safe-bash: `case`/`[[ == ]]`/glob patterns tokenized without arena reservation — 2 MB pattern from a 75-byte script = fatal OOM on a 128 MB isolate, all budgets green

[kamilio]

Where: packages/safe-bash/src/shell/pattern.ts:16 — tokens() does work.allocation?.reserve(128 + pattern.length*64) (optional) and then Array.from(pattern) + one token object per code point. The work objects passed from src/shell/runtime.ts at the [[ conditional site (:1944), the case site (:2006) and the glob-segment site (:4986) carry no allocation, so nothing is charged. Contrast parameterPattern (:4586), which passes allocation: scratch and is correctly rejected for the same input.

PoC (~75 bytes, default limits):

a=$(printf "%01000000d" 0); a=$a$a; case $a in "$a") echo m;; esac
a=$(printf "%01000000d" 0); a=$a$a; [[ $a == "$a" ]] && echo m

Run: NODE_OPTIONS=--max-old-space-size=128 npx tsx harness.mts '<script>'

Measured (default heap, peak sampler): 1 MB pattern → +68 MB peak, 1.1 s, exit 0; 2 MB → +158 MB, 4.0 s, exit 0; 4 MB pattern in a 30-iteration loop → +505 MB. 128 MB isolate: 2 MB case and [[ == ]] → FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory (re-verified independently). Glob site: echo $a* with 1 MB → +63 MB (2 MB is rejected by maxExpansionBytes). cloudflareWorkerLimits: 1 MB → +59 MB (survives alone; two concurrent would not).

Impact: (d) — ~70–125× heap amplification from a tiny script with every budget green; uncatchable isolate crash on Workers-class hosts under default limits.

Fix: pass an allocation (a budget.values.scope()) in the three work objects, or make tokens() require one; pre-check pattern.length*64 against the arena before Array.from.

Found in security audit v3 (2026-09-07).

[kamilio]

Validated with failing current-source regressions, fixed and verified on remote main at 0511e60. Case, conditional and glob token storage now reserves the shared arena before materialization and retains it for the matching lifetime. Dedicated regressions: 16/16; adjacent cohort: 108/108; complete shell selection: 3,592/3,592. Normal build and maintained root lint pass. The tiny-glob expectation was migrated with explicit pre-enumeration refusal and exact enumeration-boundary controls. Reported OOM thresholds were not asserted as measured. Release monitoring continues separately.

[kamilio]

Release verified: @poe-platform/safe-bash@0.1.432 was published successfully on September 8, 2026. Scoped release run 34192316139 completed successfully; its source commit 691aafe is a verified descendant of the fix commit. This is separate confirmation from the earlier remote-main delivery.

[kamilio]

Cloudflare Workers escalation (verified on real workerd via wrangler dev --local, 2026-09-08): this survives the cloudflareWorkerLimits profile on production. That profile sets maxExpansionBytes: 4 * 1024 * 1024 (4 MiB), but the Node measurement in this issue shows a ~2 MiB pattern already fatally OOMs a 128 MB heap. Since 4 MiB > ~2 MiB, an unquoted glob case/[[ == ]] pattern built within the CF expansion cap still reaches tokens() and allocates past the 128 MB isolate ceiling. Repro under the CF profile: a=$(printf "%03000000d" 0); case ${a}z in ${a}*) echo m;; *) echo n;; esac — a 3 MiB pattern passed maxExpansionBytes and tokenized (completed in local dev, which does not enforce the 128 MB cap). On a production 128 MB isolate this is an uncatchable crash that resets co-resident tenants. Fixing the arena reservation in tokens() (this issue) is the correct fix; note that lowering maxExpansionBytes alone is insufficient because 2 MiB already OOMs.