pax_global_header00006660000000000000000000000064152520667300014520gustar00rootroot0000000000000052 comment=714b6228a5878cfc6b07dc319db0eb6376ab2c4d juliangruber-brace-expansion-8c777ef/000077500000000000000000000000001525206673000177215ustar00rootroot00000000000000juliangruber-brace-expansion-8c777ef/.github/000077500000000000000000000000001525206673000212615ustar00rootroot00000000000000juliangruber-brace-expansion-8c777ef/.github/FUNDING.yml000066400000000000000000000000661525206673000231000ustar00rootroot00000000000000tidelift: "npm/brace-expansion" patreon: juliangruber juliangruber-brace-expansion-8c777ef/.gitignore000066400000000000000000000000231525206673000217040ustar00rootroot00000000000000node_modules *.sw* juliangruber-brace-expansion-8c777ef/.npmignore000066400000000000000000000000721525206673000217170ustar00rootroot00000000000000test .gitignore .travis.yml example.js .npmignore .claude juliangruber-brace-expansion-8c777ef/.travis.yml000066400000000000000000000001341525206673000220300ustar00rootroot00000000000000sudo: false arch: - amd64 - ppc64le language: node_js node_js: - "10" - "12" - "14" juliangruber-brace-expansion-8c777ef/LICENSE000066400000000000000000000021101525206673000207200ustar00rootroot00000000000000MIT License Copyright (c) 2013 Julian Gruber Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. juliangruber-brace-expansion-8c777ef/README.md000066400000000000000000000114421525206673000212020ustar00rootroot00000000000000# brace-expansion [Brace expansion](https://www.gnu.org/software/bash/manual/html_node/Brace-Expansion.html), as known from sh/bash, in JavaScript. [![build status](https://secure.travis-ci.org/juliangruber/brace-expansion.svg)](http://travis-ci.org/juliangruber/brace-expansion) [![downloads](https://img.shields.io/npm/dm/brace-expansion.svg)](https://www.npmjs.org/package/brace-expansion) [![Greenkeeper badge](https://badges.greenkeeper.io/juliangruber/brace-expansion.svg)](https://greenkeeper.io/) [![testling badge](https://ci.testling.com/juliangruber/brace-expansion.png)](https://ci.testling.com/juliangruber/brace-expansion) ## Example ```js var expand = require('brace-expansion'); expand('file-{a,b,c}.jpg') // => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg'] expand('-v{,,}') // => ['-v', '-v', '-v'] expand('file{0..2}.jpg') // => ['file0.jpg', 'file1.jpg', 'file2.jpg'] expand('file-{a..c}.jpg') // => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg'] expand('file{2..0}.jpg') // => ['file2.jpg', 'file1.jpg', 'file0.jpg'] expand('file{0..4..2}.jpg') // => ['file0.jpg', 'file2.jpg', 'file4.jpg'] expand('file-{a..e..2}.jpg') // => ['file-a.jpg', 'file-c.jpg', 'file-e.jpg'] expand('file{00..10..5}.jpg') // => ['file00.jpg', 'file05.jpg', 'file10.jpg'] expand('{{A..C},{a..c}}') // => ['A', 'B', 'C', 'a', 'b', 'c'] expand('ppp{,config,oe{,conf}}') // => ['ppp', 'pppconfig', 'pppoe', 'pppoeconf'] ``` ## API ```js var expand = require('brace-expansion'); ``` ### var expanded = expand(str, [options]) Return an array of all possible and valid expansions of `str`. If none are found, `[str]` is returned. The `options` object can provide a `max` value to cap the number of expansions allowed. This is limited to `100_000` by default, to prevent DoS attacks. ```js const expansions = expand('{1..100}'.repeat(5), { max: 100, }) // expansions.length will be 100, not 100^5 ``` The `options` object can also provide a `maxLength` value to cap the total number of characters across all expansions. This is limited to `4_000_000` by default, to prevent memory exhaustion from inputs whose result count stays under `max` while each result grows very long. ```js const expansions = expand('{a,b}'.repeat(1500), { maxLength: 10_000, }) ``` Valid expansions are: ```js /^(.*,)+(.+)?$/ // {a,b,...} ``` A comma separated list of options, like `{a,b}` or `{a,{b,c}}` or `{,a,}`. ```js /^-?\d+\.\.-?\d+(\.\.-?\d+)?$/ // {x..y[..incr]} ``` A numeric sequence from `x` to `y` inclusive, with optional increment. If `x` or `y` start with a leading `0`, all the numbers will be padded to have equal length. Negative numbers and backwards iteration work too. ```js /^-?\d+\.\.-?\d+(\.\.-?\d+)?$/ // {x..y[..incr]} ``` An alphabetic sequence from `x` to `y` inclusive, with optional increment. `x` and `y` must be exactly one character, and if given, `incr` must be a number. For compatibility reasons, the string `${` is not eligible for brace expansion. ## Installation With [npm](https://npmjs.org) do: ```bash npm install brace-expansion ``` ## Contributors - [Julian Gruber](https://github.com/juliangruber) - [Isaac Z. Schlueter](https://github.com/isaacs) ## Sponsors This module is proudly supported by my [Sponsors](https://github.com/juliangruber/sponsors)! Do you want to support modules like this to improve their quality, stability and weigh in on new features? Then please consider donating to my [Patreon](https://www.patreon.com/juliangruber). Not sure how much of my modules you're using? Try [feross/thanks](https://github.com/feross/thanks)! ## Security contact information To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure. ## License (MIT) Copyright (c) 2013 Julian Gruber <julian@juliangruber.com> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. juliangruber-brace-expansion-8c777ef/example.js000066400000000000000000000006161525206673000217150ustar00rootroot00000000000000var expand = require('./'); console.log(expand('http://any.org/archive{1996..1999}/vol{1..4}/part{a,b,c}.html')); console.log(expand('http://www.numericals.com/file{1..100..10}.txt')); console.log(expand('http://www.letters.com/file{a..z..2}.txt')); console.log(expand('mkdir /usr/local/src/bash/{old,new,dist,bugs}')); console.log(expand('chown root /usr/{ucb/{ex,edit},lib/{ex?.?*,how_ex}}')); juliangruber-brace-expansion-8c777ef/index.js000066400000000000000000000301471525206673000213730ustar00rootroot00000000000000var balanced = require('balanced-match'); module.exports = expandTop; var escSlash = '\0SLASH'+Math.random()+'\0'; var escOpen = '\0OPEN'+Math.random()+'\0'; var escClose = '\0CLOSE'+Math.random()+'\0'; var escComma = '\0COMMA'+Math.random()+'\0'; var escPeriod = '\0PERIOD'+Math.random()+'\0'; var EXPANSION_MAX = 100000 // `EXPANSION_MAX` caps the *number* of expansions, but not their length. An // input like `'{a,b}'.repeat(1500)` stays under that count - its output is // truncated to 100k results - while making every result ~1500 characters // long. The result set, and the intermediate arrays built while combining // brace sets, then grow large enough to exhaust memory and crash the process // (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of // characters the accumulator may hold at any point, so memory stays flat no // matter how many brace groups are chained. The limit sits well above any // realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M // characters) so legitimate input is unaffected. var EXPANSION_MAX_LENGTH = 4000000 // `expand` recurses once per level of brace *nesting* - both when expanding a // set's comma members and when re-wrapping a set whose body is a single part. // The CVE-2026-14257 fix made the *tail* iterative (recursion on `m.post`, one // level per chained group), which left nesting depth unbounded: about 3,100 // levels of `{{{...a,b...}}}` - only ~6KB of input - exhausted the native stack // and crashed the process. `EXPANSION_MAX_DEPTH` bounds how deep the parser // will follow nesting. It sits far above any realistic pattern and well below // the depth at which the stack runs out. var EXPANSION_MAX_DEPTH = 1000 // Bash keeps a quirk where a brace group followed by a comma set still expands // (`{a},b}`). The parser implements it by rewriting the string and restarting // the scan, absorbing one `}` per pass. `n` trailing braces therefore cost `n` // full passes over a string that itself grows by one `escClose` sentinel each // time - quadratic in `n`, with a ~26x constant from the sentinel's length. // 128KB of `'{a}' + '}'.repeat(n) + ',z}'` blocked the event loop for 27 // seconds to produce two results. `EXPANSION_MAX_REWRITES` bounds how many // times the scan may restart. Real `{a},b}` input needs a handful. var EXPANSION_MAX_REWRITES = 1000 function numeric(str) { return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0); } function escapeBraces(str) { return str.split('\\\\').join(escSlash) .split('\\{').join(escOpen) .split('\\}').join(escClose) .split('\\,').join(escComma) .split('\\.').join(escPeriod); } function unescapeBraces(str) { return str.split(escSlash).join('\\') .split(escOpen).join('{') .split(escClose).join('}') .split(escComma).join(',') .split(escPeriod).join('.'); } // Like `target.push(...items)` but doesn't overflow the stack function pushAll(target, items) { for (var i = 0; i < items.length; i++) { target.push(items[i]); } } // Basically just str.split(","), but handling cases // where we have nested braced sections, which should be // treated as individual members, like {a,{b,c},d} function parseCommaParts(str) { var parts = []; // Walk the brace groups iteratively. Recursing on `post` once per group let a // chain of them exhaust the stack - the parsing-side counterpart to // the `expand` overflow fixed for CVE-2026-14257, and not something `max` or // `maxLength` can bound, since it happens before expansion. // // The part the next chunk continues var carry = ''; for (;;) { var m = balanced('{', '}', str); if (!m) { var tail = str.split(','); tail[0] = carry + tail[0]; pushAll(parts, tail); return parts; } var pre = m.pre; var body = m.body; var post = m.post; var p = pre.split(','); p[0] = carry + p[0]; p[p.length-1] += '{' + body + '}'; if (!post.length) { pushAll(parts, p); return parts; } carry = p.pop(); pushAll(parts, p); str = post; } } function expandTop(str, options) { if (!str) return []; options = options || {}; var max = options.max == null ? EXPANSION_MAX : options.max; var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH : options.maxLength; var maxDepth = options.maxDepth == null ? EXPANSION_MAX_DEPTH : options.maxDepth; var maxRewrites = options.maxRewrites == null ? EXPANSION_MAX_REWRITES : options.maxRewrites; // I don't know why Bash 4.3 does this, but it does. // Anything starting with {} will have the first two bytes preserved // but *only* at the top level, so {},a}b will not expand to anything, // but a{},b}c will be expanded to [a}c,abc]. // One could argue that this is a bug in Bash, but since the goal of // this module is to match Bash's rules, we escape a leading {} if (str.substr(0, 2) === '{}') { str = '\\{\\}' + str.substr(2); } return expand(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces); } function embrace(str) { return '{' + str + '}'; } function isPadded(el) { return /^-?0\d/.test(el); } function lte(i, y) { return i <= y; } function gte(i, y) { return i >= y; } // Build `{ acc[a] + pre + values[v] }` for every combination, capping the // number of results at `max` and the total number of characters at `maxLength`. // This is the one place output grows, so bounding it here keeps the single // accumulator - and therefore memory - flat regardless of how many brace groups // are combined (CVE-2026-14257). function combine( acc, pre, values, max, maxLength, dropEmpties ) { var out = [] var length = 0 for (var a = 0; a < acc.length; a++) { for (var v = 0; v < values.length; v++) { if (out.length >= max) return out var expansion = acc[a] + pre + values[v] // Bash drops empty results at the top level. Skip them before they count // against `max`, so `max` bounds the number of *kept* results. if (dropEmpties && !expansion) continue if (length + expansion.length > maxLength) return out out.push(expansion) length += expansion.length } } return out } // The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`) // sequence body. function expandSequence( body, isAlphaSequence, max, maxLength ) { var n = body.split(/\.\./) var N = [] // A sequence body always splits into two or three parts, but the compiler // can't know that. /* c8 ignore start */ if (n[0] === undefined || n[1] === undefined) { return N } /* c8 ignore stop */ var x = numeric(n[0]) var y = numeric(n[1]) var width = Math.max(n[0].length, n[1].length) var incr = n.length === 3 && n[2] !== undefined ? Math.max(Math.abs(numeric(n[2])), 1) : 1 var test = lte var reverse = y < x if (reverse) { incr *= -1 test = gte } var pad = n.some(isPadded) var length = 0 for (var i = x; test(i, y) && N.length < max; i += incr) { var c if (isAlphaSequence) { c = String.fromCharCode(i) if (c === '\\') { c = '' } } else { c = String(i) if (pad) { var need = width - c.length if (need > 0) { var z = new Array(need + 1).join('0') if (i < 0) { c = '-' + z + c.slice(1) } else { c = z + c } } } } if (length + c.length > maxLength) break N.push(c) length += c.length } return N } function expand( str, max, maxLength, maxDepth, depth, maxRewrites, isTop ) { // Too deeply nested to keep following: treat the rest as literal, the same // way a group that cannot expand is already handled. Truncating rather than // throwing keeps expansion total, matching `max` and `maxLength`. if (depth > maxDepth) { return [str]; } // Consume the string's top-level brace groups left to right, threading a // running set of combined prefixes (`acc`). Expanding the tail iteratively - // rather than recursing on `m.post` once per group - keeps the native stack // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no // longer overflow the stack, and leaves a single accumulator whose size // `maxLength` bounds directly (CVE-2026-14257). var acc = [''] // Bash drops empty results, but only when the *first* top-level group is a // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop // is on the final strings, so it is applied to whichever `combine` produces // them (the one with no brace set left in the tail). // How many times the `{a},b}` rewrite below has restarted the scan. Each pass // re-reads the whole string, so leaving this unbounded is quadratic. var rewrites = 0 var dropEmpties = false var firstGroup = true for (;;) { const m = balanced('{', '}', str) // No brace set left: the rest of the string is literal. if (!m) { return combine(acc, str, [''], max, maxLength, dropEmpties) } // no need to expand pre, since it is guaranteed to be free of brace-sets const pre = m.pre if (/\$$/.test(pre)) { acc = combine( acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length ) firstGroup = false if (!m.post.length) break str = m.post continue } var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); var isSequence = isNumericSequence || isAlphaSequence; var isOptions = m.body.indexOf(',') >= 0; if (!isSequence && !isOptions) { // {a},b} if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) { rewrites++; str = m.pre + '{' + m.body + escClose + m.post; isTop = true; continue; } // Nothing here expands, so the whole remaining string is literal. return combine( acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties ) } if (firstGroup) { dropEmpties = isTop && !isSequence firstGroup = false } var values; if (isSequence) { values = expandSequence(m.body, isAlphaSequence, max, maxLength); } else { var n = parseCommaParts(m.body); if (n.length === 1 && n[0] !== undefined) { // x{{a,b}}y ==> x{a}y x{b}y n = expand(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace); //XXX is this necessary? Can't seem to hit it in tests. /* c8 ignore start */ if (n.length === 1) { acc = combine( acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length ) if (!m.post.length) break str = m.post continue } /* c8 ignore stop */ } // Values that `combine` is going to drop as empty produce no result, so // they must not count against `max` - otherwise `{a,,b}` with `max: 2` // would stop at `['a', '']` and yield one result instead of two. Skipping // them outright keeps `values` bounded while leaving `max` a bound on // *kept* results. var dropsEmpties = dropEmpties && !m.post.length && !pre for (var d = 0; dropsEmpties && d < acc.length; d++) { if (acc[d]) { dropsEmpties = false } } values = [] var valuesLength = 0 outer: for (var j = 0; j < n.length; j++) { var expanded = expand(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false) for (var k = 0; k < expanded.length; k++) { var v = expanded[k] if (dropsEmpties && !v) continue if (values.length >= max || valuesLength + v.length > maxLength) { break outer } values.push(v) valuesLength += v.length } } } acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length) if (!m.post.length) break str = m.post } return acc } juliangruber-brace-expansion-8c777ef/package-lock.json000066400000000000000000000707261525206673000231510ustar00rootroot00000000000000{ "name": "brace-expansion", "version": "2.1.7", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "brace-expansion", "version": "2.1.7", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" }, "devDependencies": { "@c4312/matcha": "^1.3.1", "tape": "^4.6.0" } }, "node_modules/@c4312/matcha": { "version": "1.3.1", "resolved": "https://registry.npmjs.org/@c4312/matcha/-/matcha-1.3.1.tgz", "integrity": "sha512-JfkUCcWH5ez5N9UOEq7qFAbavkaASaGx9mQfmv+XIFrzp3YC08PKVWZfzv+u5kRQVrQmbZ+hLrnyqzEmLLkKlA==", "dev": true, "dependencies": { "benchmark": "^2.1.4", "chalk": "^3.0.0", "commander": "^4.1.0", "microtime": "^3.0.0" }, "bin": { "matcha": "dist/cli.js" } }, "node_modules/ansi-styles": { "version": "4.3.0", "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz", "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==", "dev": true, "dependencies": { "color-convert": "^2.0.1" }, "engines": { "node": ">=8" }, "funding": { "url": "https://github.com/chalk/ansi-styles?sponsor=1" } }, "node_modules/balanced-match": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.0.tgz", "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c=" }, "node_modules/benchmark": { "version": "2.1.4", "resolved": "https://registry.npmjs.org/benchmark/-/benchmark-2.1.4.tgz", "integrity": "sha1-CfPeMckWQl1JjMLuVloOvzwqVik=", "dev": true, "dependencies": { "lodash": "^4.17.4", "platform": "^1.3.3" } }, "node_modules/brace-expansion": { "version": "1.1.11", "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz", "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==", "dev": true, "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "node_modules/chalk": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/chalk/-/chalk-3.0.0.tgz", "integrity": "sha512-4D3B6Wf41KOYRFdszmDqMCGq5VV/uMAB273JILmO+3jAlh8X4qDtdtgCR3fxtbLEMzSx22QdhnDcJvu2u1fVwg==", "dev": true, "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" }, "engines": { "node": ">=8" } }, "node_modules/color-convert": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz", "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==", "dev": true, "dependencies": { "color-name": "~1.1.4" }, "engines": { "node": ">=7.0.0" } }, "node_modules/color-name": { "version": "1.1.4", "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz", "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==", "dev": true }, "node_modules/commander": { "version": "4.1.1", "resolved": "https://registry.npmjs.org/commander/-/commander-4.1.1.tgz", "integrity": "sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==", "dev": true, "engines": { "node": ">= 6" } }, "node_modules/concat-map": { "version": "0.0.1", "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=", "dev": true }, "node_modules/deep-equal": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/deep-equal/-/deep-equal-1.1.1.tgz", "integrity": "sha512-yd9c5AdiqVcR+JjcwUQb9DkhJc8ngNr0MahEBGvDiJw8puWab2yZlh+nkasOnZP+EGTAP6rRp2JzJhJZzvNF8g==", "dev": true, "dependencies": { "is-arguments": "^1.0.4", "is-date-object": "^1.0.1", "is-regex": "^1.0.4", "object-is": "^1.0.1", "object-keys": "^1.1.1", "regexp.prototype.flags": "^1.2.0" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/define-properties": { "version": "1.1.3", "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.1.3.tgz", "integrity": "sha512-3MqfYKj2lLzdMSf8ZIZE/V+Zuy+BgD6f164e8K2w7dgnpKArBDerGYpM46IYYcjnkdPNMjPk9A6VFB8+3SKlXQ==", "dev": true, "dependencies": { "object-keys": "^1.0.12" }, "engines": { "node": ">= 0.4" } }, "node_modules/defined": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/defined/-/defined-1.0.0.tgz", "integrity": "sha1-yY2bzvdWdBiOEQlpFRGZ45sfppM=", "dev": true }, "node_modules/dotignore": { "version": "0.1.2", "resolved": "https://registry.npmjs.org/dotignore/-/dotignore-0.1.2.tgz", "integrity": "sha512-UGGGWfSauusaVJC+8fgV+NVvBXkCTmVv7sk6nojDZZvuOUNGUy0Zk4UpHQD6EDjS0jpBwcACvH4eofvyzBcRDw==", "dev": true, "dependencies": { "minimatch": "^3.0.4" }, "bin": { "ignored": "bin/ignored" } }, "node_modules/es-abstract": { "version": "1.18.0-next.1", "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.18.0-next.1.tgz", "integrity": "sha512-I4UGspA0wpZXWENrdA0uHbnhte683t3qT/1VFH9aX2dA5PPSf6QW5HHXf5HImaqPmjXaVeVk4RGWnaylmV7uAA==", "dev": true, "dependencies": { "es-to-primitive": "^1.2.1", "function-bind": "^1.1.1", "has": "^1.0.3", "has-symbols": "^1.0.1", "is-callable": "^1.2.2", "is-negative-zero": "^2.0.0", "is-regex": "^1.1.1", "object-inspect": "^1.8.0", "object-keys": "^1.1.1", "object.assign": "^4.1.1", "string.prototype.trimend": "^1.0.1", "string.prototype.trimstart": "^1.0.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/es-abstract/node_modules/is-regex": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.1.tgz", "integrity": "sha512-1+QkEcxiLlB7VEyFtyBg94e08OAsvq7FUBgApTq/w2ymCLyKJgDPsybBENVtA7XCQEgEXxKPonG+mvYRxh/LIg==", "dev": true, "dependencies": { "has-symbols": "^1.0.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/es-abstract/node_modules/object-inspect": { "version": "1.8.0", "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.8.0.tgz", "integrity": "sha512-jLdtEOB112fORuypAyl/50VRVIBIdVQOSUUGQHzJ4xBSbit81zRarz7GThkEFZy1RceYrWYcPcBFPQwHyAc1gA==", "dev": true, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/es-to-primitive": { "version": "1.2.1", "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.2.1.tgz", "integrity": "sha512-QCOllgZJtaUo9miYBcLChTUaHNjJF3PYs1VidD7AwiEj1kYxKeQTctLAezAOH5ZKRH0g2IgPn6KwB4IT8iRpvA==", "dev": true, "dependencies": { "is-callable": "^1.1.4", "is-date-object": "^1.0.1", "is-symbol": "^1.0.2" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/for-each": { "version": "0.3.3", "resolved": "https://registry.npmjs.org/for-each/-/for-each-0.3.3.tgz", "integrity": "sha512-jqYfLp7mo9vIyQf8ykW2v7A+2N4QjeCeI5+Dz9XraiO1ign81wjiH7Fb9vSOWvQfNtmSa4H2RoQTrrXivdUZmw==", "dev": true, "dependencies": { "is-callable": "^1.1.3" } }, "node_modules/fs.realpath": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz", "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8=", "dev": true }, "node_modules/function-bind": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz", "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A==", "dev": true }, "node_modules/glob": { "version": "7.1.6", "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.6.tgz", "integrity": "sha512-LwaxwyZ72Lk7vZINtNNrywX0ZuLyStrdDtabefZKAY5ZGJhVtgdznluResxNmPitE0SAO+O26sWTHeKSI2wMBA==", "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me", "dev": true, "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^3.0.4", "once": "^1.3.0", "path-is-absolute": "^1.0.0" }, "engines": { "node": "*" }, "funding": { "url": "https://github.com/sponsors/isaacs" } }, "node_modules/has": { "version": "1.0.3", "resolved": "https://registry.npmjs.org/has/-/has-1.0.3.tgz", "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==", "dev": true, "dependencies": { "function-bind": "^1.1.1" }, "engines": { "node": ">= 0.4.0" } }, "node_modules/has-flag": { "version": "4.0.0", "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz", "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==", "dev": true, "engines": { "node": ">=8" } }, "node_modules/has-symbols": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.1.tgz", "integrity": "sha512-PLcsoqu++dmEIZB+6totNFKq/7Do+Z0u4oT0zKOJNl3lYK6vGwwu2hjHs+68OEZbTjiUE9bgOABXbP/GvrS0Kg==", "dev": true, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/inflight": { "version": "1.0.6", "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz", "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=", "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.", "dev": true, "dependencies": { "once": "^1.3.0", "wrappy": "1" } }, "node_modules/inherits": { "version": "2.0.4", "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==", "dev": true }, "node_modules/is-arguments": { "version": "1.0.4", "resolved": "https://registry.npmjs.org/is-arguments/-/is-arguments-1.0.4.tgz", "integrity": "sha512-xPh0Rmt8NE65sNzvyUmWgI1tz3mKq74lGA0mL8LYZcoIzKOzDh6HmrYm3d18k60nHerC8A9Km8kYu87zfSFnLA==", "dev": true, "engines": { "node": ">= 0.4" } }, "node_modules/is-callable": { "version": "1.2.2", "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.2.tgz", "integrity": "sha512-dnMqspv5nU3LoewK2N/y7KLtxtakvTuaCsU9FU50/QDmdbHNy/4/JuRtMHqRU22o3q+W89YQndQEeCVwK+3qrA==", "dev": true, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/is-date-object": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/is-date-object/-/is-date-object-1.0.2.tgz", "integrity": "sha512-USlDT524woQ08aoZFzh3/Z6ch9Y/EWXEHQ/AaRN0SkKq4t2Jw2R2339tSXmwuVoY7LLlBCbOIlx2myP/L5zk0g==", "dev": true, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/is-negative-zero": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.0.tgz", "integrity": "sha1-lVOxIbD6wohp2p7UWeIMdUN4hGE=", "dev": true, "engines": { "node": ">= 0.4" } }, "node_modules/is-regex": { "version": "1.0.5", "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.0.5.tgz", "integrity": "sha512-vlKW17SNq44owv5AQR3Cq0bQPEb8+kF3UKZ2fiZNOWtztYE5i0CzCZxFDwO58qAOWtxdBRVO/V5Qin1wjCqFYQ==", "dev": true, "dependencies": { "has": "^1.0.3" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/is-symbol": { "version": "1.0.3", "resolved": "https://registry.npmjs.org/is-symbol/-/is-symbol-1.0.3.tgz", "integrity": "sha512-OwijhaRSgqvhm/0ZdAcXNZt9lYdKFpcRDT5ULUuYXPoT794UNOdU+gpT6Rzo7b4V2HUl/op6GqY894AZwv9faQ==", "dev": true, "dependencies": { "has-symbols": "^1.0.