docs: note that parser and decoder input size is not limited

Callers processing untrusted source or source maps should enforce
their own limits, such as a maximum input size and a sandboxed,
time-bound parse or decode.

Signed-off-by: Lilit Darbinyan <ldarbinyan@bloomberg.net>

Author: ldarbi

README.md

@@ -178,6 +178,13 @@ decoder.decode("barilla.js", 0, 4);  // orzo
 decoder.decode("barilla.js", 0, 25); // penne
 ```
 
+## Untrusted input
+
+The parser and decoder do not limit the size of their input, so very large or
+deeply nested input can use a lot of CPU and memory. If you process untrusted
+source or source maps, enforce your own limits, such as a maximum input size and
+a sandboxed, time-bound parse or decode.
+
 ## Development
 
 - Clone this repository

src/decoder.ts

@@ -29,7 +29,8 @@ export class SourceMapDecoder {
     private [_functionDescs]: Map<string, FunctionDesc[]>;
 
     /**
-     * Initializes the `SourceMapDecoder`
+     * Initializes the `SourceMapDecoder`.
+     * Input size is not limited; see the README if decoding untrusted source maps.
      * @param sourceMap - a PASTA enriched source map
      *
      * @throws if the input source map is invalid

src/parser.ts

@@ -23,6 +23,7 @@ import * as ts from "typescript";
  * Parse a source file and return descriptions of all functions present in the
  * source file. Each description includes the name of the function, and start and
  * end coordinates. For anonymous functions the name is "<anonymous>".
+ * Input size is not limited; see the README if parsing untrusted source.
  *
  * @param source - the contents of a source file
  * @param filetype - the type of the source file (e.g. ECMAScript or TypeScript)