[PR #1386] [MERGED] fix(javascript): handle oversized inline source maps #2845

New issue

Closed

opened 2026-10-17 21:10:58 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:10:58 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1386
Author: @cold-atom
Created: 10/10/2026
Status: ✅ Merged
Merged: 10/10/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/issue-1380

📝 Commits (2)

3a28bc0 fix(javascript): handle oversized inline source maps
b117b12 fix(javascript): avoid source map directive regex overflow

📊 Changes

2 files changed (+80 additions, -7 deletions)

View changed files

📝 src/domain/javascript/javascriptStaticAnalysisCalls.ts (+26 -7)
📝 src/domain/javascript/javascriptStaticAnalysisSourceMaps.test.ts (+54 -0)

📄 Description

A large inline source-map directive in a two-byte JavaScript source can overflow V8's regexp stack before application analysis finishes. Read the directive with fixed-prefix checks and single-character-class searches, preserving complete declared URLs and source ranges. This also handles long whitespace before the name, equals sign, and URL.

Fixes #1380.

Validation of final head b117b121:

npm run test:focused -- src/domain/javascript/javascriptStaticAnalysisSourceMaps.test.ts: 34 passed.
Real public CLI, Node 24.18.0 and Node 22.22.2: the same 38.1 MB source-owned application fails on main 7aa4d768 and succeeds here; its 9,600,223-character inline URL and three 9.5M-space directive variants retain exact URLs.
Real stdio MCP, Node 24.18.0: analysis completes, reports the existing transport resource constraint, and exports the complete retained Evidence in the same session. This verifies recovery, not that the result fits the default receive budget.
Final-head CI and real JavaScript recovery both pass.

No Hopper/Ghidra verification was needed for this JavaScript parser change.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1386 **Author:** [@cold-atom](https://github.com/cold-atom) **Created:** 10/10/2026 **Status:** ✅ Merged **Merged:** 10/10/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/issue-1380` --- ### 📝 Commits (2) - [`3a28bc0`](https://github.com/morluto/rea/commit/3a28bc0e13ed8e7c81fd72d6a60eeb7c1b0406e2) fix(javascript): handle oversized inline source maps - [`b117b12`](https://github.com/morluto/rea/commit/b117b121e1e2e3d848cc57a34f344967cffc6cbf) fix(javascript): avoid source map directive regex overflow ### 📊 Changes **2 files changed** (+80 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascript/javascriptStaticAnalysisCalls.ts` (+26 -7) 📝 `src/domain/javascript/javascriptStaticAnalysisSourceMaps.test.ts` (+54 -0) </details> ### 📄 Description A large inline source-map directive in a two-byte JavaScript source can overflow V8's regexp stack before application analysis finishes. Read the directive with fixed-prefix checks and single-character-class searches, preserving complete declared URLs and source ranges. This also handles long whitespace before the name, equals sign, and URL. Fixes #1380. Validation of final head `b117b121`: - `npm run test:focused -- src/domain/javascript/javascriptStaticAnalysisSourceMaps.test.ts`: 34 passed. - Real public CLI, Node 24.18.0 and Node 22.22.2: the same 38.1 MB source-owned application fails on main `7aa4d768` and succeeds here; its 9,600,223-character inline URL and three 9.5M-space directive variants retain exact URLs. - Real stdio MCP, Node 24.18.0: analysis completes, reports the existing transport resource constraint, and exports the complete retained Evidence in the same session. This verifies recovery, not that the result fits the default receive budget. - Final-head CI and real JavaScript recovery both pass. No Hopper/Ghidra verification was needed for this JavaScript parser change. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:10:58 +00:00