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/lodash": { "version": "4.17.21", "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz", "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==", "dev": true }, "node_modules/microtime": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/microtime/-/microtime-3.0.0.tgz", "integrity": "sha512-SirJr7ZL4ow2iWcb54bekS4aWyBQNVcEDBiwAz9D/sTgY59A+uE8UJU15cp5wyZmPBwg/3zf8lyCJ5NUe1nVlQ==", "dev": true, "hasInstallScript": true, "dependencies": { "node-addon-api": "^1.2.0", "node-gyp-build": "^3.8.0" }, "engines": { "node": ">= 4.0.0" } }, "node_modules/minimatch": { "version": "3.0.4", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz", "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==", "dev": true, "dependencies": { "brace-expansion": "^1.1.7" }, "engines": { "node": "*" } }, "node_modules/minimist": { "version": "1.2.5", "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz", "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==", "dev": true }, "node_modules/node-addon-api": { "version": "1.7.2", "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-1.7.2.tgz", "integrity": "sha512-ibPK3iA+vaY1eEjESkQkM0BbCqFOaZMiXRTtdB0u7b4djtY6JnsjvPdUHVMg6xQt3B8fpTTWHI9A+ADjM9frzg==", "dev": true }, "node_modules/node-gyp-build": { "version": "3.9.0", "resolved": "https://registry.npmjs.org/node-gyp-build/-/node-gyp-build-3.9.0.tgz", "integrity": "sha512-zLcTg6P4AbcHPq465ZMFNXx7XpKKJh+7kkN699NiQWisR2uWYOWNWqRHAmbnmKiL4e9aLSlmy5U7rEMUXV59+A==", "dev": true, "bin": { "node-gyp-build": "bin.js", "node-gyp-build-optional": "optional.js", "node-gyp-build-test": "build-test.js" } }, "node_modules/object-inspect": { "version": "1.7.0", "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.7.0.tgz", "integrity": "sha512-a7pEHdh1xKIAgTySUGgLMx/xwDZskN1Ud6egYYN3EdRW4ZMPNEDUTF+hwy2LUC+Bl+SyLXANnwz/jyh/qutKUw==", "dev": true, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/object-is": { "version": "1.1.3", "resolved": "https://registry.npmjs.org/object-is/-/object-is-1.1.3.tgz", "integrity": "sha512-teyqLvFWzLkq5B9ki8FVWA902UER2qkxmdA4nLf+wjOLAWgxzCWZNCxpDq9MvE8MmhWNr+I8w3BN49Vx36Y6Xg==", "dev": true, "dependencies": { "define-properties": "^1.1.3", "es-abstract": "^1.18.0-next.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/object-keys": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz", "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==", "dev": true, "engines": { "node": ">= 0.4" } }, "node_modules/object.assign": { "version": "4.1.1", "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.1.tgz", "integrity": "sha512-VT/cxmx5yaoHSOTSyrCygIDFco+RsibY2NM0a4RdEeY/4KgqezwFtK1yr3U67xYhqJSlASm2pKhLVzPj2lr4bA==", "dev": true, "dependencies": { "define-properties": "^1.1.3", "es-abstract": "^1.18.0-next.0", "has-symbols": "^1.0.1", "object-keys": "^1.1.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/once": { "version": "1.4.0", "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz", "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=", "dev": true, "dependencies": { "wrappy": "1" } }, "node_modules/path-is-absolute": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz", "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18=", "dev": true, "engines": { "node": ">=0.10.0" } }, "node_modules/path-parse": { "version": "1.0.6", "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz", "integrity": "sha512-GSmOT2EbHrINBf9SR7CDELwlJ8AENk3Qn7OikK4nFYAu3Ote2+JYNVvkpAEQm3/TLNEJFD/xZJjzyxg3KBWOzw==", "dev": true }, "node_modules/platform": { "version": "1.3.6", "resolved": "https://registry.npmjs.org/platform/-/platform-1.3.6.tgz", "integrity": "sha512-fnWVljUchTro6RiCFvCXBbNhJc2NijN7oIQxbwsyL0buWJPG85v81ehlHI9fXrJsMNgTofEoWIQeClKpgxFLrg==", "dev": true }, "node_modules/regexp.prototype.flags": { "version": "1.3.0", "resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.3.0.tgz", "integrity": "sha512-2+Q0C5g951OlYlJz6yu5/M33IcsESLlLfsyIaLJaG4FA2r4yP8MvVMJUUP/fVBkSpbbbZlS5gynbEWLipiiXiQ==", "dev": true, "dependencies": { "define-properties": "^1.1.3", "es-abstract": "^1.17.0-next.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/regexp.prototype.flags/node_modules/es-abstract": { "version": "1.17.7", "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.17.7.tgz", "integrity": "sha512-VBl/gnfcJ7OercKA9MVaegWsBHFjV492syMudcnQZvt/Dw8ezpcOHYZXa/J96O8vx+g4x65YKhxOwDUh63aS5g==", "dev": true, "dependencies": { "es-to-primitive": "^1.2.1", "function-bind": "^1.1.1", "has": "^1.0.3", "has-symbols": "^1.0.1", "is-callable": "^1.2.2", "is-regex": "^1.1.1", "object-inspect": "^1.8.0", "object-keys": "^1.1.1", "object.assign": "^4.1.1", "string.prototype.trimend": "^1.0.1", "string.prototype.trimstart": "^1.0.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/regexp.prototype.flags/node_modules/is-regex": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.1.tgz", "integrity": "sha512-1+QkEcxiLlB7VEyFtyBg94e08OAsvq7FUBgApTq/w2ymCLyKJgDPsybBENVtA7XCQEgEXxKPonG+mvYRxh/LIg==", "dev": true, "dependencies": { "has-symbols": "^1.0.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/regexp.prototype.flags/node_modules/object-inspect": { "version": "1.8.0", "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.8.0.tgz", "integrity": "sha512-jLdtEOB112fORuypAyl/50VRVIBIdVQOSUUGQHzJ4xBSbit81zRarz7GThkEFZy1RceYrWYcPcBFPQwHyAc1gA==", "dev": true, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/resolve": { "version": "1.17.0", "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.17.0.tgz", "integrity": "sha512-ic+7JYiV8Vi2yzQGFWOkiZD5Z9z7O2Zhm9XMaTxdJExKasieFCr+yXZ/WmXsckHiKl12ar0y6XiXDx3m4RHn1w==", "dev": true, "dependencies": { "path-parse": "^1.0.6" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/resumer": { "version": "0.0.0", "resolved": "https://registry.npmjs.org/resumer/-/resumer-0.0.0.tgz", "integrity": "sha1-8ej0YeQGS6Oegq883CqMiT0HZ1k=", "dev": true, "dependencies": { "through": "~2.3.4" } }, "node_modules/string.prototype.trim": { "version": "1.2.2", "resolved": "https://registry.npmjs.org/string.prototype.trim/-/string.prototype.trim-1.2.2.tgz", "integrity": "sha512-b5yrbl3BXIjHau9Prk7U0RRYcUYdN4wGSVaqoBQS50CCE3KBuYU0TYRNPFCP7aVoNMX87HKThdMRVIP3giclKg==", "dev": true, "dependencies": { "define-properties": "^1.1.3", "es-abstract": "^1.18.0-next.0" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/string.prototype.trimend": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.1.tgz", "integrity": "sha512-LRPxFUaTtpqYsTeNKaFOw3R4bxIzWOnbQ837QfBylo8jIxtcbK/A/sMV7Q+OAV/vWo+7s25pOE10KYSjaSO06g==", "dev": true, "dependencies": { "define-properties": "^1.1.3", "es-abstract": "^1.17.5" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/string.prototype.trimend/node_modules/es-abstract": { "version": "1.17.7", "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.17.7.tgz", "integrity": "sha512-VBl/gnfcJ7OercKA9MVaegWsBHFjV492syMudcnQZvt/Dw8ezpcOHYZXa/J96O8vx+g4x65YKhxOwDUh63aS5g==", "dev": true, "dependencies": { "es-to-primitive": "^1.2.1", "function-bind": "^1.1.1", "has": "^1.0.3", "has-symbols": "^1.0.1", "is-callable": "^1.2.2", "is-regex": "^1.1.1", "object-inspect": "^1.8.0", "object-keys": "^1.1.1", "object.assign": "^4.1.1", "string.prototype.trimend": "^1.0.1", "string.prototype.trimstart": "^1.0.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/string.prototype.trimend/node_modules/is-regex": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.1.tgz", "integrity": "sha512-1+QkEcxiLlB7VEyFtyBg94e08OAsvq7FUBgApTq/w2ymCLyKJgDPsybBENVtA7XCQEgEXxKPonG+mvYRxh/LIg==", "dev": true, "dependencies": { "has-symbols": "^1.0.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/string.prototype.trimend/node_modules/object-inspect": { "version": "1.8.0", "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.8.0.tgz", "integrity": "sha512-jLdtEOB112fORuypAyl/50VRVIBIdVQOSUUGQHzJ4xBSbit81zRarz7GThkEFZy1RceYrWYcPcBFPQwHyAc1gA==", "dev": true, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/string.prototype.trimstart": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.1.tgz", "integrity": "sha512-XxZn+QpvrBI1FOcg6dIpxUPgWCPuNXvMD72aaRaUQv1eD4e/Qy8i/hFTe0BUmD60p/QA6bh1avmuPTfNjqVWRw==", "dev": true, "dependencies": { "define-properties": "^1.1.3", "es-abstract": "^1.17.5" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/string.prototype.trimstart/node_modules/es-abstract": { "version": "1.17.7", "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.17.7.tgz", "integrity": "sha512-VBl/gnfcJ7OercKA9MVaegWsBHFjV492syMudcnQZvt/Dw8ezpcOHYZXa/J96O8vx+g4x65YKhxOwDUh63aS5g==", "dev": true, "dependencies": { "es-to-primitive": "^1.2.1", "function-bind": "^1.1.1", "has": "^1.0.3", "has-symbols": "^1.0.1", "is-callable": "^1.2.2", "is-regex": "^1.1.1", "object-inspect": "^1.8.0", "object-keys": "^1.1.1", "object.assign": "^4.1.1", "string.prototype.trimend": "^1.0.1", "string.prototype.trimstart": "^1.0.