Publish curated Unraid-AppOps-Gateway source from 2e53f628d284213b90ca2f9c5e121671f5933574

src/lib/buildDependencySecurity.test.ts

@@ -0,0 +1,37 @@
+import assert from "node:assert/strict";
+import { createRequire } from "node:module";
+import { describe, it } from "node:test";
+
+// Exercise the dependency actually used by Tailwind's globbing toolchain.
+// A direct root import would miss the transitive version selected by pnpm.
+let requireFromPackage = createRequire(import.meta.url);
+for (const packageName of ["tailwindcss", "sucrase", "glob", "minimatch"]) {
+  requireFromPackage = createRequire(
+    requireFromPackage.resolve(`${packageName}/package.json`),
+  );
+}
+const { expand } = requireFromPackage("brace-expansion") as {
+  expand: (pattern: string) => string[];
+};
+
+describe("build dependency security", () => {
+  it("preserves ordinary brace expansion", () => {
+    assert.deepEqual(expand("assets/{one,two}.css"), [
+      "assets/one.css",
+      "assets/two.css",
+    ]);
+  });
+
+  it("bounds deeply nested brace sets without overflowing the stack", () => {
+    const pattern = "{".repeat(3200) + "a,b" + "}".repeat(3200);
+    let result: string[] = [];
+    assert.doesNotThrow(() => { result = expand(pattern); });
+    assert.ok(Array.isArray(result));
+    assert.ok(result.length <= 2);
+  });
+
+  it("bounds deeply nested comma alternatives without overflowing the stack", () => {
+    const pattern = "{a,".repeat(4000) + "z" + "}".repeat(4000);
+    assert.doesNotThrow(() => expand(pattern));
+  });
+});