@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/core/httpClient.js

@@ -3,13 +3,9 @@ import { createHash } from "node:crypto";
 import process from "node:process";
 import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
 
-import {
-  Agent,
-  EnvHttpProxyAgent,
-  interceptors,
-  request as undiciRequest,
-} from "undici";
+import { Agent, EnvHttpProxyAgent, request as undiciRequest } from "undici";
 
+import { readBrotliDecoder } from "./brotliProbe.js";
 import { registerRunReset } from "./runState.js";
 
 // Environment variables here are read with raw `process.env` rather than
@@ -213,6 +209,75 @@ export function resolveTimeout(timeout) {
   return undefined;
 }
 
+let runtimeBrotliVerdict;
+
+/**
+ * Set or clear the cached runtime Brotli verdict. Exported for unit tests only.
+ *
+ * @param {boolean|undefined} verdict verdict to use, or undefined to re-check
+ */
+export function _setRuntimeBrotliVerdict(verdict) {
+  runtimeBrotliVerdict = verdict;
+}
+
+/**
+ * Whether the Brotli decoder of the runtime cdxgen runs on carries the
+ * CVE-2026-111497 fix, read once from the decoder itself: the node binary, or
+ * the shared libbrotlidec a `--shared-brotli` build (Homebrew, distro
+ * packages) loads; under Bun, the bun binary, which carries its own copy.
+ * process.versions.brotli cannot answer this, since Node.js backports the fix
+ * without changing it. Deno decodes Brotli in Rust, which was never affected.
+ *
+ * On Node.js cdxgen never asks for `br`, so a Brotli response comes only from
+ * a server that sends it unasked. When the decoder cannot be shown to be
+ * patched, such a body is left undecoded rather than handed to a decoder an
+ * attacker can write past. Bun decodes in its transport, so there the client
+ * stops asking for `br` instead.
+ *
+ * @param {Object} [runtime] the runtime to judge, for tests
+ * @returns {boolean} true when Brotli bodies may be decoded
+ */
+export function runtimeBrotliDecoderIsPatched(runtime = undefined) {
+  if (!runtime && runtimeBrotliVerdict !== undefined) {
+    return runtimeBrotliVerdict;
+  }
+  const subject = runtime || {
+    isDeno: globalThis.Deno?.version?.deno !== undefined,
+    execPath: process.execPath,
+    sharedBrotli: [true, "true"].includes(
+      process.config?.variables?.node_shared_brotli,
+    ),
+    sharedObjects: () => process.report?.getReport?.()?.sharedObjects || [],
+  };
+  let verdict = false;
+  if (subject.isDeno) {
+    verdict = true;
+  } else {
+    const decoderFile = subject.sharedBrotli
+      ? subject
+          .sharedObjects()
+          .find((path) =>
+            `${path}`.split(/[\\/]/).pop().startsWith("libbrotlidec"),
+          )
+      : subject.execPath;
+    verdict = Boolean(
+      decoderFile &&
+        readBrotliDecoder(decoderFile)?.c?.blockSwitchFix === "true",
+    );
+  }
+  if (!runtime) {
+    runtimeBrotliVerdict = verdict;
+    if (!verdict) {
+      console.warn(
+        isBun
+          ? "The Brotli decoder in this Bun is not patched for CVE-2026-111497, or could not be checked, so cdxgen no longer asks servers for Brotli-encoded responses. Bun still decodes one a server sends unasked; upgrade Bun to a release with a patched Brotli."
+          : "The Brotli decoder of this runtime is not patched for CVE-2026-111497, or could not be checked, so Brotli-encoded responses are left undecoded. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later (and the shared brotli library on Homebrew or distro builds).",
+      );
+    }
+  }
+  return verdict;
+}
+
 /**
  * Decompress a response body buffer according to its `Content-Encoding`. undici
  * performs no automatic decompression, so we replicate the behaviour `got` gave
@@ -240,6 +305,9 @@ function decompressBody(rawBody, contentEncoding) {
       } else if (encoding === "deflate") {
         buffer = inflateSync(buffer);
       } else if (encoding === "br") {
+        if (!runtimeBrotliDecoderIsPatched()) {
+          return buffer;
+        }
         buffer = brotliDecompressSync(buffer);
       } else if (encoding === "identity") {
         // no-op
@@ -301,6 +369,30 @@ async function readBody(undiciResponse, responseType) {
   return { body, rawBody };
 }
 
