@mantiq/helpers 0.5.23 → 0.6.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/src/Str.ts +4 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mantiq/helpers",
3
- "version": "0.5.23",
3
+ "version": "0.6.1",
4
4
  "description": "Str, Arr, Num, Collection utilities",
5
5
  "type": "module",
6
6
  "license": "MIT",
package/src/Str.ts CHANGED
@@ -187,8 +187,11 @@ export const Str = {
187
187
 
188
188
  /** Check if string matches a wildcard pattern (* for any) */
189
189
  is(pattern: string, value: string): boolean {
190
+ // Security: escape all regex metacharacters FIRST to prevent ReDoS,
191
+ // then replace the escaped wildcard placeholders with regex equivalents.
192
+ const escaped = pattern.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, '\\$&')
190
193
  const regex = new RegExp(
191
- '^' + pattern.replace(/\*/g, '.*').replace(/\?/g, '.') + '$',
194
+ '^' + escaped.replace(/\\\*/g, '.*').replace(/\\\?/g, '.') + '$',
192
195
  )
193
196
  return regex.test(value)
194
197
  },