random() + '\0'; -const escSlashPattern = new RegExp(escSlash, 'g'); -const escOpenPattern = new RegExp(escOpen, 'g'); -const escClosePattern = new RegExp(escClose, 'g'); -const escCommaPattern = new RegExp(escComma, 'g'); -const escPeriodPattern = new RegExp(escPeriod, 'g'); -const slashPattern = /\\\\/g; -const openPattern = /\\{/g; -const closePattern = /\\}/g; -const commaPattern = /\\,/g; -const periodPattern = /\\\./g; -exports.EXPANSION_MAX = 100_000; -// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An -// input like `'{a,b}'.repeat(1500)` stays under that count - its output is -// truncated to 100k results - while making every result ~1500 characters -// long. The result set, and the intermediate arrays built while combining -// brace sets, then grow large enough to exhaust memory and crash the process -// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of -// characters the accumulator may hold at any point, so memory stays flat no -// matter how many brace groups are chained. The limit sits well above any -// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M -// characters) so legitimate input is unaffected. -exports.EXPANSION_MAX_LENGTH = 4_000_000; -function numeric(str) { - return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); -} -function escapeBraces(str) { - return str - .replace(slashPattern, escSlash) - .replace(openPattern, escOpen) - .replace(closePattern, escClose) - .replace(commaPattern, escComma) - .replace(periodPattern, escPeriod); -} -function unescapeBraces(str) { - return str - .replace(escSlashPattern, '\\') - .replace(escOpenPattern, '{') - .replace(escClosePattern, '}') - .replace(escCommaPattern, ',') - .replace(escPeriodPattern, '.'); -} -/** - * Basically just str.split(","), but handling cases - * where we have nested braced sections, which should be - * treated as individual members, like {a,{b,c},d} - */ -function parseCommaParts(str) { - if (!str) { - return ['']; - } - const parts = []; - const m = (0, balanced_match_1.balanced)('{', '}', str); - if (!m) { - return str.split(','); - } - const { pre, body, post } = m; - const p = pre.split(','); - p[p.length - 1] += '{' + body + '}'; - const postParts = parseCommaParts(post); - if (post.length) { - ; - p[p.length - 1] += postParts.shift(); - p.push.apply(p, postParts); - } - parts.push.apply(parts, p); - return parts; -} -function expand(str, options = {}) { - if (!str) { - return []; - } - const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options; - // I don't know why Bash 4.3 does this, but it does. - // Anything starting with {} will have the first two bytes preserved - // but *only* at the top level, so {},a}b will not expand to anything, - // but a{},b}c will be expanded to [a}c,abc]. - // One could argue that this is a bug in Bash, but since the goal of - // this module is to match Bash's rules, we escape a leading {} - if (str.slice(0, 2) === '{}') { - str = '\\{\\}' + str.slice(2); - } - return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); -} -function embrace(str) { - return '{' + str + '}'; -} -function isPadded(el) { - return /^-?0\d/.test(el); -} -function lte(i, y) { - return i <= y; -} -function gte(i, y) { - return i >= y; -} -// Build `{ acc[a] + pre + values[v] }` for every combination, capping the -// number of results at `max` and the total number of characters at `maxLength`. -// This is the one place output grows, so bounding it here keeps the single -// accumulator - and therefore memory - flat regardless of how many brace groups -// are combined (CVE-2026-14257). -function combine(acc, pre, values, max, maxLength, dropEmpties) { - const out = []; - let length = 0; - for (let a = 0; a < acc.length; a++) { - for (let v = 0; v < values.length; v++) { - if (out.length >= max) - return out; - const expansion = acc[a] + pre + values[v]; - // Bash drops empty results at the top level. Skip them before they count - // against `max`, so `max` bounds the number of *kept* results. - if (dropEmpties && !expansion) - continue; - if (length + expansion.length > maxLength) - return out; - out.push(expansion); - length += expansion.length; - } - } - return out; -} -// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`) -// sequence body. -function expandSequence(body, isAlphaSequence, max) { - const n = body.split(/\.\./); - const N = []; - // A sequence body always splits into two or three parts, but the compiler - // can't know that. - /* c8 ignore start */ - if (n[0] === undefined || n[1] === undefined) { - return N; - } - /* c8 ignore stop */ - const x = numeric(n[0]); - const y = numeric(n[1]); - const width = Math.max(n[0].length, n[1].length); - let incr = n.length === 3 && n[2] !