feat(dotenv): check for .env file size to prevent DoS

plugins/dotenv/dotenv.plugin.zsh

@@ -25,6 +25,19 @@ parse_dotenv() {
       ;;
   esac
 
+  # Fail if file is too large to avoid DoS
+  zmodload -F zsh/stat b:zstat
+  local -i file_size max_size=10485760  # 10MiB
+  if ! file_size=$(zstat -L +size "$filename" 2>/dev/null); then
+    echo "dotenv: unable to determine size of file '$filename'" >&2
+    return 1
+  fi
+
+  if (( file_size > max_size )); then
+    echo "dotenv: file '$filename' is too large to parse (size: $file_size bytes)" >&2
+    return 1
+  fi
+
   local content node line key value
   local -A parsed_vars
   local -a nodes lines

plugins/dotenv/tests/basic-parsing.zunit

@@ -27,6 +27,13 @@
   assert $state equals 1
 }
 
+@test 'parse returns error for oversized file (> 10MiB)' {
+  command truncate -s 11M "$fixture" 2>/dev/null
+
+  run _parse_dotenv_quiet "$fixture" "test"
+  assert $state equals 1
+}
+
 @test 'parse returns error for non-existent file' {
   run _parse_dotenv_quiet "/nonexistent/path/.env" "test"
   assert $state equals 1