@superblocksteam/shared 0.9609.6 → 2.0.0-SNAPSHOT.7ea2658f98892d2c

package/src/utils/attachment-upload.ts

@@ -291,6 +291,34 @@ function getTextLikeMimeTypeFromFileName(fileName: string | undefined): string |
   return textAttachmentType ? TEXT_ATTACHMENT_MIME_TYPES[textAttachmentType] : undefined;
 }
 
+/**
+ * Names the media type for a file that arrives with nothing but a name, as it
+ * does when a caller points at a path instead of handing over the bytes.
+ *
+ * Derived from {@link MIME_TYPE_FILE_EXTENSIONS} rather than a general-purpose
+ * MIME database so the answer stays inside what attachments actually accept:
+ * a wider lookup would name a type for `.exe` that upload then refuses.
+ */
+export function getAttachmentMimeTypeFromFileName(fileName?: string): string | undefined {
+  const normalizedFileName = normalizeNonEmptyString(fileName)?.toLowerCase();
+  if (!normalizedFileName) {
+    return undefined;
+  }
+
+  for (const [mimeType, extension] of Object.entries(MIME_TYPE_FILE_EXTENSIONS)) {
+    // '.jpeg' resolves through the text-like pass below only if listed there,
+    // so both spellings are matched here against the canonical extension.
+    if (normalizedFileName.endsWith(extension)) {
+      return mimeType === 'image/jpg' ? 'image/jpeg' : mimeType;
+    }
+  }
+  if (normalizedFileName.endsWith('.jpeg')) {
+    return 'image/jpeg';
+  }
+
+  return getTextLikeMimeTypeFromFileName(normalizedFileName);
+}
+
 function isProviderSafeTextMimeType(mimeType: string): boolean {
   return mimeType.startsWith('text/') || mimeType === 'application/json';
 }
@@ -630,8 +658,86 @@ export async function uploadAttachmentToServerApi(params: {
 
   if (!response.ok) {
     const errorText = await response.text().catch(() => '');
+    const parsed = parseUserFacingUploadError(errorText);
+    if (parsed) {
+      throw new AttachmentUploadApiError(parsed.message, {
+        code: parsed.code,
+        status: response.status
+      });
+    }
     throw new Error(`Attachment upload failed: status=${response.status}${errorText ? `, body=${errorText}` : ''}`);
   }
 
   return (await response.json()) as AttachmentUploadServerDto;
 }
+
+/**
+ * The upload route sets this code ONLY on rejections whose `{ error }` sentence
+ * is written for the end user and is safe to show verbatim.
+ *
+ * `{ error }` is otherwise the route's generic diagnostic channel. It carries
+ * internal 500/502 detail (app-scoped-token, invalid Bucketeer response, raw
+ * Bucketeer text). Promoting that to a user-facing sentence leaked upstream
+ * internals into the UI, so the verbatim path is gated on this code rather
+ * than on the presence of the field.
+ */
+export type UserFacingUploadErrorCode = 'attachment_content_mismatch';
+
+export const ATTACHMENT_CONTENT_MISMATCH_CODE: UserFacingUploadErrorCode = 'attachment_content_mismatch';
+
+export class AttachmentUploadApiError extends Error {
+  readonly code: UserFacingUploadErrorCode;
+  readonly status: number;
+
+  constructor(message: string, options: { code: UserFacingUploadErrorCode; status: number }) {
+    super(message);
+    this.name = 'AttachmentUploadApiError';
+    this.code = options.code;
+    this.status = options.status;
+  }
+}
+
+export function isUserFacingUploadError(error: unknown): error is AttachmentUploadApiError {
+  return error instanceof AttachmentUploadApiError;
+}
+
+function readStringProperty(value: object, key: string): string | undefined {
+  if (!(key in value)) {
+    return undefined;
+  }
+  const property = Reflect.get(value, key);
+  return typeof property === 'string' ? property : undefined;
+}
+
+function isUserFacingUploadErrorCode(code: string): code is UserFacingUploadErrorCode {
+  return code === ATTACHMENT_CONTENT_MISMATCH_CODE;
+}
+
+/**
+ * Pull the server's user-facing `{ code, error }` pair out of a response body.
+ * Returns undefined unless `code` is {@link ATTACHMENT_CONTENT_MISMATCH_CODE},
+ * and for non-JSON bodies, non-string `error` fields, and blank strings, so
+ * the caller keeps the diagnostic form that still carries the HTTP status.
+ */
+export function parseUserFacingUploadError(body: string): { code: UserFacingUploadErrorCode; message: string } | undefined {
+  if (!body.trim()) {
+    return undefined;
+  }
+  try {
+    const parsed: unknown = JSON.parse(body);
+    if (typeof parsed !== 'object' || parsed === null) {
+      return undefined;
+    }
+    const code = readStringProperty(parsed, 'code');
+    const message = readStringProperty(parsed, 'error');
+    if (code === undefined || !isUserFacingUploadErrorCode(code)) {
+      return undefined;
+    }
+    if (message === undefined || !message.trim()) {
+      return undefined;
+    }
+    return { code, message };
+  } catch {
+    return undefined;
+  }
+}