+/**
+ * The headers to put on the wire. Bun's bundled undici asks for br by default
+ * and decodes it with Bun's own decoder before this client sees the body, so
+ * the check in decompressBody never runs there. Where that decoder is not
+ * patched, ask only for the encodings this client decodes itself. A server
+ * that sends br unasked is still decoded by Bun; only upgrading Bun closes
+ * that. The cache key is built from the caller's headers, not these.
+ *
+ * @param {Object} headers Request headers.
+ * @returns {Object} Headers to send.
+ */
+function transportHeaders(headers) {
+  if (
+    !isBun ||
+    Object.keys(headers).some(
+      (key) => key.toLowerCase() === "accept-encoding",
+    ) ||
+    runtimeBrotliDecoderIsPatched()
+  ) {
+    return headers;
+  }
+  return { ...headers, "accept-encoding": "gzip, deflate" };
+}
+
 /**
  * Convert a body into the `[body, headers]` pair to hand to undici. When the
  * `json` option is present it is serialized and a JSON `content-type` is added
@@ -534,20 +626,13 @@ function cacheKeyFor(method, url, headers = {}, responseType = undefined) {
 // The maximum number of redirects to follow when `followRedirect` is enabled.
 const MAX_REDIRECTIONS = 10;
 
-// Bun ships its own bundled implementation of the `undici` module which, as of
-// Bun 1.2, does not expose the `Agent.prototype.compose` composition API nor the
-// `interceptors.redirect` interceptor that undici v7 uses for redirect handling
-// (see cdxgen issue #4245). Detect the Bun runtime so we can fall back to plain
-// dispatchers and follow redirects manually instead of crashing at module load.
+// Bun ships its own bundled implementation of the `undici` module, which lacks
+// `EnvHttpProxyAgent` (see cdxgen issue #4245).
 const isBun = typeof globalThis.Bun !== "undefined";
 
-// Reusable pooled dispatchers. On Node.js, undici composes redirect handling as
-// an interceptor (there is no per-request `maxRedirections` option in undici v7),
-// so we pre-build the small set of dispatcher variants we need instead of
-// allocating a fresh Agent per request (which would defeat connection pooling).
-// On Bun, `compose`/`interceptors.redirect` are unavailable, so the redirect
-// dispatchers are just the plain agents and redirects are handled in
-// `requestWithRedirects` below.
+// Reusable pooled dispatchers, one per TLS verification setting, so requests
+// share connections instead of allocating a fresh Agent each time. Redirects
+// are followed in `requestWithRedirects` below on every runtime.
 // Whether standard proxy environment variables are set. When they are, requests
 // must be routed through the proxy. Because this client always passes an
 // explicit per-request `dispatcher`, it overrides Node's global (potentially
@@ -584,51 +669,72 @@ const defaultAgent = createBaseAgent();
 const insecureAgent = createBaseAgent({
   connect: { rejectUnauthorized: false },
 });
-const redirectDispatcher = isBun
-  ? defaultAgent
-  : defaultAgent.compose(
-      interceptors.redirect({ maxRedirections: MAX_REDIRECTIONS }),
-    );
-const insecureRedirectDispatcher = isBun
-  ? insecureAgent
-  : insecureAgent.compose(
-      interceptors.redirect({ maxRedirections: MAX_REDIRECTIONS }),
-    );
 
 /**
- * Pick the undici dispatcher matching the request's redirect and TLS
- * verification preferences.
+ * Pick the undici dispatcher matching the request's TLS verification
+ * preference. Redirects are followed by `requestWithRedirects`, not by the
+ * dispatcher.
  *
- * @param {boolean} followRedirect Whether HTTP redirects should be followed.
  * @param {boolean} insecure Whether TLS certificate verification is disabled.
  * @returns {import("undici").Dispatcher} The dispatcher to use for the request.
  */
-function selectDispatcher(followRedirect, insecure) {
-  if (insecure) {
-    return followRedirect ? insecureRedirectDispatcher : insecureAgent;
-  }
-  return followRedirect ? redirectDispatcher : defaultAgent;
+function selectDispatcher(insecure) {
+  return insecure ? insecureAgent : defaultAgent;
 }
 