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/string.prototype.trimstart/node_modules/is-regex": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.1.tgz", "integrity": "sha512-1+QkEcxiLlB7VEyFtyBg94e08OAsvq7FUBgApTq/w2ymCLyKJgDPsybBENVtA7XCQEgEXxKPonG+mvYRxh/LIg==", "dev": true, "dependencies": { "has-symbols": "^1.0.1" }, "engines": { "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/string.prototype.trimstart/node_modules/object-inspect": { "version": "1.8.0", "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.8.0.tgz", "integrity": "sha512-jLdtEOB112fORuypAyl/50VRVIBIdVQOSUUGQHzJ4xBSbit81zRarz7GThkEFZy1RceYrWYcPcBFPQwHyAc1gA==", "dev": true, "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/supports-color": { "version": "7.2.0", "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz", "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==", "dev": true, "dependencies": { "has-flag": "^4.0.0" }, "engines": { "node": ">=8" } }, "node_modules/tape": { "version": "4.13.3", "resolved": "https://registry.npmjs.org/tape/-/tape-4.13.3.tgz", "integrity": "sha512-0/Y20PwRIUkQcTCSi4AASs+OANZZwqPKaipGCEwp10dQMipVvSZwUUCi01Y/OklIGyHKFhIcjock+DKnBfLAFw==", "dev": true, "dependencies": { "deep-equal": "~1.1.1", "defined": "~1.0.0", "dotignore": "~0.1.2", "for-each": "~0.3.3", "function-bind": "~1.1.1", "glob": "~7.1.6", "has": "~1.0.3", "inherits": "~2.0.4", "is-regex": "~1.0.5", "minimist": "~1.2.5", "object-inspect": "~1.7.0", "resolve": "~1.17.0", "resumer": "~0.0.0", "string.prototype.trim": "~1.2.1", "through": "~2.3.8" }, "bin": { "tape": "bin/tape" } }, "node_modules/through": { "version": "2.3.8", "resolved": "https://registry.npmjs.org/through/-/through-2.3.8.tgz", "integrity": "sha1-DdTJ/6q8NXlgsbckEV1+Doai4fU=", "dev": true }, "node_modules/wrappy": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz", "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=", "dev": true } } } juliangruber-brace-expansion-8c777ef/package.json000066400000000000000000000021571525206673000222140ustar00rootroot00000000000000{ "name": "brace-expansion", "description": "Brace expansion as known from sh/bash", "version": "2.1.7", "repository": { "type": "git", "url": "git://github.com/juliangruber/brace-expansion.git" }, "homepage": "https://github.com/juliangruber/brace-expansion", "main": "index.js", "scripts": { "test": "tape test/*.js", "gentest": "bash test/generate.sh", "bench": "matcha test/perf/bench.js" }, "dependencies": { "balanced-match": "^1.0.0" }, "devDependencies": { "@c4312/matcha": "^1.3.1", "tape": "^4.6.0" }, "keywords": [], "author": { "name": "Julian Gruber", "email": "mail@juliangruber.com", "url": "http://juliangruber.com" }, "license": "MIT", "testling": { "files": "test/*.js", "browsers": [ "ie/8..latest", "firefox/20..latest", "firefox/nightly", "chrome/25..latest", "chrome/canary", "opera/12..latest", "opera/next", "safari/5.1..latest", "ipad/6.0..latest", "iphone/6.0..latest", "android-browser/4.2..latest" ] }, "publishConfig": { "tag": "2.x" } } juliangruber-brace-expansion-8c777ef/test/000077500000000000000000000000001525206673000207005ustar00rootroot00000000000000juliangruber-brace-expansion-8c777ef/test/bash-comparison.js000066400000000000000000000016151525206673000243260ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); var fs = require('fs'); var resfile = __dirname + '/bash-results.txt'; var cases = fs.readFileSync(resfile, 'utf8').split('><><><><'); // throw away the EOF marker cases.pop() test('matches bash expansions', function(t) { cases.forEach(function(testcase) { var set = testcase.split('\n'); var pattern = set.shift(); var actual = expand(pattern); // If it expands to the empty string, then it's actually // just nothing, but Bash is a singly typed language, so // "nothing" is the same as "". if (set.length === 1 && set[0] === '') { set = [] } else { // otherwise, strip off the [] that were added so that // "" expansions would be preserved properly. set = set.map(function (s) { return s.replace(/^\[|\]$/g, '') }) } t.same(actual, set, pattern); }); t.end(); }) juliangruber-brace-expansion-8c777ef/test/bash-results.txt000066400000000000000000000206431525206673000240620ustar00rootroot00000000000000A{b,{d,e},{f,g}}Z [AbZ] [AdZ] [AeZ] [AfZ] [AgZ]><><><><><><><\{a,b}{{a,b},a,b} [{a,b}a] [{a,b}b] [{a,b}a] [{a,b}b]><><><><{{a,b} [{a] [{b]><><><><{a,b}} [a}] [b}]><><><><{,} ><><><><><><><{,}b [b] [b]><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><{-01..5} [-01] [000] [001] [002] [003] [004] [005]><><><><{-05..100..5} [-05] [000] [005] [010] [015] [020] [025] [030] [035] [040] [045] [050] [055] [060] [065] [070] [075] [080] [085] [090] [095] [100]><><><><{-05..100} [-05] [-04] [-03] [-02] [-01] [000] [001] [002] [003] [004] [005] [006] [007] [008] [009] [010] [011] [012] [013] [014] [015] [016] [017] [018] [019] [020] [021] [022] [023] [024] [025] [026] [027] [028] [029] [030] [031] [032] [033] [034] [035] [036] [037] [038] [039] [040] [041] [042] [043] [044] [045] [046] [047] [048] [049] [050] [051] [052] [053] [054] [055] [056] [057] [058] [059] [060] [061] [062] [063] [064] [065] [066] [067] [068] [069] [070] [071] [072] [073] [074] [075] [076] [077] [078] [079] [080] [081] [082] [083] [084] [085] [086] [087] [088] [089] [090] [091] [092] [093] [094] [095] [096] [097] [098] [099] [100]><><><><{0..5..2} [0] [2] [4]><><><><{0001..05..2} [0001] [0003] [0005]><><><><{0001..-5..2} [0001] [-001] [-003] [-005]><><><><{0001..-5..-2} [0001] [-001] [-003] [-005]><><><><{0001..5..-2} [0001] [0003] [0005]><><><><{01..5} [01] [02] [03] [04] [05]><><><><{1..05} [01] [02] [03] [04] [05]><><><><{1..05..3} [01] [04]><><><><{05..100} [005] [006] [007] [008] [009] [010] [011] [012] [013] [014] [015] [016] [017] [018] [019] [020] [021] [022] [023] [024] [025] [026] [027] [028] [029] [030] [031] [032] [033] [034] [035] [036] [037] [038] [039] [040] [041] [042] [043] [044] [045] [046] [047] [048] [049] [050] [051] [052] [053] [054] [055] [056] [057] [058] [059] [060] [061] [062] [063] [064] [065] [066] [067] [068] [069] [070] [071] [072] [073] [074] [075] [076] [077] [078] [079] [080] [081] [082] [083] [084] [085] [086] [087] [088] [089] [090] [091] [092] [093] [094] [095] [096] [097] [098] [099] [100]><><><><{0a..0z} [{0a..0z}]><><><><{a,b\}c,d} [a] [b}c] [d]><><><><{a,b{c,d} [{a,bc] [{a,bd]><><><><{a,b}c,d} [ac,d}] [bc,d}]><><><><{a..F} [a] [`] [_] [^] []] [] [[] [Z] [Y] [X] [W] [V] [U] [T] [S] [R] [Q] [P] [O] [N] [M] [L] [K] [J] [I] [H] [G] [F]><><><><{A..f} [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W] [X] [Y] [Z] [[] [] []] [^] [_] [`] [a] [b] [c] [d] [e] [f]><><><><{a..Z} [a] [`] [_] [^] []] [] [[] [Z]><><><><{A..z} [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W] [X] [Y] [Z] [[] [] []] [^] [_] [`] [a] [b] [c] [d] [e] [f] [g] [h] [i] [j] [k] [l] [m] [n] [o] [p] [q] [r] [s] [t] [u] [v] [w] [x] [y] [z]><><><><{z..A} [z] [y] [x] [w] [v] [u] [t] [s] [r] [q] [p] [o] [n] [m] [l] [k] [j] [i] [h] [g] [f] [e] [d] [c] [b] [a] [`] [_] [^] []] [] [[] [Z] [Y] [X] [W] [V] [U] [T] [S] [R] [Q] [P] [O] [N] [M] [L] [K] [J] [I] [H] [G] [F] [E] [D] [C] [B] [A]><><><><{Z..a} [Z] [[] [] []] [^] [_] [`] [a]><><><><{a..F..2} [a] [_] []] [[] [Y] [W] [U] [S] [Q] [O] [M] [K] [I] [G]><><><><{A..f..02} [A] [C] [E] [G] [I] [K] [M] [O] [Q] [S] [U] [W] [Y] [[] []] [_] [a] [c] [e]><><><><{a..Z..5} [a] []><><><><><><><{A..z..10} [A] [K] [U] [_] [i] [s]><><><><{z..A..-2} [z] [x] [v] [t] [r] [p] [n] [l] [j] [h] [f] [d] [b] [`] [^] [] [Z] [X] [V] [T] [R] [P] [N] [L] [J] [H] [F] [D] [B]><><><><{Z..a..20} [Z]><><><><{a{,b} [{a] [{ab]><><><><{a},b} [a}] [b]><><><><{x,y{,}g} [x] [yg] [yg]><><><><{x,y{}g} [x] [y{}g]><><><><{{a,b} [{a] [{b]><><><><{{a,b},c} [a] [b] [c]><><><><{{a,b}c} [{ac}] [{bc}]><><><><{{a,b},} [a] [b]><><><><><><><{{a,b},}c [ac] [bc] [c]><><><><{{a,b}.} [{a.}] [{b.}]><><><><{{a,b}} [{a}] [{b}]><><><><><><>< ><><><><{-10..00} [-10] [-09] [-08] [-07] [-06] [-05] [-04] [-03] [-02] [-01] [000]><><><><{a,\\{a,b}c} [a] [\ac] [\bc]><><><><{a,\{a,b}c} [ac}] [{ac}] [bc}]><><><><><><><{-10.