package/src/utils/git-url.test.ts

@@ -21,6 +21,10 @@ describe('isValidGitUrl', () => {
   it('trims whitespace', () => {
     expect(isValidGitUrl('  https://github.com/org/repo  ')).toBe(true);
   });
+
+  it('accepts ssh:// double-slash absolute-path URLs (valid git SSH syntax)', () => {
+    expect(isValidGitUrl('ssh://git@host//org/repo.git')).toBe(true);
+  });
 });
 
 describe('isGitHubUrl', () => {
@@ -144,3 +148,64 @@ describe('sshGitUrlToHttps', () => {
     expect(sshGitUrlToHttps('not-a-url')).toBeNull();
   });
 });
+
+describe('git-url ReDoS (SEC-78)', () => {
+  it('still validates/normalizes real URLs', () => {
+    expect(isValidGitUrl('https://github.com/org/repo.git')).toBe(true);
+    expect(isValidGitUrl('git@github.com:org/repo.git')).toBe(true);
+    expect(isValidGitUrl('ssh://git@github.com/org/repo')).toBe(true);
+    expect(isValidGitUrl('not a url')).toBe(false);
+    expect(gitRemoteUrlToWeb('git@github.com:org/repo.git')).toBe('https://github.com/org/repo');
+    expect(sshGitUrlToHttps('git@github.com:org/repo.git')).toBe('https://github.com/org/repo.git');
+  });
+
+  it('still converts SCP-style paths containing spaces (e.g. Azure DevOps repo names)', () => {
+    // Raw SCP `git@host:path` strings are not URL-encoded by convention, so
+    // legitimate paths (Azure DevOps project/repo names in particular) may
+    // contain literal spaces. The bounded regex must preserve this — only the
+    // length is capped, not the character class.
+    expect(gitRemoteUrlToWeb('git@host:org/repo name.git')).toBe('https://host/org/repo name');
+    expect(sshGitUrlToHttps('git@host:org/repo name.git')).toBe('https://host/org/repo name.git');
+  });
+
+  it('does not rescan trailing whitespace polynomially on the SCP sshMatch fallback', () => {
+    // Internal-whitespace shape: a long run of spaces BEFORE the final
+    // non-whitespace char, rather than after it (the existing adversarial
+    // test puts the non-whitespace run first). Against the pre-fix
+    // `(?:\.git)?\s*$` tail this drove a genuine O(4096*n) scan (measured
+    // ~3.9s at n=1,000,000) because the lazy path capture and the trailing
+    // `\s*` were two independent backtracking axes. `trimmed` never ends in
+    // whitespace, so `\s*` before the final `$` was always redundant — it
+    // was dropped in favor of a plain `$`.
+    const evil = 'git@h:' + ' '.repeat(200000) + 'X';
+    const start = performance.now();
+    gitRemoteUrlToWeb(evil);
+    sshGitUrlToHttps(evil);
+    expect(performance.now() - start).toBeLessThan(100);
+  });
+
+  it('does not backtrack polynomially on adversarial inputs', () => {
+    const cases = [
+      'https://' + 'a.'.repeat(50000), // HTTPS_GIT_URL_RE host
+      'https://x/' + 'a/'.repeat(50000), // HTTPS_GIT_URL_RE path
+      'git@' + 'a.'.repeat(50000) + ':x', // SSH_GIT_URL_RE host
+      'ssh://git@h/' + 'a/'.repeat(50000), // SSH_PROTOCOL_RE path
+      'git@h:' + 'a'.repeat(200000), // SCP sshMatch (L72/226)
+      // Trailing-whitespace ambiguity against the `(?:\.git)?\s*$` tail: the
+      // lazy `.+?` capture and the `\s*` quantifier are two independent
+      // O(n) backtracking axes, which combine into genuine O(n^2) blowup on
+      // the pre-fix regex (confirmed: ~35ms at n=8000, ~120ms at n=16000 —
+      // consistent ~4x-per-2x quadratic scaling; would take tens of seconds
+      // at n=200000 without the bound).
+      'git@h:' + 'a'.repeat(16000) + ' '.repeat(16000) + 'X',
+      'git@ssh.dev.azure.com:v3/o/p/' + 'a'.repeat(16000) + ' '.repeat(16000) + 'X'
+    ];
+    for (const evil of cases) {
+      const start = performance.now();
+      isValidGitUrl(evil);
+      gitRemoteUrlToWeb(evil);
+      sshGitUrlToHttps(evil);
+      expect(performance.now() - start).toBeLessThan(150);
+    }
+  });
+});

package/src/utils/git-url.ts

@@ -5,10 +5,13 @@
  * Used by both the UI and the vite-plugin-file-sync AI agent tooling.
  */
 