 // HTTP status codes that represent a redirect with a `location` header.
 const REDIRECT_STATUS_CODES = new Set([301, 302, 303, 307, 308]);
 
+// Request headers that may follow a redirect to a different origin. Everything
+// else, such as Authorization, cookies and registry API keys like X-Api-Key or
+// PRIVATE-TOKEN, stays with the origin the caller addressed.
+const CROSS_ORIGIN_REDIRECT_HEADERS = new Set([
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "user-agent",
+]);
+
+/**
+ * Keep only the request headers that may be sent to a different origin.
+ *
+ * @param {Object} headers Request headers.
+ * @returns {Object} Headers safe to send cross-origin.
+ */
+function crossOriginRedirectHeaders(headers = {}) {
+  const kept = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (CROSS_ORIGIN_REDIRECT_HEADERS.has(name.toLowerCase())) {
+      kept[name] = value;
+    }
+  }
+  return kept;
+}
+
 /**
- * Issue an undici request, following redirects manually when running under Bun.
+ * Issue an undici request and follow redirects one hop at a time.
  *
- * On Node.js the redirect-following interceptor baked into the dispatcher does
- * the work, so this simply forwards to `undiciRequest`. On Bun (where the
- * interceptor API is unavailable) we loop on 3xx responses, draining each
- * intermediate body and resolving relative `location` headers, up to
+ * Redirects are followed here rather than by undici's redirect interceptor so
+ * that every hop goes through `beforeRedirect`, which runs the same host
+ * allowlist, protocol and dry-run checks as the first request, and so that
+ * credentials are not forwarded to another origin. Each intermediate body is
+ * drained and relative `location` headers are resolved, up to
  * `MAX_REDIRECTIONS` hops.
  *
  * @param {URL} url Request URL.
  * @param {Object} requestOptions Options passed to `undiciRequest`.
  * @param {boolean} followRedirect Whether redirects should be followed.
+ * @param {function(URL): Promise<void>} beforeRedirect Called with the next URL
+ *   before each hop; throws to stop the request.
  * @returns {Promise<Object>} The final undici response.
  */
-async function requestWithRedirects(url, requestOptions, followRedirect) {
-  if (!isBun || !followRedirect) {
+async function requestWithRedirects(
+  url,
+  requestOptions,
+  followRedirect,
+  beforeRedirect,
+) {
+  if (!followRedirect) {
     return await undiciRequest(url, requestOptions);
   }
   let currentUrl = url;
@@ -649,7 +755,14 @@ async function requestWithRedirects(url, requestOptions, followRedirect) {
     } catch {
       // Ignore drain failures; the socket will be discarded.
     }
-    currentUrl = new URL(location, currentUrl);
+    const nextUrl = new URL(location, currentUrl);
+    await beforeRedirect(nextUrl);
+    if (nextUrl.origin !== currentUrl.origin) {
+      requestOptions.headers = crossOriginRedirectHeaders(
+        requestOptions.headers,
+      );
+    }
+    currentUrl = nextUrl;
     redirections += 1;
     // 303, and 301/302 for anything other than GET/HEAD, must switch to GET
     // without a body, matching how undici's redirect interceptor behaves.
@@ -736,11 +849,23 @@ async function doRequest(mergedOptions) {
   const insecure = options.https?.rejectUnauthorized === false;
   const requestOptions = {
     method,
-    headers,
+    headers: transportHeaders(headers),
     body: method === "GET" || method === "HEAD" ? undefined : body,
-    dispatcher: selectDispatcher(followRedirect, insecure),
+    dispatcher: selectDispatcher(insecure),
     signal,
   };
+  // A redirect target must pass the same beforeRequest checks, such as the
+  // host allowlist, as the URL the caller asked for.
+  const beforeRedirect = async (nextUrl) => {
+    const hopOptions = {
+      ...options,
+      url: nextUrl,
+      context: { ...options.context },
+    };
+    for (const hook of options.hooks?.beforeRequest || []) {
+      await hook(hopOptions);
+    }
+  };
 