\.00} [{-10..00}]><><><><><><><><><><{l,n,m}xyz [lxyz] [nxyz] [mxyz]><><><><{abc\,def} [{abc,def}]><><><><{abc} [{abc}]><><><><{x\,y,\{abc\},trie} [x,y] [{abc}] [trie]><><><><{} [{}]><><><><} [}]><><><><{ [{]><><><><><><><{1..10} [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]><><><><{0..10,braces} [0..10] [braces]><><><><{{0..10},braces} [0] [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [braces]><><><><><><><{3..3} [3]><><><><><><><{10..1} [10] [9] [8] [7] [6] [5] [4] [3] [2] [1]><><><><{10..1}y [10y] [9y] [8y] [7y] [6y] [5y] [4y] [3y] [2y] [1y]><><><><><><><{a..f} [a] [b] [c] [d] [e] [f]><><><><{f..a} [f] [e] [d] [c] [b] [a]><><><><{a..A} [a] [`] [_] [^] []] [] [[] [Z] [Y] [X] [W] [V] [U] [T] [S] [R] [Q] [P] [O] [N] [M] [L] [K] [J] [I] [H] [G] [F] [E] [D] [C] [B] [A]><><><><{A..a} [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W] [X] [Y] [Z] [[] [] []] [^] [_] [`] [a]><><><><{f..f} [f]><><><><{1..f} [{1..f}]><><><><{f..1} [{f..1}]><><><><{-1..-10} [-1] [-2] [-3] [-4] [-5] [-6] [-7] [-8] [-9] [-10]><><><><{-20..0} [-20] [-19] [-18] [-17] [-16] [-15] [-14] [-13] [-12] [-11] [-10] [-9] [-8] [-7] [-6] [-5] [-4] [-3] [-2] [-1] [0]><><><><><><><><><><{klklkl}{1,2,3} [{klklkl}1] [{klklkl}2] [{klklkl}3]><><><><{1..10..2} [1] [3] [5] [7] [9]><><><><{-1..-10..2} [-1] [-3] [-5] [-7] [-9]><><><><{-1..-10..-2} [-1] [-3] [-5] [-7] [-9]><><><><{10..1..-2} [10] [8] [6] [4] [2]><><><><{10..1..2} [10] [8] [6] [4] [2]><><><><{1..20..2} [1] [3] [5] [7] [9] [11] [13] [15] [17] [19]><><><><{1..20..20} [1]><><><><{100..0..5} [100] [95] [90] [85] [80] [75] [70] [65] [60] [55] [50] [45] [40] [35] [30] [25] [20] [15] [10] [5] [0]><><><><{100..0..-5} [100] [95] [90] [85] [80] [75] [70] [65] [60] [55] [50] [45] [40] [35] [30] [25] [20] [15] [10] [5] [0]><><><><{a..z} [a] [b] [c] [d] [e] [f] [g] [h] [i] [j] [k] [l] [m] [n] [o] [p] [q] [r] [s] [t] [u] [v] [w] [x] [y] [z]><><><><{a..z..2} [a] [c] [e] [g] [i] [k] [m] [o] [q] [s] [u] [w] [y]><><><><{z..a..-2} [z] [x] [v] [t] [r] [p] [n] [l] [j] [h] [f] [d] [b]><><><><{2147483645..2147483649} [2147483645] [2147483646] [2147483647] [2147483648] [2147483649]><><><><{10..0..2} [10] [8] [6] [4] [2] [0]><><><><{10..0..-2} [10] [8] [6] [4] [2] [0]><><><><{-50..-0..5} [-50] [-45] [-40] [-35] [-30] [-25] [-20] [-15] [-10] [-5] [0]><><><><{1..10.f} [{1..10.f}]><><><><{1..ff} [{1..ff}]><><><><{1..10..ff} [{1..10..ff}]><><><><{1.20..2} [{1.20..2}]><><><><{1..20..f2} [{1..20..f2}]><><><><{1..20..2f} [{1..20..2f}]><><><><{1..2f..2} [{1..2f..2}]><><><><{1..ff..2} [{1..ff..2}]><><><><{1..ff} [{1..ff}]><><><><{1..f} [{1..f}]><><><><{1..0f} [{1..0f}]><><><><{1..10f} [{1..10f}]><><><><{1..10.f} [{1..10.f}]><><><><{},b}.h [{},b}.h]><><><><><><><{}{},a}b [{}}b] [{}ab]><><><><{{},a}}b [{}}b] [a}b]><><><><{}{{},a}}b [{}{}}b] [{}a}b]><><><><{}a,b}c [{}a,b}c]><><><><{1..2..0} [1] [2]><><><>< juliangruber-brace-expansion-8c777ef/test/cases.txt000066400000000000000000000054471525206673000225510ustar00rootroot00000000000000# skip quotes for now # "{x,x}" # {"x,x"} # {x","x} # '{a,b}{{a,b},a,b}' A{b,{d,e},{f,g}}Z PRE-{a,b}{{a,b},a,b}-POST \\{a,b}{{a,b},a,b} {{a,b} {a,b}} {,} a{,} {,}b a{,}b a{b}c a{1..5}b a{01..5}b a{-01..5}b a{-01..5..3}b a{001..9}b a{b,c{d,e},{f,g}h}x{y,z a{b,c{d,e},{f,g}h}x{y,z\\} a{b,c{d,e},{f,g}h}x{y,z} a{b{c{d,e}f{x,y{{g}h a{b{c{d,e}f{x,y{}g}h a{b{c{d,e}f{x,y}}g}h a{b{c{d,e}f}g}h a{{x,y},z}b f{x,y{g,z}}h f{x,y{{g,z}}h f{x,y{{g,z}}h} f{x,y{{g}h f{x,y{{g}}h f{x,y{}g}h z{a,b{,c}d z{a,b},c}d {-01..5} {-05..100..5} {-05..100} {0..5..2} {0001..05..2} {0001..-5..2} {0001..-5..-2} {0001..5..-2} {01..5} {1..05} {1..05..3} {05..100} {0a..0z} {a,b\\}c,d} {a,b{c,d} {a,b}c,d} {a..F} {A..f} {a..Z} {A..z} {z..A} {Z..a} {a..F..2} {A..f..02} {a..Z..5} d{a..Z..5}b {A..z..10} {z..A..-2} {Z..a..20} {a{,b} {a},b} {x,y{,}g} {x,y{}g} {{a,b} {{a,b},c} {{a,b}c} {{a,b},} X{{a,b},}X {{a,b},}c {{a,b}.} {{a,b}} X{a..#}X # this next one is an empty string {-10..00} # Need to escape slashes in here for reasons i guess. {a,\\\\{a,b}c} {a,\\{a,b}c} a,\\{b,c} {-10.\\.00} #### bash tests/braces.tests # Note that some tests are edited out because some features of # bash are intentionally not supported in this brace expander. ff{c,b,a} f{d,e,f}g {l,n,m}xyz {abc\\,def} {abc} {x\\,y,\\{abc\\},trie} # not impementing back-ticks obviously # XXXX\\{`echo a b c | tr ' ' ','`\\} {} # We only ever have to worry about parsing a single argument, # not a command line, so spaces have a different meaning than bash. # { } } { abcd{efgh # spaces # foo {1,2} bar # not impementing back-ticks obviously # `zecho foo {1,2} bar` # $(zecho foo {1,2} bar) # ${var} is not a variable here, like it is in bash. omit. # foo{bar,${var}.} # foo{bar,${var}} # isaacs: skip quotes for now # "${var}"{x,y} # $var{x,y} # ${var}{x,y} # new sequence brace operators {1..10} # this doesn't work yet {0..10,braces} # but this does {{0..10},braces} x{{0..10},braces}y {3..3} x{3..3}y {10..1} {10..1}y x{10..1}y {a..f} {f..a} {a..A} {A..a} {f..f} # mixes are incorrectly-formed brace expansions {1..f} {f..1} # spaces # 0{1..9} {10..20} # do negative numbers work? {-1..-10} {-20..0} # weirdly-formed brace expansions -- fixed in post-bash-3.1 a-{b{d,e}}-c a-{bdef-{g,i}-c # isaacs: skip quotes for now # {"klklkl"}{1,2,3} # isaacs: this is a valid test, though {klklkl}{1,2,3} # {"x,x"} {1..10..2} {-1..-10..2} {-1..-10..-2} {10..1..-2} {10..1..2} {1..20..2} {1..20..20} {100..0..5} {100..0..-5} {a..z} {a..z..2} {z..a..-2} # make sure brace expansion handles ints > 2**31 - 1 using intmax_t {2147483645..2147483649} # unwanted zero-padding -- fixed post-bash-4.0 {10..0..2} {10..0..-2} {-50..-0..5} # bad {1..10.f} {1..ff} {1..10..ff} {1.20..2} {1..20..f2} {1..20..2f} {1..2f..2} {1..ff..2} {1..ff} {1..f} {1..0f} {1..10f} {1..10.f} {},b}.h y{},a}x {}{},a}b {{},a}}b {}{{},a}}b {}a,b}c {1..2..0} juliangruber-brace-expansion-8c777ef/test/cve.js000066400000000000000000000056121525206673000220170ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); var fs = require('fs'); // CVE-2026-14257: `max` caps the number of results but not their length, so // chaining many brace groups keeps the count under `max` while each result // grows with the number of groups. Building 100k long results (and the // intermediate arrays combined along the way) exhausted memory and crashed // the process with an uncatchable out-of-memory error. test('total expansion length is bounded', function(t) { var str = '{a,b}'.repeat(1500) var startTime = performance.now() var expanded = expand(str) var endTime = performance.now() var totalLength = expanded.reduce(function (sum, s) { return sum + s.length; }, 0) t.ok( totalLength <= 4_000_000, `Expected total length (${totalLength}) to be bounded`, ) t.ok(expanded.length > 0, 'still returns a (truncated) result') t.ok( expanded.every(s => /^[ab]+$/.test(s)), 'results are valid expansions', ) t.ok( endTime - startTime < 5000, `Expected time (${endTime - startTime}ms) to be less than 5000ms`, ) // The bound is a single accumulator, not a per-level limit, so it holds no // matter how many brace groups are chained - not `groups * maxLength`. for (var groups of [100, 1500, 5000]) { var total = expand('{a,b}'.repeat(groups)).reduce( function(sum, s) { return sum + s.length; }, 0, ) t.ok( total <= 4_000_000, `Expected total length (${total}) to stay bounded at ${groups} groups`, ) } t.end(); }) // Expanding the tail iteratively (rather than recursing once per brace group) // keeps native stack depth constant, so deeply chained input that used to throw // `RangeError: Maximum call stack size exceeded` around ~2,700 groups now // returns a bounded result. test('deep chaining does not overflow the stack', function(t) { var str = '{a,b}'.repeat(50_000) t.doesNotThrow(() => { var expanded = expand(str) t.ok(expanded.length > 0, 'still returns a (truncated) result') t.ok( expanded.reduce(function (sum, s) { return sum + s.length; }, 0) <= 4_000_000, 'output stays bounded', ) }) t.end(); }) test('maxLength option bounds output size', function (t) { var str = '{a,b}'.repeat(1500) var expanded = expand(str, { maxLength: 100_000 }) var totalLength = expanded.reduce(function (sum, s) { return sum + s.length; }, 0) t.ok( totalLength <= 100_000, `Expected total length (${totalLength}) to respect maxLength`, ) // The `${...