Brunobkr/llama.cpp_AlgMor24_github

1/*2Copyright (c) 2014, Yahoo! Inc. All rights reserved.3Copyrights licensed under the New BSD License.4See the accompanying LICENSE file for terms.5*/6 7'use strict';8 9// Generate an internal UID to make the regexp pattern harder to guess.10var UID_LENGTH          = 16;11var UID                 = generateUID();12var PLACE_HOLDER_REGEXP = new RegExp('(\\\\)?"@__(F|R|D|M|S|A|U|I|B|L)-' + UID + '-(\\d+)__@"', 'g');13 14var IS_NATIVE_CODE_REGEXP = /\{\s*\[native code\]\s*\}/g;15var IS_PURE_FUNCTION = /function.*?\(/;16var IS_ARROW_FUNCTION = /.*?=>.*?/;17var UNSAFE_CHARS_REGEXP   = /[<>\/\u2028\u2029]/g;18// Regex to match </script> and variations (case-insensitive) for XSS protection19// Matches </script followed by optional whitespace/attributes and >20var SCRIPT_CLOSE_REGEXP = /<\/script[^>]*>/gi;21 22var RESERVED_SYMBOLS = ['*', 'async'];23 24// Mapping of unsafe HTML and invalid JavaScript line terminator chars to their25// Unicode char counterparts which are safe to use in JavaScript strings.26var ESCAPED_CHARS = {27    '<'     : '\\u003C',28    '>'     : '\\u003E',29    '/'     : '\\u002F',30    '\u2028': '\\u2028',31    '\u2029': '\\u2029'32};33 34function escapeUnsafeChars(unsafeChar) {35    return ESCAPED_CHARS[unsafeChar];36}37 38// Escape function body for XSS protection while preserving arrow function syntax39function escapeFunctionBody(str) {40    // Escape </script> sequences and variations (case-insensitive) - the main XSS risk41    // Matches </script followed by optional whitespace/attributes and >42    // This must be done first before other replacements43    str = str.replace(SCRIPT_CLOSE_REGEXP, function(match) {44        // Escape all <, /, and > characters in the closing script tag45        return match.replace(/</g, '\\u003C').replace(/\//g, '\\u002F').replace(/>/g, '\\u003E');46    });47    // Escape line terminators (these are always unsafe)48    str = str.replace(/\u2028/g, '\\u2028');49    str = str.replace(/\u2029/g, '\\u2029');50    return str;51}52 53function generateUID() {54    var bytes = crypto.getRandomValues(new Uint8Array(UID_LENGTH));55    var result = '';56    for(var i=0; i<UID_LENGTH; ++i) {57        result += bytes[i].toString(16);58    }59    return result;60}61 62function deleteFunctions(obj){63    var functionKeys = [];64    for (var key in obj) {65        if (typeof obj[key] === "function") {66            functionKeys.push(key);67        }68    }69    for (var i = 0; i < functionKeys.length; i++) {70        delete obj[functionKeys[i]];71    }72}73 74module.exports = function serialize(obj, options) {75    options || (options = {});76 77    // Backwards-compatibility for `space` as the second argument.78    if (typeof options === 'number' || typeof options === 'string') {79        options = {space: options};80    }81 82    var functions = [];83    var regexps   = [];84    var dates     = [];85    var maps      = [];86    var sets      = [];87    var arrays    = [];88    var undefs    = [];89    var infinities= [];90    var bigInts = [];91    var urls = [];92 93    // Returns placeholders for functions and regexps (identified by index)94    // which are later replaced by their string representation.95    function replacer(key, value) {96 97        // For nested function98        if(options.ignoreFunction){99            deleteFunctions(value);100        }101 102        if (!value && value !== undefined && value !== BigInt(0)) {103            return value;104        }105 106        // If the value is an object w/ a toJSON method, toJSON is called before107        // the replacer runs, so we use this[key] to get the non-toJSONed value.108        var origValue = this[key];109        var type = typeof origValue;110 111        if (type === 'object') {112            if(origValue instanceof RegExp) {113                return '@__R-' + UID + '-' + (regexps.push(origValue) - 1) + '__@';114            }115 116            if(origValue instanceof Date) {117                return '@__D-' + UID + '-' + (dates.push(origValue) - 1) + '__@';118            }119 120            if(origValue instanceof Map) {121                return '@__M-' + UID + '-' + (maps.push(origValue) - 1) + '__@';122            }123 124            if(origValue instanceof Set) {125                return '@__S-' + UID + '-' + (sets.push(origValue) - 1) + '__@';126            }127 128            if(Array.isArray(origValue)) {129                var isSparse = Object.keys(origValue).length !== origValue.length;130                if (isSparse) {131                    return '@__A-' + UID + '-' + (arrays.push(origValue) - 1) + '__@';132                }133            }134 135            if(origValue instanceof URL) {136                return '@__L-' + UID + '-' + (urls.push(origValue) - 1) + '__@';137            }138        }139 140        if (type === 'function') {141            return '@__F-' + UID + '-' + (functions.push(origValue) - 1) + '__@';142        }143 144        if (type === 'undefined') {145            return '@__U-' + UID + '-' + (undefs.push(origValue) - 1) + '__@';146        }147 148        if (type === 'number' && !isNaN(origValue) && !isFinite(origValue)) {149            return '@__I-' + UID + '-' + (infinities.push(origValue) - 1) + '__@';150        }151 152        if (type === 'bigint') {153            return '@__B-' + UID + '-' + (bigInts.push(origValue) - 1) + '__@';154        }155 156        return value;157    }158 159    function serializeFunc(fn, options) {160      var serializedFn = fn.toString();161      if (IS_NATIVE_CODE_REGEXP.test(serializedFn)) {162          throw new TypeError('Serializing native function: ' + fn.name);163      }164 165      // Escape unsafe HTML characters in function body for XSS protection166      // This must preserve arrow function syntax (=>) while escaping </script>167      if (options && options.unsafe !