actions/setup-java
5
0
Fork 0
mirror of https://gitea.com/actions/setup-java.git synced 2026-08-05 02:31:18 +00:00
Code Activity

Update brace-expansion security fix

Browse Source 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Bruno Borges
2026-08-04 19:47:45 -04:00
parent c4ba924625
commit b5c6639b25
3 changed files with 63 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/cleanup/767.index.js
Vendored
+30 -4
View File
@@ -59543,7 +59543,7 @@ function combine(acc, pre, values, max, maxLength, dropEmpties) {
}
// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
// sequence body.
function expandSequence(body, isAlphaSequence, max) {
function expandSequence(body, isAlphaSequence, max, maxLength) {
const n = body.split(/\.\./);
const N = [];
// A sequence body always splits into two or three parts, but the compiler
@@ -59566,6 +59566,7 @@ function expandSequence(body, isAlphaSequence, max) {
test = gte;
}
const pad = n.some(isPadded);
let length = 0;
for (let i = x; test(i, y) && N.length < max; i += incr) {
let c;
if (isAlphaSequence) {
@@ -59589,7 +59590,10 @@ function expandSequence(body, isAlphaSequence, max) {
}
}
}
if (length + c.length > maxLength)
break;
N.push(c);
length += c.length;
}
return N;
}
@@ -59643,7 +59647,7 @@ function expand_(str, max, maxLength, isTop) {
}
let values;
if (isSequence) {
values = expandSequence(m.body, isAlphaSequence, max);
values = expandSequence(m.body, isAlphaSequence, max, maxLength);
}
else {
let n = parseCommaParts(m.body);
@@ -59661,9 +59665,31 @@ function expand_(str, max, maxLength, isTop) {
}
/* c8 ignore stop */
}
// Values that `combine` is going to drop as empty produce no result, so
// they must not count against `max` - otherwise `{a,,b}` with `max: 2`
// would stop at `['a', '']` and yield one result instead of two. Skipping
// them outright keeps `values` bounded while leaving `max` a bound on
// *kept* results.
let dropsEmpties = dropEmpties && !m.post.length && !pre;
for (let d = 0; dropsEmpties && d < acc.length; d++) {
if (acc[d]) {
dropsEmpties = false;
}
}
values = [];
for (let j = 0; j < n.length; j++) {
values.push.apply(values, expand_(n[j], max, maxLength, false));
let valuesLength = 0;
outer: for (let j = 0; j < n.length; j++) {
const expanded = expand_(n[j], max, maxLength, false);
for (let k = 0; k < expanded.length; k++) {
const v = expanded[k];
if (dropsEmpties && !v)
continue;
if (values.length >= max || valuesLength + v.length > maxLength) {
break outer;
}
values.push(v);
valuesLength += v.length;
}
}
}
acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
dist/setup/971.index.js
Vendored
+30 -4
View File
@@ -52531,7 +52531,7 @@ function combine(acc, pre, values, max, maxLength, dropEmpties) {
}
// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
// sequence body.
function expandSequence(body, isAlphaSequence, max) {
function expandSequence(body, isAlphaSequence, max, maxLength) {
const n = body.split(/\.\./);
const N = [];
// A sequence body always splits into two or three parts, but the compiler
@@ -52554,6 +52554,7 @@ function expandSequence(body, isAlphaSequence, max) {
test = gte;
}
const pad = n.some(isPadded);
let length = 0;
for (let i = x; test(i, y) && N.length < max; i += incr) {
let c;
if (isAlphaSequence) {
@@ -52577,7 +52578,10 @@ function expandSequence(body, isAlphaSequence, max) {
}
}
}
if (length + c.length > maxLength)
break;
N.push(c);
length += c.length;
}
return N;
}
@@ -52631,7 +52635,7 @@ function expand_(str, max, maxLength, isTop) {
}
let values;
if (isSequence) {
values = expandSequence(m.body, isAlphaSequence, max);
values = expandSequence(m.body, isAlphaSequence, max, maxLength);
}
else {
let n = parseCommaParts(m.body);
@@ -52649,9 +52653,31 @@ function expand_(str, max, maxLength, isTop) {
}
/* c8 ignore stop */
}
// Values that `combine` is going to drop as empty produce no result, so
// they must not count against `max` - otherwise `{a,,b}` with `max: 2`
// would stop at `['a', '']` and yield one result instead of two. Skipping
// them outright keeps `values` bounded while leaving `max` a bound on
// *kept* results.
let dropsEmpties = dropEmpties && !m.post.length && !pre;
for (let d = 0; dropsEmpties && d < acc.length; d++) {
if (acc[d]) {
dropsEmpties = false;
}
}
values = [];
for (let j = 0; j < n.length; j++) {
values.push.apply(values, expand_(n[j], max, maxLength, false));
let valuesLength = 0;
outer: for (let j = 0; j < n.length; j++) {
const expanded = expand_(n[j], max, maxLength, false);
for (let k = 0; k < expanded.length; k++) {
const v = expanded[k];
if (dropsEmpties && !v)
continue;
if (values.length >= max || valuesLength + v.length > maxLength) {
break outer;
}
values.push(v);
valuesLength += v.length;
}
}
}
acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);