expand: add BracesSeq with a config parameter and error returns

BracesSeq is a streaming, error-returning replacement for Braces.
A sequence brace whose count exceeds an internal limit yields an
error rather than taking too much memory or time.

FieldsSeq now drives BracesSeq, so the gosh interpreter surfaces
the error to stderr like bash does. An interp smoke test covers
the end-to-end path.

Braces is now deprecated with a short explanation why.

Author: mvdan

expand/braces.go

@@ -4,6 +4,8 @@
 package expand
 
 import (
+	"fmt"
+	"iter"
 	"strconv"
 	"strings"
 
@@ -15,28 +17,76 @@ import (
 // "foo{bar,baz}" will return two literal words, "foobar" and "foobaz".
 //
 // Note that the resulting words may share word parts.
+//
+// Deprecated: use [BracesSeq], which yields words lazily and reports an
+// error rather than letting a large sequence allocate huge amounts.
 func Braces(word *syntax.Word) []*syntax.Word {
 	var all []*syntax.Word
+	bracesSeqRec(word, func(w *syntax.Word) bool {
+		all = append(all, w)
+		return true
+	})
+	return all
+}
+
+// BracesSeq performs brace expansion on a word, given that it contains any
+// [syntax.BraceExp] parts. For example, the word with a brace expansion
+// "foo{bar,baz}" will return two literal words, "foobar" and "foobaz".
+//
+// The iteration yields an error and stops if the total expansion is too
+// large, including combinatorial blow-ups across multiple brace expansions
+// like {1..100}{1..100}{1..100}. This may be configurable with cfg in the
+// future; the parameter is entirely unused for now.
+//
+// Note that the resulting words may share word parts.
+func BracesSeq(cfg *Config, word *syntax.Word) iter.Seq2[*syntax.Word, error] {
+	return func(yield func(*syntax.Word, error) bool) {
+		// 16Ki expanded elements is more than any script should need in practice,
+		// but it's small enough where we don't waste too much memory and CPU.
+		const limit = 16 << 10
+		count := 0
+		bracesSeqRec(word, func(w *syntax.Word) bool {
+			count++
+			if count > limit {
+				yield(nil, fmt.Errorf("brace expansion would exceed %d elements", limit))
+				return false
+			}
+			return yield(w, nil)
+		})
+	}
+}
+
+// bracesSeqRec yields each fully-expanded word descended from word.
+// It returns false if iteration should stop.
+func bracesSeqRec(word *syntax.Word, yield func(*syntax.Word) bool) bool {
 	var left []syntax.WordPart
 	for i, wp := range word.Parts {
 		br, ok := wp.(*syntax.BraceExp)
 		if !ok {
 			left = append(left, wp)
 			continue
 		}
+		rest := word.Parts[i+1:]
+		// Yield each word produced by recursing on `next`,
+		// after prepending `left` to its Parts.
+		expand := func(next *syntax.Word) bool {
+			return bracesSeqRec(next, func(w *syntax.Word) bool {
+				w.Parts = append(append([]syntax.WordPart(nil), left...), w.Parts...)
+				return yield(w)
+			})
+		}
 		if br.Sequence {
-			chars := false
-
 			fromLit := br.Elems[0].Lit()
 			toLit := br.Elems[1].Lit()
 			zeros := max(extraLeadingZeros(fromLit), extraLeadingZeros(toLit))
 
+			chars := false
 			from, err1 := strconv.Atoi(fromLit)
 			to, err2 := strconv.Atoi(toLit)
 			if err1 != nil || err2 != nil {
 				chars = true
-				from = int(br.Elems[0].Lit()[0])
-				to = int(br.Elems[1].Lit()[0])
+				from = int(fromLit[0])
+				to = int(toLit[0])
 			}
 			upward := from <= to
 			incr := 1
@@ -49,45 +99,31 @@ func Braces(word *syntax.Word) []*syntax.Word {
 					incr = n
 				}
 			}
-			n := from
-			for {
-				if upward && n > to {
-					break
-				}
-				if !upward && n < to {
-					break
-				}
+			for n := from; (upward && n <= to) || (!upward && n >= to); n += incr {
 				next := *word
-				next.Parts = next.Parts[i+1:]
 				lit := &syntax.Lit{}
 				if chars {
 					lit.Value = string(rune(n))
 				} else {
 					lit.Value = strings.Repeat("0", zeros) + strconv.Itoa(n)
 				}
-				next.Parts = append([]syntax.WordPart{lit}, next.Parts...)
-				exp := Braces(&next)
-				for _, w := range exp {
-					w.Parts = append(left, w.Parts...)
+				next.Parts = append([]syntax.WordPart{lit}, rest...)
+				if !expand(&next) {
+					return false
 				}
-				all = append(all, exp...)
-				n += incr
 			}
-			return all
+			return true
 		}
 		for _, elem := range br.Elems {
 			next := *word
-			next.Parts = next.Parts[i+1:]
-			next.Parts = append(elem.Parts, next.Parts...)
-			exp := Braces(&next)
-			for _, w := range exp {
-				w.Parts = append(left, w.Parts...)
+			next.Parts = append(append([]syntax.WordPart(nil), elem.Parts...), rest...)
+			if !expand(&next) {
+				return false
 			}
-			all = append(all, exp...)
 		}
-		return all
+		return true
 	}
-	return []*syntax.Word{{Parts: left}}
+	return yield(&syntax.Word{Parts: left})
 }
 
