@superblocksteam/shared 0.9609.6 → 0.9611.0

package/src/utils/git-url.ts

@@ -5,10 +5,13 @@
  * Used by both the UI and the vite-plugin-file-sync AI agent tooling.
  */
 
-const HTTPS_GIT_URL_RE = /^https?:\/\/[^\s/$.?#]+(?:\.[^\s/$.?#]+)+\/[^\s/$.?#]+(\/[^\s/$.?#]+)+(\.git)?\/?$/i;
-const SSH_GIT_URL_RE = /^[\w-]+@[\w.-]+:[\w./-]+(\.git)?$/;
+// Character classes below are bounded ({1,256} / {1,4096}) to avoid polynomial
+// backtracking on adversarial input (SEC-78) — real hosts/paths are far shorter,
+// so behavior is preserved for every valid git remote URL.
+const HTTPS_GIT_URL_RE = /^https?:\/\/[^\s/$.?#]{1,256}(?:\.[^\s/$.?#]{1,256})+\/[^\s/$.?#]{1,256}(?:\/[^\s/$.?#]{1,256})+(?:\.git)?\/?$/i;
+const SSH_GIT_URL_RE = /^[\w-]{1,256}@[\w.-]{1,256}:[\w./-]{1,4096}(?:\.git)?$/;
 // ssh:// protocol format: ssh://git@host/path
-const SSH_PROTOCOL_RE = /^ssh:\/\/[\w-]+@[\w.-]+(\/[\w./-]+)+(\.git)?\/?$/i;
+const SSH_PROTOCOL_RE = /^ssh:\/\/[\w-]{1,256}@[\w.-]{1,256}\/[\w./-]{1,4096}(?:\.git)?\/?$/i;
 
 export function isValidGitUrl(url: string): boolean {
   const trimmed = url.trim();
@@ -69,7 +72,15 @@ export function gitRemoteUrlToWeb(url: string): string | null {
   }
 
   // SCP-style SSH: git@host:org/repo.git → https://host/org/repo
-  const sshMatch = trimmed.match(/^[\w-]+@([\w.-]+):(.+?)(?:\.git)?\s*$/);
+  // Path capture is bounded ({1,4096}) so it cannot drive polynomial
+  // backtracking on adversarial input (SEC-78). The char class itself is
+  // unchanged (`.`) — paths may legitimately contain spaces (e.g. Azure
+  // DevOps project/repo names), and the numeric bound alone is enough to
+  // keep matching linear. `trimmed` (see top of function) never ends in
+  // whitespace, so the trailing `\s*` that used to sit before `$` was
+  // redundant (always zero-width) and only added its own O(n) rescan per
+  // lazy-capture step — dropped for a plain `$`.
+  const sshMatch = trimmed.match(/^[\w-]{1,256}@([\w.-]{1,256}):(.{1,4096}?)(?:\.git)?$/);
   if (sshMatch?.[1] && sshMatch[2]) {
     const host = sshMatch[1];
     const path = sshMatch[2];
@@ -212,7 +223,12 @@ export function sshGitUrlToHttps(url: string): string | null {
       const host = parsed.hostname;
       const path = parsed.pathname;
       if (host === 'ssh.dev.azure.com') {
-        const azureMatch = path.match(/^\/v3\/([^/]+)\/([^/]+)\/(.+?)(?:\.git)?\/?$/);
+        // Path capture is bounded ({1,4096}) so the trailing `(?:\.git)?\/?$`
+        // cannot drive polynomial backtracking on adversarial input (SEC-78).
+        // The char class itself is unchanged (`.`) — Azure DevOps repo names
+        // may legitimately contain spaces, and the numeric bound alone is
+        // enough to keep matching linear.
+        const azureMatch = path.match(/^\/v3\/([^/]{1,256})\/([^/]{1,256})\/(.{1,4096}?)(?:\.git)?\/?$/);
         if (azureMatch) {
           return `https://dev.azure.com/${azureMatch[1]}/${azureMatch[2]}/_git/${azureMatch[3]}`;
         }
@@ -223,7 +239,14 @@ export function sshGitUrlToHttps(url: string): string | null {
     // Not a standard URL — try SCP-style SSH below.
   }
 
