",[],[216],["D",1788115758091],[],[18],"7a19c16f-27a1-414d-9e65-7f067197fb10","billion-laughs-demo.ts","907191d6-a4a8-11f1-93b0-1607ee4eb77e",11,["D",1788117930991],"// BOUNDED \"billion laughs\" reproduction — SAFE, educational only.\n// Reconstructs the exact entity-expansion amplification of the XML bomb\n// (nested definitions multiplying by a factor each level)\n// WITHOUT materializing gigabytes, so it's safe on shared infra.\n//\n// The real attack is the same math but unbounded (lol9+lol10 OOMs a parser).\n\nconst FACTOR = 10; // classic bomb multiplies by 10 per level\nconst MAX_LEVEL = 7; // BOUNDED: lol7 = 10^6 expansions (~1MB) — safe. The real bomb runs to lol9/10.\n\n// Total occurrences if we fully expanded level `n`:\n// n=1 -> 1, n=2 -> FACTOR, n=3 -> FACTOR^2, ... n -> FACTOR^(n-1)\nfunction expansionsAtLevel(level: number): number {\n return Math.pow(FACTOR, level - 1);\n}\n\nconsole.log(\"=== BOUNDED Billion-Laughs reproduction ===\");\nconsole.log(`Factor per level: ${FACTOR}. Max level allowed: ${MAX_LEVEL} (the classic bomb uses lol9 + lol10).\\n`);\n\nlet cumulativeEntities = 0;\nfor (let n = 1; n <= MAX_LEVEL; n++) {\n const occ = expansionsAtLevel(n);\n cumulativeEntities += occ;\n console.log(`lol${n} = &lol${n - 1} * ${FACTOR} -> ${occ.toLocaleString()} \\\"lol\\\" copies`);\n}\n\nconsole.log(`\\nUn-bounded: lol9 = 10^8 (~1 GB) and lol10 = 10^19 (crashes the parser).`);\n\n// Demonstrate how a naive entity-resolution loop would recurse without a cap.\n// This is the exact pattern real parsers had before entity-expansion limits.\nlet depth = 1;\nlet total = 1;\nconsole.log(`\\nNaive resolver iteration count (growth proves the amplification):`);\nfor (let n = 2; n <= MAX_LEVEL; n++) {\n const cnt = Math.pow(FACTOR, n - 2); // expand each prior reference FACTOR times\n total += cnt;\n depth++;\n console.log(` pass ${depth}: yes uses ${total.toLocaleString()} references so far`);\n}\n\nconsole.log(`\\nDemo complete. On a real vulnerable parser, lol9 alone would allocate ~1 GB;`);\nconsole.log(`lol10 (~10^19) exceeds parser/host limits and is the \"bomb\".`);\n",[],[228],"44016c45-f58e-45cc-8a8c-98dc7c9b7ee9","auth-env-check.ts","a607f7ae-a4aa-11f1-a71e-1607ee4eb77e",["D",1788118826202],"// Auth-env diagnostic — SAFE by construction.\n// Reports ONLY (a) env var NAME and (b) whether a value is present (boolean).\n// NEVER prints, returns, logs, or exposes any credential VALUE.\n//\n// Scope: checks whether environment variables whose names look like they might\n// carry authentication credentials are set. Intended for authorized security\n// review / secret-hygiene audits inside a controlled environment.\n\n/** Returns true if a variable name plausibly relates to credentials. */\nfunction looksLikeCredential(key: string): boolean {\n const k = key.toUpperCase();\n const markers = [\n \"TOKEN\", \"SECRET\", \"KEY\", \"PASSWORD\", \"PASSWD\", \"CREDENTIAL\",\n \"API_KEY\", \"ACCESS_KEY\", \"AUTH\", \"BEARER\", \"EMAIL\", \"PWD\",\n \"SECRET_KEY\", \"PRIVATE_KEY\", \"CLIENT_SECRET\", \"JWT\", \"S3\",\n ];\n return markers.some((m) => k.includes(m));\n}\n\n/** Collect names + presence only. Values are never read into output. */\nfunction scan(): Array<{ name: string; valuePresent: boolean }> {\n const found: Array<{ name: string; valuePresent: boolean }> = [];\n for (const key of Object.keys(Deno.env.toObject())) {\n if (looksLikeCredential(key)) {\n const raw = Deno.env.get(key);\n found.push({ name: key, valuePresent: typeof raw === \"string\" && raw.length > 0 });\n }\n }\n return found.sort((a, b) => a.name.localeCompare(b.name));\n}\n\nconst result = scan();\n\nconsole.log(\"=== Credential-looking env var presence check (names only, no values) ===\");\nif (result.length === 0) {\n console.log(\"No environment variables matched credential-like naming patterns.\");\n} else {\n for (const { name, valuePresent } of result) {\n console.log(`${name}: ${valuePresent ? \"SET\" : \"EMPTY/UNSET\"}`);\n }\n}\nconsole.log(\"\\nValues were intentionally NOT printed.\");\n\n// Export for use as a library if desired.\nexport { scan, looksLikeCredential };\n",[],[236],"595a9ac3-928b-4dd8-b263-c6397961aec1","untitled-folder-7559","d48057ee-a495-11f1-ac49-1607ee4eb77e",6,["D",1788109884732],"directory",[],[243],["D",1788109731932],["D",1789500119686],{"_11":12,"_140":71},{"_11":12,"_136":-5,"_70":71,"_30":69,"_137":138,"_139":24},{"_40":127,"_13":16,"_34":37,"_128":88,"_129":-5,"_130":-5,"_131":-5,"_132":-5,"_133":-5,"_134":14,"_135":12},"ctx",{"_54":-5,"_159":288,"_289":290,"_291":292,"_293":24,"_294":24,"_295":24,"_296":101,"_297":-5,"_298":-7,"_299":-7,"_300":26,"_301":24,"_302":24,"_303":-5,"_304":24,"_305":24,"_306":24,"_307":-5},"ENV",{"_259":260,"_261":262,"_263":16,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281,"_282":283,"_284":285,"_286":287},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · lullaby.ts