== undefined ? - Math.max(Math.abs(numeric(n[2])), 1) - : 1; - let test = lte; - const reverse = y < x; - if (reverse) { - incr *= -1; - test = gte; - } - const pad = n.some(isPadded); - for (let i = x; test(i, y) && N.length < max; i += incr) { - let c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === '\\') { - c = ''; - } - } - else { - c = String(i); - if (pad) { - const need = width - c.length; - if (need > 0) { - const z = new Array(need + 1).join('0'); - if (i < 0) { - c = '-' + z + c.slice(1); - } - else { - c = z + c; - } - } - } - } - N.push(c); - } - return N; -} -function expand_(str, max, maxLength, isTop) { - // Consume the string's top-level brace groups left to right, threading a - // running set of combined prefixes (`acc`). Expanding the tail iteratively - - // rather than recursing on `m.post` once per group - keeps the native stack - // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no - // longer overflow the stack, and leaves a single accumulator whose size - // `maxLength` bounds directly (CVE-2026-14257). - let acc = ['']; - // Bash drops empty results, but only when the *first* top-level group is a - // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop - // is on the final strings, so it is applied to whichever `combine` produces - // them (the one with no brace set left in the tail). - let dropEmpties = false; - let firstGroup = true; - for (;;) { - const m = (0, balanced_match_1.balanced)('{', '}', str); - // No brace set left: the rest of the string is literal. - if (!m) { - return combine(acc, str, [''], max, maxLength, dropEmpties); - } - // no need to expand pre, since it is guaranteed to be free of brace-sets - const pre = m.pre; - if (/\$$/.test(pre)) { - acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length); - firstGroup = false; - if (!m.post.length) - break; - str = m.post; - continue; - } - const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); - const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); - const isSequence = isNumericSequence || isAlphaSequence; - const isOptions = m.body.indexOf(',') >= 0; - if (!isSequence && !isOptions) { - // {a},b} - if (m.post.match(/,(?!,).*\}/)) { - str = m.pre + '{' + m.body + escClose + m.post; - isTop = true; - continue; - } - // Nothing here expands, so the whole remaining string is literal. - return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties); - } - if (firstGroup) { - dropEmpties = isTop && !isSequence; - firstGroup = false; - } - let values; - if (isSequence) { - values = expandSequence(m.body, isAlphaSequence, max); - } - else { - let n = parseCommaParts(m.body); - if (n.length === 1 && n[0] !== undefined) { - // x{{a,b}}y ==> x{a}y x{b}y - n = expand_(n[0], max, maxLength, false).map(embrace); - //XXX is this necessary? Can't seem to hit it in tests. - /* c8 ignore start */ - if (n.length === 1) { - acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length); - if (!m.post.length) - break; - str = m.post; - continue; - } - /* c8 ignore stop */ - } - values = []; - for (let j = 0; j < n.length; j++) { - values.push.apply(values, expand_(n[j], max, maxLength, false)); - } - } - acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); - if (!m.post.length) - break; - str = m.post; - } - return acc; -} -//# sourceMappingURL=index.js.map - -/***/ }), - /***/ 9373: /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { diff --git a/package-lock.json b/package-lock.json index 3f71f07d..c8473e39 100644 --- a/package-lock.json +++ b/package-lock.json @@ -70,6 +70,22 @@ "minimatch": "^3.0.4" } }, + "node_modules/@actions/cache/node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "license": "MIT" + }, + "node_modules/@actions/cache/node_modules/brace-expansion": { + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, "node_modules/@actions/cache/node_modules/minimatch": { "version": "3.1.5", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", @@ -3186,6 +3202,12 @@ "dev": true, "license": "MIT" }, + "node_modules/concat-map": { + "version": "0.0.1", + "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", + "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", + "license": "MIT" + }, "node_modules/convert-source-map": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz", @@ -4202,6 +4224,23 @@ "node": ">=10.13.0" } }, + "node_modules/glob/node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "dev": true, + "license": "MIT" + }, + "node_modules/glob/node_modules/brace-expansion": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0" + } + }, "node_modules/glob/node_modules/minimatch": { "version": "9.0.9", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", @@ -6265,6 +6304,24 @@ "node": ">=8" } }, + "node_modules/test-exclude/node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "dev": true, + "license": "MIT" + }, + "node_modules/test-exclude/node_modules/brace-expansion": { + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, "node_modules/test-exclude/node_modules/glob": { "version": "7.2.3", "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz", diff --git a/package.json b/package.json index 29b311ea..99f83283 100644 --- a/package.json +++ b/package.json @@ -75,8 +75,5 @@ "bugs": { "url": "https://github.com/actions/setup-java/issues" }, - "homepage": "https://github.com/actions/setup-java#readme", - "overrides": { - "brace-expansion": "5.0.8" - } + "homepage": "https://github.com/actions/setup-java#readme" }