Merge commit from fork

* Bound total expansion length across comma alternatives

`maxLength` was enforced in `combine`, the one place output grows, but not on
the `values` array built to feed it. Each alternative in `{a,b,c,...}` is
expanded by its own `expand_` call, so each received a full independent
`maxLength` allowance, and the results were concatenated with no running total.
With `A` alternatives, `values` could reach `A * maxLength` characters before
`combine` ever got the chance to truncate it.

A ~25 KB input with 400 alternatives grew `values` past the heap limit and
crashed the process with an uncatchable out-of-memory error, bypassing the
mitigation added in 5.0.8 for CVE-2026-14257.

Track the running result count and character length while appending
alternatives, and stop once either bound is reached.

* Apply maxLength while generating sequences

`expandSequence` was bounded by `max`, the result count, but never consulted
`maxLength`. A padded element's width follows the input, so a wide pad made it
generate `max` wide elements only for `combine` to discard nearly all of them.

Memory stays flat here, since V8 represents those padded strings as
cons-strings, which is likely why this path was not caught alongside the
memory-exhaustion issue. The cost is time instead, proportional to
`max * width`: a ~400 KB input blocked the event loop for over two minutes.

Pass `maxLength` into the generation loop and stop once the sequence's own
characters reach it. Output is byte-identical; only the discarded work is
removed. The same input now returns in ~18 ms.

* fix: don't count dropped empties against `max`

Capping the intermediate `values` array at `max` entries counted
alternatives that `combine` goes on to drop as empty, so `max` stopped
bounding the number of *kept* results: `expand('{a,,b}', { max: 2 })`
returned `['a']` where it used to return `['a', 'b']`.

Skip those values rather than counting them. The cap itself stays - it is
what bounds the array when the values are empty and so contribute no
characters for `maxLength` to see.

Author: juliangruber

src/index.ts

@@ -161,6 +161,7 @@ function expandSequence(
   body: string,
   isAlphaSequence: boolean,
   max: number,
+  maxLength: number,
 ): string[] {
   const n = body.split(/\.\./)
   const N: string[] = []
@@ -186,6 +187,7 @@ function expandSequence(
   }
   const pad = n.some(isPadded)
 
+  let length = 0
   for (let i = x; test(i, y) && N.length < max; i += incr) {
     let c
     if (isAlphaSequence) {
@@ -207,7 +209,9 @@ function expandSequence(
         }
       }
     }
+    if (length + c.length > maxLength) break
     N.push(c)
+    length += c.length
   }
   return N
 }
@@ -290,7 +294,7 @@ function expand_(
 
     let values: string[]
     if (isSequence) {
-      values = expandSequence(m.body, isAlphaSequence, max)
+      values = expandSequence(m.body, isAlphaSequence, max, maxLength)
     } else {
       let n = parseCommaParts(m.body)
       if (n.length === 1 && n[0] !== undefined) {
@@ -314,9 +318,31 @@ function expand_(
         /* c8 ignore stop */
       }
 
+      // Values that `combine` is going to drop as empty produce no result, so
+      // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+      // would stop at `['a', '']` and yield one result instead of two. Skipping
+      // them outright keeps `values` bounded while leaving `max` a bound on
+      // *kept* results.
+      let dropsEmpties = dropEmpties && !m.post.length && !pre
+      for (let d = 0; dropsEmpties && d < acc.length; d++) {
+        if (acc[d]) {
+          dropsEmpties = false
+        }
+      }
+
       values = []
-      for (let j = 0; j < n.length; j++) {
-        values.push.apply(values, expand_(n[j] as string, max, maxLength, false))
+      let valuesLength = 0
+      outer: for (let j = 0; j < n.length; j++) {
+        const expanded = expand_(n[j] as string, max, maxLength, false)
+        for (let k = 0; k < expanded.length; k++) {
+          const v = expanded[k] as string
+          if (dropsEmpties && !v) continue
+          if (values.length >= max || valuesLength + v.length > maxLength) {
+            break outer
+          }
+          values.push(v)
+          valuesLength += v.length
+        }
       }
     }
 

