@mastra/memory 1.0.0-beta.5 → 1.0.0-beta.6

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @mastra/memory
 
+## 1.0.0-beta.6
+
+### Patch Changes
+
+- Fixed ReDoS vulnerability in working memory tag parsing. ([#11248](https://github.com/mastra-ai/mastra/pull/11248))
+
+  Replaced regex-based parsing with indexOf-based string parsing to prevent denial of service attacks from malicious input. The vulnerable regex `/<working_memory>([^]*?)<\/working_memory>/g` had O(n²) complexity on pathological inputs - the new implementation maintains O(n) linear time.
+
+- Updated dependencies [[`4f94ed8`](https://github.com/mastra-ai/mastra/commit/4f94ed8177abfde3ec536e3574883e075423350c), [`ac3cc23`](https://github.com/mastra-ai/mastra/commit/ac3cc2397d1966bc0fc2736a223abc449d3c7719), [`a86f4df`](https://github.com/mastra-ai/mastra/commit/a86f4df0407311e0d2ea49b9a541f0938810d6a9), [`029540c`](https://github.com/mastra-ai/mastra/commit/029540ca1e582fc2dd8d288ecd4a9b0f31a954ef), [`66741d1`](https://github.com/mastra-ai/mastra/commit/66741d1a99c4f42cf23a16109939e8348ac6852e), [`01b20fe`](https://github.com/mastra-ai/mastra/commit/01b20fefb7c67c2b7d79417598ef4e60256d1225), [`0dbf199`](https://github.com/mastra-ai/mastra/commit/0dbf199110f22192ce5c95b1c8148d4872b4d119), [`a7ce182`](https://github.com/mastra-ai/mastra/commit/a7ce1822a8785ce45d62dd5c911af465e144f7d7)]:
+  - @mastra/core@1.0.0-beta.14
+
 ## 1.0.0-beta.5
 
 ### Patch Changes

package/dist/index.cjs

@@ -9237,6 +9237,50 @@ var __experimental_updateWorkingMemoryToolVNext = (config) => {
     }
   });
 };
+
+// src/working-memory-utils.ts
+var WORKING_MEMORY_START_TAG = "<working_memory>";
+var WORKING_MEMORY_END_TAG = "</working_memory>";
+function extractWorkingMemoryTags(text3) {
+  const results = [];
+  let pos = 0;
+  while (pos < text3.length) {
+    const start = text3.indexOf(WORKING_MEMORY_START_TAG, pos);
+    if (start === -1) break;
+    const end = text3.indexOf(WORKING_MEMORY_END_TAG, start + WORKING_MEMORY_START_TAG.length);
+    if (end === -1) break;
+    results.push(text3.substring(start, end + WORKING_MEMORY_END_TAG.length));
+    pos = end + WORKING_MEMORY_END_TAG.length;
+  }
+  return results.length > 0 ? results : null;
+}
+function removeWorkingMemoryTags(text3) {
+  let result = "";
+  let pos = 0;
+  while (pos < text3.length) {
+    const start = text3.indexOf(WORKING_MEMORY_START_TAG, pos);
+    if (start === -1) {
+      result += text3.substring(pos);
+      break;
+    }
+    result += text3.substring(pos, start);
+    const end = text3.indexOf(WORKING_MEMORY_END_TAG, start + WORKING_MEMORY_START_TAG.length);
+    if (end === -1) {
+      result += text3.substring(start);
+      break;
+    }
+    pos = end + WORKING_MEMORY_END_TAG.length;
+  }
+  return result;
+}
+function extractWorkingMemoryContent(text3) {
+  const start = text3.indexOf(WORKING_MEMORY_START_TAG);
+  if (start === -1) return null;
+  const contentStart = start + WORKING_MEMORY_START_TAG.length;
+  const end = text3.indexOf(WORKING_MEMORY_END_TAG, contentStart);
+  if (end === -1) return null;
+  return text3.substring(contentStart, end);
+}
 var CHARS_PER_TOKEN = 4;
 var DEFAULT_MESSAGE_RANGE = { before: 1, after: 1 };
 var DEFAULT_TOP_K = 4;
@@ -9653,11 +9697,10 @@ ${workingMemory}`;
     return result;
   }
   updateMessageToHideWorkingMemory(message) {
-    const workingMemoryRegex = /<working_memory>([^]*?)<\/working_memory>/g;
     if (typeof message?.content === `string`) {
       return {
         ...message,
-        content: message.content.replace(workingMemoryRegex, ``).trim()
+        content: removeWorkingMemoryTags(message.content).trim()
       };
     } else if (Array.isArray(message?.content)) {
       const filteredContent = message.content.filter(
@@ -9667,7 +9710,7 @@ ${workingMemory}`;
         if (content.type === "text") {
           return {
             ...content,
-            text: content.text.replace(workingMemoryRegex, "").trim()
+            text: removeWorkingMemoryTags(content.text).trim()
           };
         }
         return { ...content };
@@ -9679,13 +9722,12 @@ ${workingMemory}`;
     }
   }
   updateMessageToHideWorkingMemoryV2(message) {
-    const workingMemoryRegex = /<working_memory>([^]*?)<\/working_memory>/g;
     const newMessage = { ...message };
     if (message.content && typeof message.content === "object" && !Array.isArray(message.content)) {
       newMessage.content = { ...message.content };
     }
     if (typeof newMessage.content?.content === "string" && newMessage.content.content.length > 0) {
-      newMessage.content.content = newMessage.content.content.replace(workingMemoryRegex, "").trim();
+      newMessage.content.content = removeWorkingMemoryTags(newMessage.content.content).trim();
     }
     if (Array.isArray(newMessage.content?.parts)) {
       newMessage.content.parts = newMessage.content.parts.filter((part) => {
@@ -9698,7 +9740,7 @@ ${workingMemory}`;
           const text3 = typeof part.text === "string" ? part.text : "";
           return {
             ...part,
-            text: text3.replace(workingMemoryRegex, "").trim()
+            text: removeWorkingMemoryTags(text3).trim()
           };
         }
         return part;
@@ -9711,13 +9753,8 @@ ${workingMemory}`;
   }
   parseWorkingMemory(text3) {
     if (!this.threadConfig.workingMemory?.enabled) return null;
-    const workingMemoryRegex = /<working_memory>([^]*?)<\/working_memory>/g;
-    const matches = text3.match(workingMemoryRegex);
-    const match = matches?.[0];
-    if (match) {
-      return match.replace(/<\/?working_memory>/g, "").trim();
-    }
-    return null;
+    const content = extractWorkingMemoryContent(text3);
+    return content?.trim() ?? null;
   }
   async getWorkingMemory({
     threadId,
@@ -9960,5 +9997,8 @@ Object.defineProperty(exports, "WorkingMemory", {
 });
 exports.Memory = Memory;
 exports.deepMergeWorkingMemory = deepMergeWorkingMemory;
+exports.extractWorkingMemoryContent = extractWorkingMemoryContent;
+exports.extractWorkingMemoryTags = extractWorkingMemoryTags;
+exports.removeWorkingMemoryTags = removeWorkingMemoryTags;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map