   let undiciResponse;
   try {
@@ -748,6 +873,7 @@ async function doRequest(mergedOptions) {
       url,
       requestOptions,
       followRedirect,
+      beforeRedirect,
     );
   } catch (err) {
     const requestError = new RequestError(err, options);

package/lib/core/lockPaths.js

@@ -0,0 +1,38 @@
+import { isAbsolute, relative, resolve, win32 } from "node:path";
+
+/**
+ * Containment check for a path taken from a lockfile (issue #3816). A crafted
+ * npm lockfile can name `file:`/`link:` specifiers or link targets built from
+ * `..` chains or absolute paths, so a parser that is about to list such an
+ * entry checks the resolved path against the project root first.
+ *
+ * The candidate is resolved against `projectRoot`, so both relative values
+ * and the absolute paths arborist already normalised are accepted. The root
+ * itself counts as inside: a lockfile may legitimately link the project to
+ * its own directory.
+ *
+ * @param {string} candidate Path to check, absolute or relative to projectRoot
+ * @param {string} projectRoot Project root the path must stay inside; a falsy
+ *   root means the current working directory, mirroring `node:path`
+ *
+ * @returns {Boolean} True when the path is inside projectRoot
+ */
+export function isPathInsideProject(candidate, projectRoot) {
+  if (typeof candidate !== "string" || !candidate) {
+    return false;
+  }
+  if (candidate.includes("\0")) {
+    return false;
+  }
+  const rootAbs = resolve(projectRoot || process.cwd());
+  const rel = relative(rootAbs, resolve(rootAbs, candidate));
+  if (!rel) {
+    return true;
+  }
+  // relative() returns an absolute path when the two sit on different
+  // Windows drives.
+  if (isAbsolute(rel) || win32.isAbsolute(rel)) {
+    return false;
+  }
+  return rel !== ".." && !rel.startsWith("../") && !rel.startsWith("..\\");
+}

package/lib/core/paths.js

@@ -14,7 +14,7 @@
  * `https://` URL, and `fileURLToPath` throws `ERR_INVALID_URL_SCHEME` on those.
  */
 
-import { platform } from "node:os";
+import { homedir, platform } from "node:os";
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -68,3 +68,26 @@ export function isValidDriveRoot(root) {
 export function toCamel(str) {
   return str.replace(/-([a-z])/g, (_, g) => g.toUpperCase());
 }
+
+/**
+ * Rewrite an absolute path under the user's home directory to a `~`-relative
+ * form so the emitted BOM does not carry the local username.
+ *
+ * @param {string} filePath Absolute path
+ * @param {string} [home] Home directory, defaulting to the current user's
+ * @returns {string} Home-relative path when applicable, else the input
+ */
+export function redactHomePath(filePath, home = homedir()) {
+  const value = String(filePath || "");
+  if (!home || !value.startsWith(home)) {
+    return value;
+  }
+  // Require a path boundary so a sibling home such as /Users/alice-backup is
+  // not rewritten as if it sat under /Users/alice.
+  const remainder = value.slice(home.length);
+  if (remainder && !/^[/\\]/u.test(remainder)) {
+    return value;
+  }
+  const rest = remainder.replace(/^[/\\]/u, "");
+  return rest ? `~/${rest.replaceAll("\\", "/")}` : "~";
+}

package/lib/core/processTree.js

@@ -37,6 +37,8 @@ export function formatDuration(ms) {
  * its end: once the root is gone its pid can be handed to an unrelated
  * process, whose children would otherwise look like the run's. Elsewhere this
  * does nothing: an orphan is re-parented and can no longer be told apart.
+ * It returns once the stopped processes have exited, or after ten seconds,
+ * so the caller can remove files the run left half-written.
  *
  * @param {number|undefined} rootPid pid of the process cdxgen spawned
  * @param {number} startedAt Epoch milliseconds at which the run started
@@ -77,6 +79,9 @@ export function reapProcessTree(
     "  }",
     "}",
     "foreach ($child in $found) { Stop-Process -Id $child -Force -ErrorAction SilentlyContinue }",
+    // Stop-Process returns before the process exits, and a process that is
+    // still exiting keeps its files open, so wait for the exits.
+    "if ($found.Count) { Wait-Process -Id $found.ToArray() -Timeout 10 -ErrorAction SilentlyContinue }",
     "$found -join ','",
   ].join("\n");
   const result = safeSpawnSync(

