@saptools/cf-inspector 0.9.1 → 0.9.3

package/dist/index.js

@@ -158,6 +158,22 @@ init_types();
 var REGEX_PREFIX = "regex:";
 var REGEX_FLAGS_PATTERN = /^[dgimsuvy]*$/;
 var TS_JS_EXT_PATTERN = /\.(?:ts|js|mts|mjs|cts|cjs)$/i;
+var MAX_REMOTE_ROOT_PATTERN_LENGTH = 200;
+var NESTED_QUANTIFIER_PATTERN = /\([^()]*[+*][^()]*\)[+*]/;
+function assertSafeRemoteRootPattern(pattern) {
+  if (pattern.length > MAX_REMOTE_ROOT_PATTERN_LENGTH) {
+    throw new CfInspectorError(
+      "INVALID_REMOTE_ROOT",
+      `--remote-root regex pattern is too long (${pattern.length.toString()} chars, max ${MAX_REMOTE_ROOT_PATTERN_LENGTH.toString()}) \u2014 this bounds worst-case backtracking cost`
+    );
+  }
+  if (NESTED_QUANTIFIER_PATTERN.test(pattern)) {
+    throw new CfInspectorError(
+      "INVALID_REMOTE_ROOT",
+      `--remote-root regex pattern "${pattern}" contains a nested quantifier (e.g. "(x+)+"), which can cause catastrophic backtracking \u2014 simplify the pattern`
+    );
+  }
+}
 function parseBreakpointSpec(input) {
   const idx = input.lastIndexOf(":");
   if (idx <= 0 || idx === input.length - 1) {
@@ -198,6 +214,7 @@ function parseRemoteRoot(value) {
   return { kind: "literal", value: stripTrailingSlash(trimmed) };
 }
 function toRegex(pattern, flags) {
+  assertSafeRemoteRootPattern(pattern);
   return { kind: "regex", pattern, flags };
 }
 function parseSlashDelimited(value) {