security: bound recursive glob expansion work - #2925

Human

AI

Summary

• Add a configurable work budget for recursive glob expansion across the compiler, IR, and library APIs.
• Bound generated fields and charge candidate traversal, recursive rule application, substitutions, literal body replay, and array materialization before expensive allocation.
• Return a clear compilation error when the budget is exceeded.

Security impact

Small recursive glob expressions could feed generated fields back into later matches and amplify into excessive CPU or memory use. The new accounting stops those inputs before they can exhaust process resources.

Validation

• go test ./... -count=1
• go vet ./...
• Boundary and adversarial tests for two-rule and three-rule feedback, substitutions, duplicate literal keys, missing variables, nested arrays, and a 1,000 by 1,000 array payload.