package/lib/core/projectConfig.js

@@ -45,6 +45,7 @@ const ANNOUNCED_OPTIONS = new Set([
   "api-key",
   "include-formulation",
   "install-deps",
+  "introspect",
   "deep",
   "tea-publish",
   "tea-fetch",

package/lib/core/projectTooling.js

@@ -0,0 +1,97 @@
+/**
+ * Policy for running the scanned project's own build tooling.
+ *
+ * Build tools such as Maven, Gradle, Poetry, MSBuild, SwiftPM, Leiningen and
+ * CocoaPods read configuration or run code that ships with the project
+ * (`.mvn/jvm.config`, `.poetry/plugins`, `Directory.Build.rsp`, `Package.swift`,
+ * `project.clj`, podspecs). Running them on an untrusted project runs that
+ * project's code, so they belong to the same surface as dependency
+ * installation and are skipped whenever installation is disabled.
+ */
+import { isSecureMode, readEnvironmentVariable } from "./activity.js";
+import { recordDegradation } from "./buildLedger.js";
+
+/**
+ * Whether secure mode is on right now. `isSecureMode` is read once when the
+ * modules load, but the `cdxgen-secure` command turns secure mode on later,
+ * by setting CDXGEN_SECURE_MODE before the scan starts.
+ *
+ * @returns {boolean} true when secure mode is on
+ */
+export function isSecureModeActive() {
+  return (
+    isSecureMode ||
+    ["true", "1"].includes(readEnvironmentVariable("CDXGEN_SECURE_MODE"))
+  );
+}
+
+/**
+ * Whether the scan may run the scanned project's own build tooling, such as
+ * wrapper scripts or build definitions that Maven, Gradle, sbt, Mill, Poetry,
+ * PDM, MSBuild, SwiftPM, Leiningen and CocoaPods evaluate.
+ *
+ * Tooling follows `options.installDeps`, which defaults to off in secure mode
+ * when a caller does not set it. Introspection mode exists to observe the
+ * project's own toolchain, so it keeps that tooling on even when dependency
+ * installation is disabled, as long as the operator asked for it rather than
+ * a config file in the scanned project. Secure mode still wins:
+ * CDXGEN_INTROSPECT alone must not make a secure-mode scan run the scanned
+ * project's code.
+ *
+ * @param {Object} [options] CLI options
+ * @returns {boolean} true when project tooling may run
+ */
+export function isProjectToolingAllowed(options) {
+  const secureMode = isSecureModeActive();
+  const installDeps = options?.installDeps ?? !secureMode;
+  if (installDeps !== false) {
+    return true;
+  }
+  return (
+    options?.introspect === true &&
+    options?.introspectFromConfigFile !== true &&
+    !secureMode
+  );
+}
+
+// The skips already reported for each scan, keyed by the scan's options.
+// Callers without options share one key.
+const reportedSkips = new WeakMap();
+const noOptionsKey = {};
+
+/**
+ * Tell the user that a tool was skipped because project tooling is not
+ * allowed, and record the matching degradation for the fidelity report.
+ * Each skip is reported once per scan, however many manifests it applies to.
+ * A skip that only costs evidence, not BOM content, passes no remediation id
+ * and is only shown.
+ *
+ * @param {Object} options CLI options of the scan
+ * @param {string|null} remediationId Remediation id from
+ *   data/remediations.json, or null for a message only
+ * @param {string} message Console message shown to the user
+ * @param {Object} [fields] Degradation fields (ecosystem, tool, impact, detail)
+ * @returns {void}
+ */
+export function reportProjectToolingSkipped(
+  options,
+  remediationId,
+  message,
+  fields,
+) {
+  const key = options && typeof options === "object" ? options : noOptionsKey;
+  let reported = reportedSkips.get(key);
+  if (!reported) {
+    reported = new Set();
+    reportedSkips.set(key, reported);
+  }
+  const skipKey = remediationId || message;
+  if (reported.has(skipKey)) {
+    return;
+  }
+  reported.add(skipKey);
+  console.log(message);
+  if (remediationId) {
+    recordDegradation(remediationId, fields);
+  }
+}

