fix(awk): cap multi-subscript arrays

[chaliy]

Closes #2046

Introduces AWK_MAX_MULTI_SUBSCRIPTS (100) and enforces it at parse time when collecting comma-separated subscripts in arr[e1,e2,...] expressions. The parser rejects any subscript list longer than the cap, preventing pathological left-deep SUBSEP_CONCAT AST construction from adversarial scripts. Adds a regression test that verifies rejection when the cap is exceeded (using AWK_MAX_MULTI_SUBSCRIPTS + 1 so it tracks the constant).

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	2776e75	Commit Preview URL Branch Preview URL	Jun 12 2026, 10:08 AM

[Copilot]

Pull request overview

This PR mitigates an awk DoS vector by bounding how many subscripts can appear in a single multi-subscript array key (e.g. a[i,j,k]), preventing unbounded left-deep SUBSEP_CONCAT AST construction and recursive evaluation.

Changes:

• Added a centralized limit constant (AWK_MAX_MULTI_SUBSCRIPTS) for awk multi-subscript array keys.
• Enforced the cap in the awk parser when collecting comma-separated subscripts, returning an error when exceeded.
• Added an end-to-end regression test ensuring excessively long subscript lists are rejected.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
crates/bashkit/src/builtins/limits.rs	Introduces a centralized awk limit for maximum multi-subscript count.
crates/bashkit/src/builtins/awk/parser.rs	Applies the new cap while parsing arr[e1,e2,...] to prevent pathological AST growth.
crates/bashkit/src/builtins/awk/tests.rs	Adds a regression test verifying rejection when the multi-subscript cap is exceeded.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.