test/index.js

@@ -277,3 +277,91 @@ t.test('maxLength option bounds output size', async t => {
     `Expected total length (${dollarLength}) to respect maxLength`,
   )
 })
+
+// Bypass of CVE-2026-14257's mitigation: each comma-separated alternative
+// (`{alt,alt,...}`) is expanded independently, and `maxLength` only bounded
+// each alternative's own output, not the running total accumulated across
+// all of them. Many alternatives - each individually far under `maxLength` -
+// could still sum to an unbounded intermediate array before the final
+// `combine` call ever got a chance to truncate.
+t.test('total length across comma alternatives is bounded', async t => {
+  const alt = '{1..5}'
+  const str = '{' + Array(1000).fill(alt).join(',') + '}'
+  const startTime = performance.now()
+  const expanded = expand(str, { maxLength: 50 })
+  const endTime = performance.now()
+
+  const totalLength = expanded.reduce((sum, s) => sum + s.length, 0)
+  t.ok(
+    totalLength <= 50,
+    `Expected total length (${totalLength}) to respect maxLength`,
+  )
+  t.ok(expanded.length > 0, 'still returns a (truncated) result')
+  t.ok(
+    endTime - startTime < 500,
+    `Expected time (${endTime - startTime}ms) to be less than 500ms`,
+  )
+
+  // Regression case from the report: 400 alternatives, each individually
+  // bounded by maxLength but unbounded in aggregate before the fix.
+  const part = '{' + '0'.repeat(50) + '1..100000}'
+  const bigStr = '{' + Array(400).fill(part).join(',') + '}'
+  t.doesNotThrow(() => {
+    const bigExpanded = expand(bigStr)
+    const bigTotal = bigExpanded.reduce((sum, s) => sum + s.length, 0)
+    t.ok(
+      bigTotal <= 4_000_000,
+      `Expected total length (${bigTotal}) to stay bounded`,
+    )
+  })
+})
+
+// A padded sequence's element width follows the input, so generating all `max`
+// elements before `combine` could discard them cost time proportional to
+// `max * width` - a ~400KB input blocked the event loop for over two minutes.
+t.test('padded sequences respect maxLength while generating', async t => {
+  const str = '{' + '0'.repeat(400_000) + '1..100000}'
+  const startTime = performance.now()
+  const expanded = expand(str)
+  const elapsed = performance.now() - startTime
+
+  const totalLength = expanded.reduce((sum, s) => sum + s.length, 0)
+  t.ok(
+    totalLength <= 4_000_000,
+    `Expected total length (${totalLength}) to stay bounded`,
+  )
+  t.ok(expanded.length > 0, 'still returns a (truncated) result')
+  t.ok(
+    elapsed < 2000,
+    `Expected time (${elapsed}ms) to be less than 2000ms`,
+  )
+
+  // Truncating early must not change results that fit within the bound.
+  t.same(
+    expand('{01..10}'),
+    ['01', '02', '03', '04', '05', '06', '07', '08', '09', '10'],
+    'padded sequences under the bound are unaffected',
+  )
+})
+
+// Bounding the intermediate `values` array must not change what `max` counts:
+// alternatives that expand to nothing are dropped by `combine`, so they cost a
+// slot in `values` but never a result.
+t.test('max bounds the number of kept results', async t => {
+  t.same(
+    expand('{a,,b}', { max: 2 }),
+    ['a', 'b'],
+    'dropped empty alternatives do not count against max',
+  )
+  t.same(
+    expand('{a,,,b,c}', { max: 3 }),
+    ['a', 'b', 'c'],
+    'consecutive empty alternatives do not count against max',
+  )
+  // Here the empties survive as `xy`, so they are results and do count.
+  t.same(
+    expand('x{a,,b}y', { max: 2 }),
+    ['xay', 'xy'],
+    'kept empty alternatives still count against max',
+  )
+})