}` literal branch combines its body with the expanded tail and // must be bounded the same way. var dollar = '${x}' + '{a,b}'.repeat(20) var expandedDollar = expand(dollar, { maxLength: 100_000 }) var dollarLength = expandedDollar.reduce(function (sum, s) { return sum + s.length; }, 0) t.ok( dollarLength <= 100_000, `Expected total length (${dollarLength}) to respect maxLength`, ) t.end(); }) juliangruber-brace-expansion-8c777ef/test/dollar.js000066400000000000000000000010161525206673000225110ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); test('ignores ${', function(t) { t.deepEqual(expand('${1..3}'), ['${1..3}']); t.deepEqual(expand('${a,b}${c,d}'), ['${a,b}${c,d}']); t.deepEqual(expand('${a,b}${c,d}{e,f}'), ['${a,b}${c,d}e','${a,b}${c,d}f']); t.deepEqual(expand('{a,b}${c,d}${e,f}'), ['a${c,d}${e,f}','b${c,d}${e,f}']); t.deepEqual(expand('${a,b}${c,d}{1..3}'), ['${a,b}${c,d}1','${a,b}${c,d}2','${a,b}${c,d}3']); t.deepEqual(expand('x${a,b}x${c,d}x'), ['x${a,b}x${c,d}x']); t.end(); }); juliangruber-brace-expansion-8c777ef/test/empty-option.js000066400000000000000000000002671525206673000237070ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); test('empty option', function(t) { t.deepEqual(expand('-v{,,,,}'), [ '-v', '-v', '-v', '-v', '-v' ]); t.end(); }); juliangruber-brace-expansion-8c777ef/test/generate.sh000077500000000000000000000010321525206673000230250ustar00rootroot00000000000000#!/usr/bin/env bash set -e # Bash 4.3 because of arbitrary need to pick a single standard. if [ "${BASH_VERSINFO[0]}" != "4" ] || [ "${BASH_VERSINFO[1]}" != "3" ]; then echo "this script requires bash 4.3" >&2 exit 1 fi CDPATH= cd "$(dirname "$0")" js='require("./")(process.argv[1]).join(" ")' cat cases.txt | \ while read case; do if [ "${case:0:1}" = "#" ]; then continue; fi; b="$($BASH -c 'for c in '"$case"'; do echo ["$c"]; done')" echo "$case" echo -n "$b><><><><"; done > bash-results.txt juliangruber-brace-expansion-8c777ef/test/ghsa-6j4f-fj2g-mc7p.js000066400000000000000000000040351525206673000244230ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); // `parseCommaParts` recursed on the remainder of the string once per brace // group, so chaining groups inside a brace set exhausted the native stack at // ~7,000 groups (~29KB of input) - the parsing-side counterpart to the // `expand` overflow fixed for CVE-2026-14257. The identical chain *outside* a // brace set (`'{a,b}'.repeat(n)`) was already safe; routing it through // `parseCommaParts` was not. test('deeply chained comma groups do not overflow the stack', function (t) { var str = '{' + '{a},'.repeat(50000) + 'b}' t.doesNotThrow(function () { var expanded = expand(str) t.ok(expanded.length > 0, 'still returns a result') }) // The overflow happened while parsing, before anything was expanded, so // neither bound could prevent it - and neither is what keeps it safe now. t.doesNotThrow( function () { expand(str, { max: 1, maxLength: 1 }) }, 'still safe with both bounds set as low as they go' ) t.end(); }) // `push.apply(target, items)` passes one argument per element, so a single // large array overflowed the stack with no recursion at all - this input // reaches a recursion depth of exactly one. test('a large comma set does not overflow the stack', function (t) { var str = '{{x},' + 'a,'.repeat(200000) + 'b}' t.doesNotThrow(function () { var expanded = expand(str) t.ok(expanded.length > 0, 'still returns a (truncated) result') }) t.end(); }) // The rewrite must not change what the parser produces. test('nested comma groups still parse as before', function (t) { t.deepEqual(expand('{a,b}{c,d}'), ['ac', 'ad', 'bc', 'bd']) t.deepEqual(expand('x{{a,b}}y'), ['x{a}y', 'x{b}y']) t.deepEqual(expand('{a,{b,c},d}'), ['a', 'b', 'c', 'd']) t.deepEqual(expand('{a,{b,c}d,e}'), ['a', 'bd', 'cd', 'e']) t.deepEqual(expand('x{a,{b,c},d}y'), ['xay', 'xby', 'xcy', 'xdy']) t.deepEqual(expand('{a,,b}'), ['a', 'b']) t.deepEqual(expand('{,}'), []) t.deepEqual(expand('{}'), ['{}']) t.deepEqual(expand('{a,b'), ['{a,b']) t.end(); }) juliangruber-brace-expansion-8c777ef/test/ghsa-q2hr-2g5m-vwhr.js000066400000000000000000000037001525206673000245660ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); // Bash keeps a quirk where a brace group followed by a comma set still expands // (`{a},b}`). The parser rewrites the string and restarts the scan, absorbing // one `}` per pass, so `n` trailing braces cost `n` passes over a string that // itself grows by one `escClose` sentinel each time - quadratic in `n`. 128KB // of this shape blocked the event loop for 27 seconds to produce 2 results. test('the {a},b} rewrite does not run in quadratic time', function (t) { var build = function (n) { return '{a}' + '}'.repeat(n) + ',z}' } var startTime = performance.now() expand(build(128000)) var elapsed = performance.now() - startTime t.ok(elapsed < 2000, 'Expected time (' + elapsed + 'ms) to be less than 2000ms') // Neither output bound applies: the payload yields a couple of results at any // size, so the cost is all in parsing. t.doesNotThrow(function () { expand(build(128000), { max: 1, maxLength: 1 }) }) t.end(); }) test('maxRewrites option bounds the rescan count', function (t) { var build = function (n) { return '{a}' + '}'.repeat(n) + ',z}' } // Real `{a},b}` input needs a handful of passes, and is untouched. t.deepEqual(expand('{a},b}'), ['a}', 'b']) t.deepEqual(expand('a{},b}c'), ['a}c', 'abc']) // Below the bound the result matches an unbounded expansion exactly. var ns = [1, 10, 100] for (var i = 0; i < ns.length; i++) { t.deepEqual( expand(build(ns[i]), { maxRewrites: 1000 }), expand(build(ns[i]), { maxRewrites: 100000 }), ns[i] + ' trailing braces are unchanged below the bound' ) } // Past it the scan stops restarting and the rest stays literal, rather than // throwing - the same way `max` and `maxLength` truncate. t.deepEqual(expand('{a},b}', { maxRewrites: 0 }), ['{a},b}']) t.ok( expand(build(50), { maxRewrites: 10 })[0].indexOf('{a}') === 0, 'past the bound the group comes back literal' ) t.end(); }) juliangruber-brace-expansion-8c777ef/test/ghsa-qhr7-859c-m2p7.js000066400000000000000000000047461525206673000243230ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); // `expand` recurses once per level of brace *nesting*: once per comma member of // a set, and once when re-wrapping a set whose body is a single part. The // CVE-2026-14257 fix made the *tail* iterative (one level per chained group), // so chained input was already safe - nesting drives a different recursion that // the tail fix never touched. test('deep nesting does not overflow the stack', function (t) { // A set nested inside every comma member. Crashed at ~3,900 levels (~15.6KB). var members = '{a,'.repeat(10000) + 'z' + '}'.repeat(10000) t.doesNotThrow(function () { t.ok(expand(members).length > 0, 'comma members still return a result') }) // A set whose body parses to a single part, nested all the way down. The // cheapest payload: crashed at ~3,100 levels, about 6KB of input. var single = '{'.repeat(10000) + 'a,b' + '}'.repeat(10000) t.doesNotThrow(function () { t.ok(expand(single).length > 0, 'single set still returns a result') }) // Neither output bound could prevent this - the payloads expand to almost // nothing, so the result set never reaches either limit. t.doesNotThrow( function () { expand(single, { max: 1, maxLength: 1 }) }, 'still safe with both output bounds at their lowest' ) t.end(); }) test('maxDepth option bounds nesting depth', function (t) { // The bound counts levels of nesting followed, so a flat set never needs any: // its members are literals, and expanding them is what would recurse. t.deepEqual(expand('{a,b}', { maxDepth: 0 }), ['a', 'b']) // Below the bound the result is exactly what an unbounded expansion produces. var cases = ['{a,b}', '{{a,b}}', '{{{a,b}}}', '{a,{b,c}}', '{a,{b,{c,d}}}', 'x{{a,b}}y'] for (var i = 0; i < cases.length; i++) { t.deepEqual( expand(cases[i], { maxDepth: 50 }), expand(cases[i]), cases[i] + ' is unchanged below the bound' ) } // Past it, the group stops expanding and comes back literal rather than // throwing - the same way a group that cannot expand is already handled. t.deepEqual(expand('{{a,b}}', { maxDepth: 0 }), ['{{a,b}}']) t.deepEqual(expand('{{{a,b}}}', { maxDepth: 1 }), ['{{{a,b}}}']) t.deepEqual(expand('x{{a,b}}y', { maxDepth: 0 }), ['x{{a,b}}y']) // Partially: the levels within the bound still expand. t.deepEqual(expand('{a,{b,c}}', { maxDepth: 0 }), ['a', '{b,c}']) t.deepEqual(expand('{a,{b,{c,d}}}', { maxDepth: 1 }), ['a', 'b', '{c,d}']) t.end(); }) juliangruber-brace-expansion-8c777ef/test/ghsa-rgw5-rvv9-x895.js000066400000000000000000000064671525206673000244760ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); // Bypass of CVE-2026-14257's mitigation: each comma-separated alternative // (`{alt,alt,...