Merge commit from fork

* test: backport

* fix: bound expansion length across comma alternatives and sequences

* fix: don't count dropped empties against `max`

Capping the intermediate `values` array at `max` entries counted
alternatives that `combine` goes on to drop as empty, so `max` stopped
bounding the number of *kept* results: `expand('{a,,b}', { max: 2 })`
returned `['a']` where it used to return `['a', 'b']`.

Skip those values rather than counting them. The cap itself stays - it is
what bounds the array when the values are empty and so contribute no
characters for `maxLength` to see.

---------

Co-authored-by: Gareth Jones <3151613+G-Rath@users.noreply.github.com>

Author: juliangruber

index.js

@@ -158,7 +158,8 @@ function combine(
 function expandSequence(
   body,
   isAlphaSequence,
-  max
+  max,
+  maxLength
 ) {
   var n = body.split(/\.\./)
   var N = []
@@ -184,6 +185,7 @@ function expandSequence(
   }
   var pad = n.some(isPadded)
 
+  var length = 0
   for (var i = x; test(i, y) && N.length < max; i += incr) {
     var c
     if (isAlphaSequence) {
@@ -205,7 +207,9 @@ function expandSequence(
         }
       }
     }
+    if (length + c.length > maxLength) break
     N.push(c)
+    length += c.length
   }
   return N
 }
@@ -301,7 +305,7 @@ function expand(
 
     var values;
     if (isSequence) {
-      values = expandSequence(m.body, isAlphaSequence, max);
+      values = expandSequence(m.body, isAlphaSequence, max, maxLength);
     } else {
       var n = parseCommaParts(m.body);
       if (n.length === 1 && n[0] !== undefined) {
@@ -329,9 +333,32 @@ function expand(
         /* c8 ignore stop */
       }
 
+      // Values that `combine` is going to drop as empty produce no result, so
+      // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+      // would stop at `['a', '']` and yield one result instead of two. Skipping
+      // them outright keeps `values` bounded while leaving `max` a bound on
+      // *kept* results. A value is dropped when it adds nothing past the
+      // baseline, which is what `combine` tests.
+      var dropsEmpties = dropEmpties && !m.post.length && !pre
+      for (var d = 0; dropsEmpties && d < acc.length; d++) {
+        if (acc[d].length !== accBase[d]) {
+          dropsEmpties = false
+        }
+      }
+
       values = []
-      for (var j = 0; j < n.length; j++) {
-        values.push.apply(values, expand(n[j], max, maxLength, false))
+      var valuesLength = 0
+      outer: for (var j = 0; j < n.length; j++) {
+        var expanded = expand(n[j], max, maxLength, false)
+        for (var k = 0; k < expanded.length; k++) {
+          var v = expanded[k]
+          if (dropsEmpties && !v) continue
+          if (values.length >= max || valuesLength + v.length > maxLength) {
+            break outer
+          }
+          values.push(v)
+          valuesLength += v.length
+        }
       }
     }
 

test/ghsa-rgw5-rvv9-x895.js

@@ -0,0 +1,96 @@
+var test = require('tape');
+var expand = require('..');
+
+// Bypass of CVE-2026-14257's mitigation: each comma-separated alternative
+// (`{alt,alt,...}`) is expanded independently, and `maxLength` only bounded
+// each alternative's own output, not the running total accumulated across
+// all of them. Many alternatives - each individually far under `maxLength` -
+// could still sum to an unbounded intermediate array before the final
+// `combine` call ever got a chance to truncate.
+test('total length across comma alternatives is bounded', async t => {
+  var alt = '{1..5}'
+  var str = '{' + Array(1000).fill(alt).join(',') + '}'
+  var startTime = performance.now()
+  var expanded = expand(str, { maxLength: 50 })
+  var endTime = performance.now()
+
+  var totalLength = expanded.reduce((sum, s) => sum + s.length, 0)
+  t.ok(
+    totalLength <= 50,
+    `Expected total length (${totalLength}) to respect maxLength`,
+  )
+  t.ok(expanded.length > 0, 'still returns a (truncated) result')
+  t.ok(
+    endTime - startTime < 500,
+    `Expected time (${endTime - startTime}ms) to be less than 500ms`,
+  )
+
+  // Regression case from the report: 400 alternatives, each individually
+  // bounded by maxLength but unbounded in aggregate before the fix.
+  var part = '{' + '0'.repeat(50) + '1..100000}'
+  var bigStr = '{' + Array(400).fill(part).join(',') + '}'
+  t.doesNotThrow(() => {
+    var bigExpanded = expand(bigStr)
+    var bigTotal = bigExpanded.reduce((sum, s) => sum + s.length, 0)
+    t.ok(
+      bigTotal <= 4_000_000,
+      `Expected total length (${bigTotal}) to stay bounded`,
+    )
+  })
+
+  t.end();
+})
+
+// A padded sequence's element width follows the input, so generating all `max`
+// elements before `combine` could discard them cost time proportional to
+// `max * width` - a ~400KB input blocked the event loop for over two minutes.
+test('padded sequences respect maxLength while generating', async t => {
+  var str = '{' + '0'.repeat(400_000) + '1..100000}'
+  var startTime = performance.now()
+  var expanded = expand(str)
+  var elapsed = performance.now() - startTime
+
+  var totalLength = expanded.reduce((sum, s) => sum + s.length, 0)
+  t.ok(
+    totalLength <= 4_000_000,
+    `Expected total length (${totalLength}) to stay bounded`,
+  )
+  t.ok(expanded.length > 0, 'still returns a (truncated) result')
+  t.ok(
+    elapsed < 2000,
+    `Expected time (${elapsed}ms) to be less than 2000ms`,
+  )
+
+  // Truncating early must not change results that fit within the bound.
+  t.same(
+    expand('{01..10}'),
+    ['01', '02', '03', '04', '05', '06', '07', '08', '09', '10'],
+    'padded sequences under the bound are unaffected',
+  )
+
+  t.end();
+})
+
+// Bounding the intermediate `values` array must not change what `max` counts:
+// alternatives that expand to nothing are dropped by `combine`, so they cost a
+// slot in `values` but never a result.
+test('max bounds the number of kept results', async t => {
+  t.same(
+    expand('{a,,b}', { max: 2 }),
+    ['a', 'b'],
+    'dropped empty alternatives do not count against max',
+  )
+  t.same(
+    expand('{a,,,b,c}', { max: 3 }),
+    ['a', 'b', 'c'],
+    'consecutive empty alternatives do not count against max',
+  )
+  // Here the empties survive as `xy`, so they are results and do count.
+  t.same(
+    expand('x{a,,b}y', { max: 2 }),
+    ['xay', 'xy'],
+    'kept empty alternatives still count against max',
+  )
+
+  t.end();
+})