Limit expression/statement nesting depths.

src/api.rs

@@ -444,7 +444,14 @@ impl Engine {
         optimization_level: OptimizationLevel,
     ) -> Result<AST, Box<ParseError>> {
         let stream = lex(scripts);
-        parse(&mut stream.peekable(), self, scope, optimization_level)
+
+        parse(
+            &mut stream.peekable(),
+            self,
+            scope,
+            optimization_level,
+            (self.max_expr_depth, self.max_function_expr_depth),
+        )
     }
 
     /// Read the contents of a file into a string.
@@ -571,6 +578,7 @@ impl Engine {
             self,
             &scope,
             OptimizationLevel::None,
+            self.max_expr_depth,
         )?;
 
         // Handle null - map to ()
@@ -654,7 +662,13 @@ impl Engine {
 
         {
             let mut peekable = stream.peekable();
-            parse_global_expr(&mut peekable, self, scope, self.optimization_level)
+            parse_global_expr(
+                &mut peekable,
+                self,
+                scope,
+                self.optimization_level,
+                self.max_expr_depth,
+            )
         }
     }
 
@@ -805,8 +819,14 @@ impl Engine {
     ) -> Result<T, Box<EvalAltResult>> {
         let scripts = [script];
         let stream = lex(&scripts);
-        // Since the AST will be thrown away afterwards, don't bother to optimize it
-        let ast = parse_global_expr(&mut stream.peekable(), self, scope, OptimizationLevel::None)?;
+
+        let ast = parse_global_expr(
+            &mut stream.peekable(),
+            self,
+            scope,
+            self.optimization_level,
+            self.max_expr_depth,
+        )?;
         self.eval_ast_with_scope(scope, &ast)
     }
 
@@ -931,8 +951,13 @@ impl Engine {
         let scripts = [script];
         let stream = lex(&scripts);
 
-        // Since the AST will be thrown away afterwards, don't bother to optimize it
-        let ast = parse(&mut stream.peekable(), self, scope, OptimizationLevel::None)?;
+        let ast = parse(
+            &mut stream.peekable(),
+            self,
+            scope,
+            self.optimization_level,
+            (self.max_expr_depth, self.max_function_expr_depth),
+        )?;
         self.consume_ast_with_scope(scope, &ast)
     }
 

src/engine.rs

@@ -49,14 +49,30 @@ pub type Map = HashMap<String, Dynamic>;
 
 #[cfg(not(feature = "unchecked"))]
 #[cfg(debug_assertions)]
-pub const MAX_CALL_STACK_DEPTH: usize = 28;
+pub const MAX_CALL_STACK_DEPTH: usize = 8;
+#[cfg(not(feature = "unchecked"))]
+#[cfg(debug_assertions)]
+pub const MAX_EXPR_DEPTH: usize = 32;
+#[cfg(not(feature = "unchecked"))]
+#[cfg(debug_assertions)]
+pub const MAX_FUNCTION_EXPR_DEPTH: usize = 16;
 
 #[cfg(not(feature = "unchecked"))]
 #[cfg(not(debug_assertions))]
-pub const MAX_CALL_STACK_DEPTH: usize = 256;
+pub const MAX_CALL_STACK_DEPTH: usize = 128;
+#[cfg(not(feature = "unchecked"))]
+#[cfg(not(debug_assertions))]
+pub const MAX_EXPR_DEPTH: usize = 128;
+#[cfg(not(feature = "unchecked"))]
+#[cfg(not(debug_assertions))]
+pub const MAX_FUNCTION_EXPR_DEPTH: usize = 32;
 
 #[cfg(feature = "unchecked")]
 pub const MAX_CALL_STACK_DEPTH: usize = usize::MAX;
+#[cfg(feature = "unchecked")]
+pub const MAX_EXPR_DEPTH: usize = usize::MAX;
+#[cfg(feature = "unchecked")]
+pub const MAX_FUNCTION_EXPR_DEPTH: usize = usize::MAX;
 
 pub const KEYWORD_PRINT: &str = "print";
 pub const KEYWORD_DEBUG: &str = "debug";
@@ -338,8 +354,12 @@ pub struct Engine {
     pub(crate) optimization_level: OptimizationLevel,
     /// Maximum levels of call-stack to prevent infinite recursion.
     ///
-    /// Defaults to 28 for debug builds and 256 for non-debug builds.
+    /// Defaults to 8 for debug builds and 128 for non-debug builds.
     pub(crate) max_call_stack_depth: usize,
+    /// Maximum depth of statements/expressions at global level.
+    pub(crate) max_expr_depth: usize,
+    /// Maximum depth of statements/expressions in functions.
+    pub(crate) max_function_expr_depth: usize,
     /// Maximum number of operations allowed to run.
     pub(crate) max_operations: Option<NonZeroU64>,
     /// Maximum number of modules allowed to load.
@@ -382,6 +402,8 @@ impl Default for Engine {
             optimization_level: OptimizationLevel::Full,
 
             max_call_stack_depth: MAX_CALL_STACK_DEPTH,
+            max_expr_depth: MAX_EXPR_DEPTH,
+            max_function_expr_depth: MAX_FUNCTION_EXPR_DEPTH,
             max_operations: None,
             max_modules: None,
         };
@@ -523,6 +545,8 @@ impl Engine {
             optimization_level: OptimizationLevel::Full,
 
             max_call_stack_depth: MAX_CALL_STACK_DEPTH,
+            max_expr_depth: MAX_EXPR_DEPTH,
+            max_function_expr_depth: MAX_FUNCTION_EXPR_DEPTH,
             max_operations: None,
             max_modules: None,
         }
@@ -574,6 +598,13 @@ impl Engine {
         self.max_modules = NonZeroU64::new(modules);
     }
 
+    /// Set the depth limits for expressions/statements.
+    #[cfg(not(feature = "unchecked"))]
+    pub fn set_max_expr_depths(&mut self, max_expr_depth: usize, max_function_expr_depth: usize) {
+        self.max_expr_depth = max_expr_depth;
+        self.max_function_expr_depth = max_function_expr_depth;
+    }
+
     /// Set the module resolution service used by the `Engine`.
     ///
     /// Not available under the `no_module` feature.

src/error.rs

@@ -110,6 +110,10 @@ pub enum ParseErrorType {
     AssignmentToCopy,
     /// Assignment to an a constant variable.
     AssignmentToConstant(String),
+    /// Expression exceeding the maximum levels of complexity.
+    ///
+    /// Never appears under the `unchecked` feature.
+    ExprTooDeep,
     /// Break statement not inside a loop.
     LoopBreak,
 }
@@ -158,7 +162,8 @@ impl ParseError {
             ParseErrorType::DuplicatedExport(_) => "Duplicated variable/function in export statement",
             ParseErrorType::WrongExport => "Export statement can only appear at global level",
             ParseErrorType::AssignmentToCopy => "Only a copy of the value is change with this assignment",
-            ParseErrorType::AssignmentToConstant(_) => "Cannot assign to a constant value.",
+            ParseErrorType::AssignmentToConstant(_) => "Cannot assign to a constant value",
+            ParseErrorType::ExprTooDeep => "Expression exceeds maximum complexity",
             ParseErrorType::LoopBreak => "Break statement should only be used inside a loop"
         }
     }