}`) is expanded independently, and `maxLength` only bounded // each alternative's own output, not the running total accumulated across // all of them. Many alternatives - each individually far under `maxLength` - // could still sum to an unbounded intermediate array before the final // `combine` call ever got a chance to truncate. test('total length across comma alternatives is bounded', async t => { var alt = '{1..5}' var str = '{' + Array(1000).fill(alt).join(',') + '}' var startTime = performance.now() var expanded = expand(str, { maxLength: 50 }) var endTime = performance.now() var totalLength = expanded.reduce((sum, s) => sum + s.length, 0) t.ok( totalLength <= 50, `Expected total length (${totalLength}) to respect maxLength`, ) t.ok(expanded.length > 0, 'still returns a (truncated) result') t.ok( endTime - startTime < 500, `Expected time (${endTime - startTime}ms) to be less than 500ms`, ) // Regression case from the report: 400 alternatives, each individually // bounded by maxLength but unbounded in aggregate before the fix. var part = '{' + '0'.repeat(50) + '1..100000}' var bigStr = '{' + Array(400).fill(part).join(',') + '}' t.doesNotThrow(() => { var bigExpanded = expand(bigStr) var bigTotal = bigExpanded.reduce((sum, s) => sum + s.length, 0) t.ok( bigTotal <= 4_000_000, `Expected total length (${bigTotal}) to stay bounded`, ) }) t.end(); }) // A padded sequence's element width follows the input, so generating all `max` // elements before `combine` could discard them cost time proportional to // `max * width` - a ~400KB input blocked the event loop for over two minutes. test('padded sequences respect maxLength while generating', async t => { var str = '{' + '0'.repeat(400_000) + '1..100000}' var startTime = performance.now() var expanded = expand(str) var elapsed = performance.now() - startTime var totalLength = expanded.reduce((sum, s) => sum + s.length, 0) t.ok( totalLength <= 4_000_000, `Expected total length (${totalLength}) to stay bounded`, ) t.ok(expanded.length > 0, 'still returns a (truncated) result') t.ok( elapsed < 2000, `Expected time (${elapsed}ms) to be less than 2000ms`, ) // Truncating early must not change results that fit within the bound. t.same( expand('{01..10}'), ['01', '02', '03', '04', '05', '06', '07', '08', '09', '10'], 'padded sequences under the bound are unaffected', ) t.end(); }) // Bounding the intermediate `values` array must not change what `max` counts: // alternatives that expand to nothing are dropped by `combine`, so they cost a // slot in `values` but never a result. test('max bounds the number of kept results', async t => { t.same( expand('{a,,b}', { max: 2 }), ['a', 'b'], 'dropped empty alternatives do not count against max', ) t.same( expand('{a,,,b,c}', { max: 3 }), ['a', 'b', 'c'], 'consecutive empty alternatives do not count against max', ) // Here the empties survive as `xy`, so they are results and do count. t.same( expand('x{a,,b}y', { max: 2 }), ['xay', 'xy'], 'kept empty alternatives still count against max', ) t.end(); }) juliangruber-brace-expansion-8c777ef/test/negative-increment.js000066400000000000000000000007421525206673000250250ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); test('negative increment', function(t) { t.deepEqual(expand('{3..1}'), ['3', '2', '1']); t.deepEqual(expand('{10..8}'), ['10', '9', '8']); t.deepEqual(expand('{10..08}'), ['10', '09', '08']); t.deepEqual(expand('{c..a}'), ['c', 'b', 'a']); t.deepEqual(expand('{4..0..2}'), ['4', '2', '0']); t.deepEqual(expand('{4..0..-2}'), ['4', '2', '0']); t.deepEqual(expand('{e..a..2}'), ['e', 'c', 'a']); t.end(); }); juliangruber-brace-expansion-8c777ef/test/nested.js000066400000000000000000000006141525206673000225210ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); test('nested', function(t) { t.deepEqual(expand('{a,b{1..3},c}'), [ 'a', 'b1', 'b2', 'b3', 'c' ]); t.deepEqual(expand('{{A..Z},{a..z}}'), 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'.split('') ); t.deepEqual(expand('ppp{,config,oe{,conf}}'), [ 'ppp', 'pppconfig', 'pppoe', 'pppoeconf' ]); t.end(); }); juliangruber-brace-expansion-8c777ef/test/order.js000066400000000000000000000002501525206673000223460ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); test('order', function(t) { t.deepEqual(expand('a{d,c,b}e'), [ 'ade', 'ace', 'abe' ]); t.end(); }); juliangruber-brace-expansion-8c777ef/test/pad.js000066400000000000000000000003371525206673000220050ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); test('pad', function(t) { t.deepEqual(expand('{9..11}'), [ '9', '10', '11' ]); t.deepEqual(expand('{09..11}'), [ '09', '10', '11' ]); t.end(); }); juliangruber-brace-expansion-8c777ef/test/perf/000077500000000000000000000000001525206673000216345ustar00rootroot00000000000000juliangruber-brace-expansion-8c777ef/test/perf/bench.js000066400000000000000000000004171525206673000232530ustar00rootroot00000000000000'use strict'; var expand = require('../../'); var fs = require('fs'); var resfile = __dirname + '/../cases.txt'; var cases = fs.readFileSync(resfile, 'utf8').split('\n'); bench('Average', function() { cases.forEach(function(testcase) { expand(testcase); }); }); juliangruber-brace-expansion-8c777ef/test/redos.js000066400000000000000000000006051525206673000223530ustar00rootroot00000000000000import test from 'node:test' import assert from 'assert' import expand from '../index.js' test('redos', function () { const str = '{a}' + ','.repeat(100000) + '\u0000' const startTime = performance.now() expand(str) const endTime = performance.now() const timeTaken = endTime - startTime assert.ok(timeTaken < 1000, `Expected time (${timeTaken}ms) to be less than 1000ms`) }) juliangruber-brace-expansion-8c777ef/test/same-type.js000066400000000000000000000002401525206673000231360ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); test('x and y of same type', function(t) { t.deepEqual(expand('{a..9}'), ['{a..9}']); t.end(); }); juliangruber-brace-expansion-8c777ef/test/sequence.js000066400000000000000000000042421525206673000230500ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); test('numeric sequences', function(t) { t.deepEqual(expand('a{1..2}b{2..3}c'), [ 'a1b2c', 'a1b3c', 'a2b2c', 'a2b3c' ]); t.deepEqual(expand('{1..2}{2..3}'), [ '12', '13', '22', '23' ]); t.end(); }); test('numeric sequences with step count', function(t) { t.deepEqual(expand('{0..8..2}'), [ '0', '2', '4', '6', '8' ]); t.deepEqual(expand('{1..8..2}'), [ '1', '3', '5', '7' ]); t.end(); }); test('numeric sequence with negative x / y', function(t) { t.deepEqual(expand('{3..-2}'), [ '3', '2', '1', '0', '-1', '-2' ]); t.end(); }); test('alphabetic sequences', function(t) { t.deepEqual(expand('1{a..b}2{b..c}3'), [ '1a2b3', '1a2c3', '1b2b3', '1b2c3' ]); t.deepEqual(expand('{a..b}{b..c}'), [ 'ab', 'ac', 'bb', 'bc' ]); t.end(); }); test('alphabetic sequences with step count', function(t) { t.deepEqual(expand('{a..k..2}'), [ 'a', 'c', 'e', 'g', 'i', 'k' ]); t.deepEqual(expand('{b..k..2}'), [ 'b', 'd', 'f', 'h', 'j' ]); t.end(); }); test('multiple sequences max', function(t) { var str = '{1..10}'.repeat(10); var expanded10 = expand(str, { max: 10 }); t.deepEqual(expanded10, [ '1111111111', '1111111112', '1111111113', '1111111114', '1111111115', '1111111116', '1111111117', '1111111118', '1111111119', '11111111110' ], 'custom max truncates expansion'); t.equal(expanded10.length, 10, 'custom max is respected'); // 11^5 == 161051 combinations, truncated to the default `max`. var large = '{1..11}'.repeat(5); t.equal(expand(large).length, 100000, 'default max caps expansion'); t.end(); }); test('single sequence max', function(t) { const str = '{1..100000000}'; var expanded = expand(str, { max: 10 }); t.deepEqual(expanded, ['1', '2', '3', '4', '5', '6', '7', '8', '9', '10'], 'custom max truncates expansion'); t.equal(expanded.length, 10, 'custom max is respected'); var large = '{1..10000}'; t.equal(expand(large).length, 10000, 'expansions under the default max are untouched'); t.equal(expand('{1..1000000}').length, 100000, 'default max caps expansion'); t.end(); }); juliangruber-brace-expansion-8c777ef/test/unbound-recursion.js000066400000000000000000000014061525206673000247200ustar00rootroot00000000000000var test = require('tape'); var expand = require('..'); // https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp test('unbound recursion', async t => { // A run of non-expanding `{}` groups used to expand `post` once per group, // doubling the work on every group. This 30-group, 90 byte input blocked // for minutes. const str = 'a{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{}' const startTime = performance.now() const expanded = expand(str) const endTime = performance.now() const timeTaken = endTime - startTime t.deepEqual(expanded, [str], 'does not expand') t.ok( timeTaken < 1000, `Expected time (${timeTaken}ms) to be less than 1000ms`, ) t.end() })