mirror/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea synced 2026-10-28 06:46:47 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(schema): compose portable stack-safe base64 constraints

Browse Source 
Replace the lookahead-based pattern with separate allOf/not JSON Schema rules for quartet length, alphabet, padding and canonical pad bits. Share the runtime predicates with HAR and padded base64 parsing.

Validate converted advertised leaves with the MCP SDK validator, preserve permissive versus canonical semantics, and exercise every pattern near the 32 MiB encoded-input budget in all JavaScript modes.
This commit is contained in:
morluto
2026-10-20 00:03:45 +08:00
parent 4af71a45f9
commit 0949313d8f
8 changed files with 174 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/domain/stringPatterns.ts
+36 -12
View File
@@ -1,20 +1,44 @@
import { z } from "zod";
/** Portable ASCII identifier starting with a letter. */
export const IDENTIFIER_PATTERN = /^[A-Za-z][A-Za-z0-9._\x2d]*$/u;
/** Stable evidence identifier, also admitting namespace and path separators. */
export const STABLE_IDENTIFIER_PATTERN = /^[A-Za-z][A-Za-z0-9._:\x2f\x2d]*$/u;
// Repeated alphabet quartets exhaust V8's regexp stack on large bodies,
// including under JSON Schema's Unicode-set mode. Check alphabet and terminal
// padding separately, leaving an unconstrained fixed-width loop for length.
const PADDED_BASE64_PREFIX = String.raw`^(?!.*[^A-Za-z0-9+\x2f=])(?!.*=[^=])(?!.*===)`;
// These rules are separate JSON Schema constraints. A single RE2-compatible
// regex for alphabet and quartet validity requires a repeated alphabet group;
// V8's Unicode-set engine overflows its regexp stack on that group near the
// provider's 32 MiB encoded-input budget. Wildcard quartets and literal bad
// token probes stay stack-safe at that size and compose exactly with `allOf`.
export const BASE64_QUARTET_LENGTH_PATTERN = /^(?:....)*$/;
export const INVALID_BASE64_CHARACTER_PATTERN = /[^A-Za-z0-9+\x2f=]/;
export const INVALID_BASE64_PADDING_PATTERN = /(?:=[^=]|===)/;
export const INVALID_CANONICAL_BASE64_PAD_BITS_PATTERN =
/(?:[^AQgw]==$|[BCDFGHJKLNOPRSTVWXZabdefhijlmnpqrtuvxyz1235679+\x2f]=$)/;
/** Padded base64 syntax, allowing nonzero pad bits and the empty encoding. */
export const PADDED_BASE64_PATTERN = new RegExp(
`${PADDED_BASE64_PREFIX}(?:....)*$`,
);
export const isPaddedBase64 = (value: string): boolean =>
value.length % 4 === 0 &&
!INVALID_BASE64_CHARACTER_PATTERN.test(value) &&
!INVALID_BASE64_PADDING_PATTERN.test(value);
/** Canonical padded base64, including zero pad bits and the empty encoding. */
export const CANONICAL_BASE64_PATTERN = new RegExp(
`${PADDED_BASE64_PREFIX}(?!.*[^AQgw]==$)(?!.*[^AEIMQUYcgkosw048=]=$)(?:....)*$`,
);
export const isCanonicalBase64 = (value: string): boolean =>
isPaddedBase64(value) &&
!INVALID_CANONICAL_BASE64_PAD_BITS_PATTERN.test(value);
const paddedBase64SchemaRules = [
{ pattern: BASE64_QUARTET_LENGTH_PATTERN.source },
{ not: { pattern: INVALID_BASE64_CHARACTER_PATTERN.source } },
{ not: { pattern: INVALID_BASE64_PADDING_PATTERN.source } },
];
/** Canonical padded base64 with zero pad bits, including the empty encoding. */
export const canonicalBase64Schema = z
.string()
.refine(isCanonicalBase64, "Expected canonical padded base64")
.meta({
allOf: [
...paddedBase64SchemaRules,
{ not: { pattern: INVALID_CANONICAL_BASE64_PAD_BITS_PATTERN.source } },
],
});