package/lib/core/propertySanitizer.js

@@ -26,6 +26,15 @@ const JSON_PROPERTY_NAMES = new Set([
 ]);
 const URL_PATTERN = /https?:\/\/[^\s<>"'),\]}]+/giu;
 const MAX_STRUCTURE_DEPTH = 6;
+// What an RFC 3986 path may hold as it is: unreserved characters, sub-delims,
+// ":", "@", "/" and well-formed percent-escapes. A query or fragment may also
+// hold "?". Everything else is percent-encoded.
+const URI_PATH_UNSAFE =
+  /%(?![0-9A-Fa-f]{2})|[^A-Za-z0-9\-._~!$&'()*+,;=:@/%]/gu;
+const URI_QUERY_UNSAFE =
+  /%(?![0-9A-Fa-f]{2})|[^A-Za-z0-9\-._~!$&'()*+,;=:@/?%]/gu;
+const URI_SCHEME_AUTHORITY = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#]*/u;
+const UTF8_ENCODER = new TextEncoder();
 
 function sanitizeUrlForBom(value) {
   const input = String(value || "").trim();
@@ -146,6 +155,69 @@ export function sanitizeBomUrl(value) {
   return sanitizeUrlForBom(value);
 }
 
+function percentEncodeUnsafe(text, unsafe) {
+  return text.replace(unsafe, (character) =>
+    Array.from(
+      UTF8_ENCODER.encode(character),
+      (byte) => `%${byte.toString(16).toUpperCase().padStart(2, "0")}`,
+    ).join(""),
+  );
+}
+
+/**
+ * Percent-encode what an RFC 3986 URI reference cannot hold as it is, so a
+ * route template or URL can be emitted where CycloneDX expects an
+ * iri-reference, such as `services[].endpoints[]`. The braces of a route
+ * template, spaces, `<>`, `[]` outside an IPv6 host, `|`, `^`, non-ASCII
+ * characters and a `%` that starts no escape are encoded:
+ * `/users/{id}` becomes `/users/%7Bid%7D`. The scheme and authority of an
+ * absolute URL are kept as written, the query and fragment stay a query and
+ * fragment, and existing escapes are kept, so encoding twice changes
+ * nothing. Nothing is removed; strip credentials with {@link sanitizeBomUrl}
+ * first.
+ *
+ * @param {unknown} value Route template, path or URL
+ * @returns {string} The encoded reference
+ */
+export function encodeUriReference(value) {
+  const text = String(value ?? "");
+  const authority = URI_SCHEME_AUTHORITY.exec(text)?.[0] ?? "";
+  const rest = text.slice(authority.length);
+  const queryStart = rest.indexOf("?");
+  const fragmentStart = rest.indexOf("#");
+  const pathEnd = Math.min(
+    queryStart < 0 ? rest.length : queryStart,
+    fragmentStart < 0 ? rest.length : fragmentStart,
+  );
+  let encoded =
+    authority + percentEncodeUnsafe(rest.slice(0, pathEnd), URI_PATH_UNSAFE);
+  if (pathEnd === queryStart) {
+    const queryEnd = fragmentStart > queryStart ? fragmentStart : rest.length;
+    encoded += `?${percentEncodeUnsafe(rest.slice(queryStart + 1, queryEnd), URI_QUERY_UNSAFE)}`;
+  }
+  if (fragmentStart >= 0) {
+    encoded += `#${percentEncodeUnsafe(rest.slice(fragmentStart + 1), URI_QUERY_UNSAFE)}`;
+  }
+  return encoded;
+}
+
+/**
+ * Whether a value carries a token shape the BOM sanitizer redacts: cloud
+ * access keys, bearer tokens, GitHub, Slack and npm tokens, JWTs and the
+ * like. Callers that cannot splice a `[redacted]` marker into the value, such
+ * as a URL path segment, use it to drop the value instead.
+ *
+ * @param {unknown} value Value to check
+ * @returns {boolean} true when the value holds an inline credential
+ */
+export function hasInlineCredential(value) {
+  const text = String(value ?? "");
+  return INLINE_CREDENTIAL_PATTERNS.some((pattern) => {
+    pattern.lastIndex = 0;
+    return pattern.test(text);
+  });
+}
+
 /**
  * Sanitize a property value before serializing it into BOM properties.
  *