== true) {168          serializedFn = escapeFunctionBody(serializedFn);169      }170 171      // pure functions, example: {key: function() {}}172      if(IS_PURE_FUNCTION.test(serializedFn)) {173          return serializedFn;174      }175 176      // arrow functions, example: arg1 => arg1+5177      if(IS_ARROW_FUNCTION.test(serializedFn)) {178          return serializedFn;179      }180 181      var argsStartsAt = serializedFn.indexOf('(');182      var def = serializedFn.substr(0, argsStartsAt)183        .trim()184        .split(' ')185        .filter(function(val) { return val.length > 0 });186 187      var nonReservedSymbols = def.filter(function(val) {188        return RESERVED_SYMBOLS.indexOf(val) === -1189      });190 191      // enhanced literal objects, example: {key() {}}192      if(nonReservedSymbols.length > 0) {193          return (def.indexOf('async') > -1 ? 'async ' : '') + 'function'194            + (def.join('').indexOf('*') > -1 ? '*' : '')195            + serializedFn.substr(argsStartsAt);196      }197 198      // arrow functions199      return serializedFn;200    }201 202    // Check if the parameter is function203    if (options.ignoreFunction && typeof obj === "function") {204        obj = undefined;205    }206    // Protects against `JSON.stringify()` returning `undefined`, by serializing207    // to the literal string: "undefined".208    if (obj === undefined) {209        return String(obj);210    }211 212    var str;213 214    // Creates a JSON string representation of the value.215    // NOTE: Node 0.12 goes into slow mode with extra JSON.stringify() args.216    if (options.isJSON && !options.space) {217        str = JSON.stringify(obj);218    } else {219        str = JSON.stringify(obj, options.isJSON ? null : replacer, options.space);220    }221 222    // Protects against `JSON.stringify()` returning `undefined`, by serializing223    // to the literal string: "undefined".224    if (typeof str !== 'string') {225        return String(str);226    }227 228    // Replace unsafe HTML and invalid JavaScript line terminator chars with229    // their safe Unicode char counterpart. This _must_ happen before the230    // regexps and functions are serialized and added back to the string.231    if (options.unsafe !== true) {232        str = str.replace(UNSAFE_CHARS_REGEXP, escapeUnsafeChars);233    }234 235    if (functions.length === 0 && regexps.length === 0 && dates.length === 0 && maps.length === 0 && sets.length === 0 && arrays.length === 0 && undefs.length === 0 && infinities.length === 0 && bigInts.length === 0 && urls.length === 0) {236        return str;237    }238 239    // Replaces all occurrences of function, regexp, date, map and set placeholders in the240    // JSON string with their string representations. If the original value can241    // not be found, then `undefined` is used.242    return str.replace(PLACE_HOLDER_REGEXP, function (match, backSlash, type, valueIndex) {243        // The placeholder may not be preceded by a backslash. This is to prevent244        // replacing things like `"a\"@__R-<UID>-0__@"` and thus outputting245        // invalid JS.246        if (backSlash) {247            return match;248        }249 250        if (type === 'D') {251            // Validate ISO string format to prevent code injection via spoofed toISOString()252            var isoStr = String(dates[valueIndex].toISOString());253            if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?Z$/.test(isoStr)) {254                throw new TypeError('Invalid Date ISO string');255            }256            return "new Date(\"" + isoStr + "\")";257        }258 259        if (type === 'R') {260            // Sanitize flags to prevent code injection (only allow valid RegExp flag characters)261            var flags = String(regexps[valueIndex].flags).replace(/[^gimsuydv]/g, '');262            return "new RegExp(" + serialize(regexps[valueIndex].source) + ", \"" + flags + "\")";263        }264 265        if (type === 'M') {266            return "new Map(" + serialize(Array.from(maps[valueIndex].entries()), options) + ")";267        }268 269        if (type === 'S') {270            return "new Set(" + serialize(Array.from(sets[valueIndex].values()), options) + ")";271        }272 273        if (type === 'A') {274            return "Array.prototype.slice.call(" + serialize(Object.assign({ length: arrays[valueIndex].length }, arrays[valueIndex]), options) + ")";275        }276 277        if (type === 'U') {278            return 'undefined'279        }280 281        if (type === 'I') {282            return infinities[valueIndex];283        }284 285        if (type === 'B') {286            return "BigInt(\"" + bigInts[valueIndex] + "\")";287        }288 289        if (type === 'L') {290            return "new URL(" + serialize(urls[valueIndex].toString(), options) + ")";291        }292 293        var fn = functions[valueIndex];294 295        return serializeFunc(fn, options);296    });297}298