 func extraLeadingZeros(s string) int {

expand/braces_test.go

@@ -185,6 +185,60 @@ func TestBraces(t *testing.T) {
 	}
 }
 
+func TestBracesSeq(t *testing.T) {
+	t.Parallel()
+	for _, tc := range braceTests {
+		t.Run("", func(t *testing.T) {
+			inStr := printWords(tc.in)
+			wantStr := printWords(tc.want...)
+
+			inBraces := *tc.in
+			syntax.SplitBraces(&inBraces)
+
+			var got []*syntax.Word
+			for w, err := range BracesSeq(nil, &inBraces) {
+				if err != nil {
+					t.Fatalf("unexpected error on %q: %v", inStr, err)
+				}
+				got = append(got, w)
+			}
+			gotStr := printWords(got...)
+			if gotStr != wantStr {
+				t.Fatalf("mismatch in %q\nwant:\n%s\ngot: %s",
+					inStr, wantStr, gotStr)
+			}
+		})
+	}
+}
+
+func TestBracesSeqError(t *testing.T) {
+	t.Parallel()
+	tests := []string{
+		"{1..100000}",
+		"a{0..9223372036854775807}b",
+		"{-9223372036854775808..9223372036854775807}",
+		"{1..1000000000..1}",
+		"{1..100}{1..100}{1..100}",
+		"{a,b,c,d}{1..100}{1..100}{1..50}",
+	}
+	for _, in := range tests {
+		t.Run(in, func(t *testing.T) {
+			word := &syntax.Word{Parts: []syntax.WordPart{lit(in)}}
+			syntax.SplitBraces(word)
+			var gotErr error
+			for _, err := range BracesSeq(nil, word) {
+				if err != nil {
+					gotErr = err
+					break
+				}
+			}
+			if gotErr == nil {
+				t.Fatalf("expected error for %q", in)
+			}
+		})
+	}
+}
+
 func wantBraceExpParts(t *testing.T, word *syntax.Word, want bool) {
 	t.Helper()
 	anyBrace := false

expand/expand.go

@@ -460,43 +460,55 @@ func FieldsSeq(cfg *Config, words ...*syntax.Word) iter.Seq2[string, error] {
 	cfg = prepareConfig(cfg)
 	dir := cfg.envGet("PWD")
 	return func(yield func(string, error) bool) {
+		expandWord := func(w *syntax.Word) (stop bool) {
+			wfields, err := cfg.wordFields(w.Parts)
+			if err != nil {
+				yield("", err)
+				return true
+			}
+			for _, field := range wfields {
+				path, doGlob := cfg.escapedGlobField(field)
+				if doGlob && cfg.ReadDir2 != nil {
+					// Note that globbing requires keeping a slice state, so it doesn't
+					// really benefit from using an iterator.
+					matches, err := cfg.glob(dir, path)
+					if err != nil {
+						// We avoid [errors.As] as it allocates,
+						// and we know that [Config.glob] returns [pattern.Regexp] errors without wrapping.
+						if _, ok := err.(*pattern.SyntaxError); !ok {
+							yield("", err)
+							return true
+						}
+					} else if len(matches) > 0 || cfg.NullGlob {
+						for _, m := range matches {
+							if !yield(m, nil) {
+								return true
+							}
+						}
+						continue
+					}
+				}
+				if !yield(cfg.fieldJoin(field), nil) {
+					return true
+				}
+			}
+			return false
+		}
 		for _, word := range words {
 			word := *word // make a copy, since SplitBraces replaces the Parts slice
-			afterBraces := []*syntax.Word{&word}
-			if syntax.SplitBraces(&word) {
-				afterBraces = Braces(&word)
+			if !syntax.SplitBraces(&word) {
+				if expandWord(&word) {
+					return
+				}
+				continue
 			}
-			for _, word2 := range afterBraces {
-				wfields, err := cfg.wordFields(word2.Parts)
+			for w, err := range BracesSeq(cfg, &word) {
 				if err != nil {
 					yield("", err)
 					return
 				}
-				for _, field := range wfields {
-					path, doGlob := cfg.escapedGlobField(field)
-					if doGlob && cfg.ReadDir2 != nil {
-						// Note that globbing requires keeping a slice state, so it doesn't
-						// really benefit from using an iterator.
-						matches, err := cfg.glob(dir, path)
-						if err != nil {
-							// We avoid [errors.As] as it allocates,
-							// and we know that [Config.glob] returns [pattern.Regexp] errors without wrapping.
-							if _, ok := err.(*pattern.SyntaxError); !ok {
-								yield("", err)
-								return
-							}
-						} else if len(matches) > 0 || cfg.NullGlob {
-							for _, m := range matches {
-								if !yield(m, nil) {
-									return
-								}
-							}
-							continue
-						}
-					}
-					if !yield(cfg.fieldJoin(field), nil) {
-						return
-					}
+				if expandWord(w) {
+					return
 				}
 			}
 		}

interp/interp_test.go

@@ -3352,6 +3352,14 @@ done <<< 2`,
 	{`echo a{1\}2,3}b`, "a1}2b a3b\n"},
 	{`echo a{1\..2}b`, "a{1..2}b\n"},
 	{`echo \{\{iriname\}\}`, "{{iriname}}\n"},
+	{
+		"echo {1..100000}",
+		"brace expansion would exceed 16384 elements\n #IGNORE bash has no defensive limit below MaxInt",
+	},
+	{
+		"echo a{0..9999999999}b",
+		"brace expansion would exceed 16384 elements\n #JUSTERR bash errors with a different message",
+	},
 
 	// brace expansion in declarations
 	{"declare {A,B}_VAR=1; echo $A_VAR $B_VAR", "1 1\n"},