@arela/uploader 1.0.24 → 1.1.0

package/src/scoring/scoring-engine.js

@@ -36,17 +36,44 @@ import path from 'path';
 
 import { FieldResult } from '../document-type-shared.js';
 
+// Compile cache for string patterns (from DB matchers): stable across every
+// document in a run, so compile once instead of per document. Invalid patterns
+// cache as null and are treated as a non-match (parity with the TS engine).
+const regexCache = new Map();
+const REGEX_CACHE_MAX = 5000;
+
 function toRegExp(clue) {
-  return clue.pattern instanceof RegExp
-    ? clue.pattern
-    : new RegExp(clue.pattern, clue.flags ?? '');
+  if (clue.pattern instanceof RegExp) {
+    // Local-seed patterns are already compiled; reset lastIndex so a g/y flag
+    // can't make repeated .test() calls stateful across documents.
+    clue.pattern.lastIndex = 0;
+    return clue.pattern;
+  }
+  const safeFlags = (clue.flags ?? '').replace(/[gy]/g, '');
+  const key = `${safeFlags} ${clue.pattern}`;
+  let re = regexCache.get(key);
+  if (re === undefined) {
+    try {
+      re = new RegExp(clue.pattern, safeFlags);
+    } catch {
+      re = null;
+    }
+    if (regexCache.size >= REGEX_CACHE_MAX) regexCache.clear();
+    regexCache.set(key, re);
+  }
+  return re;
 }
 
+// Cap the text a single regex runs on. Real extracted document text is far
+// below this; the cap only bounds pathological/crafted inputs so an allowed
+// (quadratic) pattern can't blow up on a megabyte-scale adversarial string.
+const MATCH_INPUT_CAP = 1_000_000;
+
 function clueTarget(clue, ctx) {
   // FILENAME_REGEX tests the file name; every other kind tests the content.
-  return clue.kind === 'FILENAME_REGEX'
-    ? (ctx.fileName ?? '')
-    : (ctx.source ?? '');
+  const raw =
+    clue.kind === 'FILENAME_REGEX' ? (ctx.fileName ?? '') : (ctx.source ?? '');
+  return raw.length > MATCH_INPUT_CAP ? raw.slice(0, MATCH_INPUT_CAP) : raw;
 }
 
 /**
@@ -73,7 +100,8 @@ export function scoreMatcher(matcher, ctx) {
 
   for (const clue of matcher.clues ?? []) {
     const weight = clue.weight ?? 1;
-    const hit = toRegExp(clue).test(clueTarget(clue, ctx));
+    const re = toRegExp(clue);
+    const hit = re ? re.test(clueTarget(clue, ctx)) : false;
 
     if (clue.negative) {
       if (hit) {

package/.vscode/settings.json

@@ -1 +0,0 @@
-{}