-  const sshMatch = trimmed.match(/^[\w-]+@([\w.-]+):(.+?)(?:\.git)?\s*$/);
+  // Path capture is bounded ({1,4096}) so it cannot drive polynomial
+  // backtracking on adversarial input (SEC-78). The char class itself is
+  // unchanged (`.`) — paths may legitimately contain spaces, and the numeric
+  // bound alone is enough to keep matching linear. `trimmed` (see top of
+  // function) never ends in whitespace, so the trailing `\s*` that used to
+  // sit before `$` was redundant (always zero-width) and only added its own
+  // O(n) rescan per lazy-capture step — dropped for a plain `$`.
+  const sshMatch = trimmed.match(/^[\w-]{1,256}@([\w.-]{1,256}):(.{1,4096}?)(?:\.git)?$/);
   if (sshMatch?.[1] && sshMatch[2]) {
     const host = sshMatch[1];
     const path = sshMatch[2];

package/src/utils/normalizeRoleName.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest';
+
+import { normalizeRoleName } from './normalizeRoleName.js';
+
+describe('normalizeRoleName', () => {
+  it('lowercases a simple name', () => {
+    expect(normalizeRoleName('Admin')).toBe('admin');
+  });
+
+  it('collapses internal non-alphanumeric runs to a single underscore', () => {
+    expect(normalizeRoleName('Team   Lead')).toBe('team_lead');
+    expect(normalizeRoleName('a__b')).toBe('a_b');
+  });
+
+  it('strips leading and trailing non-alphanumeric characters', () => {
+    expect(normalizeRoleName('  Team Lead  ')).toBe('team_lead');
+    expect(normalizeRoleName('!!!Role@@@')).toBe('role');
+    expect(normalizeRoleName('___')).toBe('');
+  });
+
+  it('handles a long non-alphanumeric run without catastrophic backtracking', () => {
+    const input = `${'!'.repeat(100_000)}role`;
+    const start = Date.now();
+    expect(normalizeRoleName(input)).toBe('role');
+    expect(Date.now() - start).toBeLessThan(1_000);
+  });
+});

package/src/utils/normalizeRoleName.ts

@@ -1,7 +1,7 @@
 export function normalizeRoleName(displayName: string): string {
   const key = displayName
     .trim() // remove leading/trailing whitespace
-    .replace(/^[\W_]+|[\W_]+$/g, '') // remove leading/trailing non-alphanumeric characters
-    .replace(/[\W_]+/g, '_'); // replace non-alphanumeric characters with underscores
+    .replace(/[\W_]+/g, '_') // collapse non-alphanumeric runs to a single underscore (linear)
+    .replace(/^_|_$/g, ''); // strip the single edge underscore left by the collapse step (no quantifier -> no polynomial shape)
   return key.toLowerCase();
 }

package/src/utils/response-dto.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+
+import { BadRequestError } from '../errors/index.js';
+import { unwrapResponseDto } from './response-dto.js';
+
+describe('unwrapResponseDto', () => {
+  it('turns a 400 response into a BadRequestError with the server message', async () => {
+    const response = Promise.resolve({
+      responseMeta: {
+        status: 400,
+        success: false,
+        message: 'Excluded application path ".git" cannot be uploaded',
+        error: {
+          code: 400,
+          message: 'Excluded application path ".git" cannot be uploaded'
+        }
+      },
+      data: null
+    });
+
+    const error = await unwrapResponseDto(response).catch((caughtError: unknown) => caughtError);
+
+    expect(error).toBeInstanceOf(BadRequestError);
+    expect(error).toMatchObject({
+      message: 'Excluded application path ".git" cannot be uploaded',
+      status: 400
+    });
+  });
+});