dofs: Add bounded filesystem primitives - #79
Conversation
馃 Changeset detectedLatest commit: 3da7bfa The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Thanks for your interest in Cloudflare Computer. This repository does not accept unsolicited pull requests. Please use one of the accepted contribution paths instead:
If a maintainer asked you to open this pull request, they can add the |
commit: |
b85296c to
80d82a8
Compare
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Return file size and modification time from readdir, and apply limit and offset after pending write buffers are merged into stable name order.
Add readRange to WorkspaceFilesystem so callers can read a byte window without materializing or transferring the whole file.
Teach find that a question mark matches one non-separator character so its glob surface covers the pattern documented by the AI find tool.
Keep literal, case-sensitive defaults while adding regular expressions, explicit case handling, numbered context, and limit and offset controls for tool callers.
Keep the new pagination tests compliant with the repository-wide Biome import ordering check.
Record the directory, range-read, glob, and grep additions with the storage package that introduces them.
9a8959c to
73e565c
Compare
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
| function compileMatcher(pattern: string, options: { regex: boolean; ignoreCase: boolean }): RegExp { | ||
| const source = options.regex ? pattern : pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); | ||
| try { | ||
| return new RegExp(source, options.ignoreCase ? "i" : ""); | ||
| } catch (error) { | ||
| throw new TypeError( | ||
| `Invalid regular expression: ${error instanceof Error ? error.message : String(error)}`, | ||
| ); | ||
| } | ||
| } |
There was a problem hiding this comment.
馃煥 User-supplied regular expressions can be compiled and run against file contents (ReDoS)
The new regex: true grep mode compiles the caller-supplied pattern verbatim into a RegExp (compileMatcher at packages/dofs/src/fs/grep.ts:121-130) and evaluates it per line over every file under the search root (packages/dofs/src/fs/grep.ts:145-146). A catastrophically backtracking pattern (e.g. (a+)+$) applied to long lines can block the isolate/event loop for an unbounded time, since there is no execution budget, line-length cap, or pattern complexity check. Prior behaviour was fixed-string search only, so this expands the attack surface when the pattern originates from an untrusted tool caller.
Was this helpful? React with 馃憤 or 馃憥 to provide feedback.
1 participant
Stack 1 of 7. Base:
main. Head:stack/improve-tools-01-dofs-primitives.The storage filesystem could not page directories after merging pending writes, expose bounded byte reads through its main facade, match single-character globs, or bound search results. Tool callers therefore had to transfer too much data or implement behavior outside the authoritative storage layer.
This change adds stable name-ordered directory pages with size and modification time, including entries held in write buffers. It exposes byte-range reads on
WorkspaceFilesystem, adds?glob matching, and extendsgrepwith fixed-string and regular-expression modes, explicit case handling, context lines, limits, and offsets. Existinggrepcallers retain literal, case-sensitive defaults.Verification
npm test --workspace @cloudflare/dofs npm run typecheck --workspace @cloudflare/dofs npm run build --workspace @cloudflare/dofsThe next stack part carries these bounded primitives through the Computer facade and AI tool adapters.