feat: DoS prevention, #250

src/util/index.ts

@@ -9,3 +9,4 @@ export * from './async'
 export * from './strftime'
 export * from './liquid-date'
 export * from './timezone-date'
+export * from './limiter'

src/util/limiter.ts

@@ -0,0 +1,18 @@
+import { assert } from './assert'
+
+export class Limiter {
+  private message: string
+  private base = 0
+  private limit: number
+  constructor (resource: string, limit: number) {
+    this.message = `${resource} limit exceeded`
+    this.limit = limit
+  }
+  use (count: number) {
+    assert(this.base + count <= this.limit, this.message)
+    this.base += count
+  }
+  check (count: number) {
+    assert(count <= this.limit, this.message)
+  }
+}

src/util/underscore.ts

@@ -178,8 +178,8 @@ export function caseInsensitiveCompare (a: any, b: any) {
   return 0
 }
 
-export function argumentsToValue<F extends (...args: any) => any> (fn: F) {
-  return (...args: Parameters<F>) => fn(...args.map(toValue))
+export function argumentsToValue<F extends (...args: any) => any, T> (fn: F) {
+  return function (this: T, ...args: Parameters<F>) { return fn.call(this, ...args.map(toValue)) }
 }
 
 export function escapeRegExp (text: string) {