@exortek/apikey 1.1.0 → 1.1.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @exortek/apikey
 
+## 1.1.1
+
+### Patch Changes
+
+- e53ae64: Fix polynomial-ReDoS (quadratic regex backtracking) surfaced by CodeQL, plus small code-quality fixes.
+  Bundled `@exortek/shared` utilities (base32, base64, duration) are inlined into the packages listed above, so each
+  ships the fix.
+
+  - Replace `/=+$/` trailing-padding strips (base32 / base64 decode, OTP provisioning URI) with linear scans —
+    `"=".repeat(n) + "x"` was O(n²).
+  - Rework the duration parser regex so surrounding whitespace can no longer cause O(n²) matching (trim first, single
+    interior `\s*`).
+  - Strip trailing spaces/dots in filename sanitisation with a linear scan — upload filenames are attacker-controlled.
+  - Cap email length before the regex in magic-link.
+  - Thread the JWT decode label into error messages (removes dead arguments and gives failures which segment broke).
+  - Drop a duplicate character in a UA browser-detection regex character class.
+
+  DoS-hardening and hygiene only — no API or behavioural change for valid input.
+
 ## 1.1.0
 
 ### Minor Changes

package/dist/index.cjs

@@ -65,7 +65,11 @@ const UNIT_MS = Object.freeze({
   years: 31_536_000_000,
 });
 
-const DURATION_RE = /^\s*(-?\d+(?:\.\d+)?)\s*([a-z]+)?\s*$/i;
+// Note: no leading/trailing `\s*` — the caller trims first. Two `\s*` runs
+// around the optional unit (`\s*([a-z]+)?\s*`) made this O(n^2) on hostile
+// input like `"1" + " ".repeat(n) + "!"`; trimming plus a single interior
+// `\s*` keeps matching linear.
+const DURATION_RE = /^(-?\d+(?:\.\d+)?)\s*([a-z]+)?$/i;
 
 const SUPPORTED_UNITS = 'ms, s, m, h, d, w, y (and long/plural forms)';
 
@@ -95,7 +99,7 @@ function parseDuration(input) {
     throw new TypeError(`parseDuration: expected string or number; got ${typeof input}`);
   }
 
-  const match = DURATION_RE.exec(input);
+  const match = DURATION_RE.exec(input.trim());
   if (!match) {
     throw new Error(
       `parseDuration: could not parse ${JSON.stringify(input)}. Examples: 900 (ms), '15m', '2h', '7d', '500ms', '30s'.`,

package/dist/index.mjs

@@ -63,7 +63,11 @@ const UNIT_MS = Object.freeze({
   years: 31_536_000_000,
 });
 
-const DURATION_RE = /^\s*(-?\d+(?:\.\d+)?)\s*([a-z]+)?\s*$/i;
+// Note: no leading/trailing `\s*` — the caller trims first. Two `\s*` runs
+// around the optional unit (`\s*([a-z]+)?\s*`) made this O(n^2) on hostile
+// input like `"1" + " ".repeat(n) + "!"`; trimming plus a single interior
+// `\s*` keeps matching linear.
+const DURATION_RE = /^(-?\d+(?:\.\d+)?)\s*([a-z]+)?$/i;
 
 const SUPPORTED_UNITS = 'ms, s, m, h, d, w, y (and long/plural forms)';
 
@@ -93,7 +97,7 @@ function parseDuration(input) {
     throw new TypeError(`parseDuration: expected string or number; got ${typeof input}`);
   }
 
-  const match = DURATION_RE.exec(input);
+  const match = DURATION_RE.exec(input.trim());
   if (!match) {
     throw new Error(
       `parseDuration: could not parse ${JSON.stringify(input)}. Examples: 900 (ms), '15m', '2h', '7d', '500ms', '30s'.`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exortek/apikey",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Stripe-style prefixed API keys for Node.js — 3-segment tokens (prefix_id_secret), HMAC-SHA256 storage hash with pepper rotation, scope allowlists with wildcard match, opt-in lastUsedAt tracking, memory + Redis stores, Express + Fastify middleware. Server-only. Zero non-@exortek runtime dependencies.",
   "type": "module",
   "sideEffects": false,