lib: limit split function calls to prevent excessive array length

PR-URL: #57501
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>

Author: gurgunday

lib/internal/blob.js

@@ -360,7 +360,7 @@ function resolveObjectURL(url) {
   try {
     const parsed = new URL(url);
 
-    const split = StringPrototypeSplit(parsed.pathname, ':');
+    const split = StringPrototypeSplit(parsed.pathname, ':', 3);
 
     if (split.length !== 2)
       return;

lib/internal/debugger/inspect.js

@@ -160,7 +160,7 @@ class NodeInspector {
       this[domain] = createAgentProxy(domain, this.client);
     });
     this.handleDebugEvent = (fullName, params) => {
-      const { 0: domain, 1: name } = StringPrototypeSplit(fullName, '.');
+      const { 0: domain, 1: name } = StringPrototypeSplit(fullName, '.', 2);
       if (domain in this) {
         this[domain].emit(name, params);
       }

lib/internal/errors.js

@@ -907,7 +907,7 @@ const fatalExceptionStackEnhancers = {
     // ANSI escape sequences is not reliable.
     if (isWindows) {
       const info = internalBinding('os').getOSInformation();
-      const ver = ArrayPrototypeMap(StringPrototypeSplit(info[2], '.'),
+      const ver = ArrayPrototypeMap(StringPrototypeSplit(info[2], '.', 3),
                                     Number);
       if (ver[0] !== 10 || ver[2] < 14393) {
         useColors = false;

lib/internal/modules/cjs/loader.js

@@ -1833,7 +1833,7 @@ function reconstructErrorStack(err, parentPath, parentSource) {
   const { 1: line, 2: col } =
     RegExpPrototypeExec(/(\d+):(\d+)\)/, errLine) || [];
   if (line && col) {
-    const srcLine = StringPrototypeSplit(parentSource, '\n')[line - 1];
+    const srcLine = StringPrototypeSplit(parentSource, '\n', line)[line - 1];
     const frame = `${parentPath}:${line}\n${srcLine}\n${StringPrototypeRepeat(' ', col - 1)}^\n`;
     setArrowMessage(err, frame);
   }

lib/internal/modules/esm/module_job.js

@@ -218,7 +218,7 @@ class ModuleJob extends ModuleJobBase {
       if (!getSourceMapsSupport().enabled &&
           StringPrototypeIncludes(e.message,
                                   ' does not provide an export named')) {
-        const splitStack = StringPrototypeSplit(e.stack, '\n');
+        const splitStack = StringPrototypeSplit(e.stack, '\n', 2);
         const parentFileUrl = RegExpPrototypeSymbolReplace(
           /:\d+$/,
           splitStack[0],

lib/internal/repl/await.js

@@ -178,7 +178,7 @@ function processTopLevelAwait(src) {
       return null;
     const line = e.loc.line;
     const column = line === 1 ? e.loc.column - wrapPrefix.length : e.loc.column;
-    let message = '\n' + StringPrototypeSplit(src, '\n')[line - 1] + '\n' +
+    let message = '\n' + StringPrototypeSplit(src, '\n', line)[line - 1] + '\n' +
         StringPrototypeRepeat(' ', column) +
         '^\n\n' + RegExpPrototypeSymbolReplace(/ \([^)]+\)/, e.message, '');
     // V8 unexpected token errors include the token string.

lib/internal/source_map/source_map_cache.js

@@ -292,7 +292,7 @@ function sourceMapFromFile(mapURL) {
 // data:[<mediatype>][;base64],<data> see:
 // https://tools.ietf.org/html/rfc2397#section-2
 function sourceMapFromDataUrl(sourceURL, url) {
-  const { 0: format, 1: data } = StringPrototypeSplit(url, ',');
+  const { 0: format, 1: data } = StringPrototypeSplit(url, ',', 2);
   const splitFormat = StringPrototypeSplit(format, ';');
   const contentType = splitFormat[0];
   const base64 = splitFormat[splitFormat.length - 1] === 'base64';

lib/internal/test_runner/utils.js

@@ -263,7 +263,7 @@ function parseCommandLine() {
         );
       }
 
-      const indexAndTotal = StringPrototypeSplit(shardOption, '/');
+      const indexAndTotal = StringPrototypeSplit(shardOption, '/', 2);
       shard = {
         __proto__: null,
         index: NumberParseInt(indexAndTotal[0], 10),

lib/internal/tty.js

@@ -138,7 +138,7 @@ function getColorDepth(env = process.env) {
     // Lazy load for startup performance.
     if (OSRelease === undefined) {
       const { release } = require('os');
-      OSRelease = StringPrototypeSplit(release(), '.');
+      OSRelease = StringPrototypeSplit(release(), '.', 3);
     }
     // Windows 10 build 10586 is the first Windows release that supports 256
     // colors. Windows 10 build 14931 is the first release that supports

lib/internal/util/debuglog.js

@@ -160,6 +160,7 @@ function formatTime(ms) {
     ({ 0: seconds, 1: ms } = StringPrototypeSplit(
       NumberPrototypeToFixed(seconds, 3),
       '.',
+      2,
     ));
     const res = hours !== 0 ? `${hours}:${pad(minutes)}` : minutes;
     return `${res}:${pad(seconds)}.${ms} (${hours !== 0 ? 'h:m' : ''}m:ss.mmm)`;

lib/internal/worker/js_transferable.js

@@ -35,7 +35,7 @@ function setup() {
   // from .postMessage() calls. The format of `deserializeInfo` is generally
   // 'module:Constructor', e.g. 'internal/fs/promises:FileHandle'.
   setDeserializerCreateObjectFunction((deserializeInfo) => {
-    const { 0: module, 1: ctor } = StringPrototypeSplit(deserializeInfo, ':');
+    const { 0: module, 1: ctor } = StringPrototypeSplit(deserializeInfo, ':', 2);
     const Ctor = require(module)[ctor];
     if (typeof Ctor !== 'function' ||
         typeof Ctor.prototype[messaging_deserialize_symbol] !== 'function') {

lib/tls.js

@@ -254,7 +254,7 @@ function check(hostParts, pattern, wildcards) {
 
   const hostSubdomain = hostParts[0];
   const patternSubdomain = patternParts[0];
-  const patternSubdomainParts = patternSubdomain.split('*');
+  const patternSubdomainParts = patternSubdomain.split('*', 3);
 
   // Short-circuit when the subdomain does not contain a wildcard.
   // RFC 6125 does not allow wildcard substitution for components