-const HTTPS_GIT_URL_RE = /^https?:\/\/[^\s/$.?#]+(?:\.[^\s/$.?#]+)+\/[^\s/$.?#]+(\/[^\s/$.?#]+)+(\.git)?\/?$/i;
-const SSH_GIT_URL_RE = /^[\w-]+@[\w.-]+:[\w./-]+(\.git)?$/;
+// Character classes below are bounded ({1,256} / {1,4096}) to avoid polynomial
+// backtracking on adversarial input (SEC-78) — real hosts/paths are far shorter,
+// so behavior is preserved for every valid git remote URL.
+const HTTPS_GIT_URL_RE = /^https?:\/\/[^\s/$.?#]{1,256}(?:\.[^\s/$.?#]{1,256})+\/[^\s/$.?#]{1,256}(?:\/[^\s/$.?#]{1,256})+(?:\.git)?\/?$/i;
+const SSH_GIT_URL_RE = /^[\w-]{1,256}@[\w.-]{1,256}:[\w./-]{1,4096}(?:\.git)?$/;
 // ssh:// protocol format: ssh://git@host/path
-const SSH_PROTOCOL_RE = /^ssh:\/\/[\w-]+@[\w.-]+(\/[\w./-]+)+(\.git)?\/?$/i;
+const SSH_PROTOCOL_RE = /^ssh:\/\/[\w-]{1,256}@[\w.-]{1,256}\/[\w./-]{1,4096}(?:\.git)?\/?$/i;
 
 export function isValidGitUrl(url: string): boolean {
   const trimmed = url.trim();
@@ -69,7 +72,15 @@ export function gitRemoteUrlToWeb(url: string): string | null {
   }
 
   // SCP-style SSH: git@host:org/repo.git → https://host/org/repo
-  const sshMatch = trimmed.match(/^[\w-]+@([\w.-]+):(.+?)(?:\.git)?\s*$/);
+  // Path capture is bounded ({1,4096}) so it cannot drive polynomial
+  // backtracking on adversarial input (SEC-78). The char class itself is
+  // unchanged (`.`) — paths may legitimately contain spaces (e.g. Azure
+  // DevOps project/repo names), and the numeric bound alone is enough to
+  // keep matching linear. `trimmed` (see top of function) never ends in
+  // whitespace, so the trailing `\s*` that used to sit before `$` was
+  // redundant (always zero-width) and only added its own O(n) rescan per
+  // lazy-capture step — dropped for a plain `$`.
+  const sshMatch = trimmed.match(/^[\w-]{1,256}@([\w.-]{1,256}):(.{1,4096}?)(?:\.git)?$/);
   if (sshMatch?.[1] && sshMatch[2]) {
     const host = sshMatch[1];
     const path = sshMatch[2];
@@ -212,7 +223,12 @@ export function sshGitUrlToHttps(url: string): string | null {
       const host = parsed.hostname;
       const path = parsed.pathname;
       if (host === 'ssh.dev.azure.com') {
-        const azureMatch = path.match(/^\/v3\/([^/]+)\/([^/]+)\/(.+?)(?:\.git)?\/?$/);
+        // Path capture is bounded ({1,4096}) so the trailing `(?:\.git)?\/?$`
+        // cannot drive polynomial backtracking on adversarial input (SEC-78).
+        // The char class itself is unchanged (`.`) — Azure DevOps repo names
+        // may legitimately contain spaces, and the numeric bound alone is
+        // enough to keep matching linear.
+        const azureMatch = path.match(/^\/v3\/([^/]{1,256})\/([^/]{1,256})\/(.{1,4096}?)(?:\.git)?\/?$/);
         if (azureMatch) {
           return `https://dev.azure.com/${azureMatch[1]}/${azureMatch[2]}/_git/${azureMatch[3]}`;
         }
@@ -223,7 +239,14 @@ export function sshGitUrlToHttps(url: string): string | null {
     // Not a standard URL — try SCP-style SSH below.
   }
 
-  const sshMatch = trimmed.match(/^[\w-]+@([\w.-]+):(.+?)(?:\.git)?\s*$/);
+  // Path capture is bounded ({1,4096}) so it cannot drive polynomial
+  // backtracking on adversarial input (SEC-78). The char class itself is
+  // unchanged (`.`) — paths may legitimately contain spaces, and the numeric
+  // bound alone is enough to keep matching linear. `trimmed` (see top of
+  // function) never ends in whitespace, so the trailing `\s*` that used to
+  // sit before `$` was redundant (always zero-width) and only added its own
+  // O(n) rescan per lazy-capture step — dropped for a plain `$`.
+  const sshMatch = trimmed.match(/^[\w-]{1,256}@([\w.-]{1,256}):(.{1,4096}?)(?:\.git)?$/);
   if (sshMatch?.[1] && sshMatch[2]) {
     const host = sshMatch[1];
     const path = sshMatch[2];

package/src/utils/normalizeRoleName.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest';
+
+import { normalizeRoleName } from './normalizeRoleName.js';
+
+describe('normalizeRoleName', () => {
+  it('lowercases a simple name', () => {
+    expect(normalizeRoleName('Admin')).toBe('admin');
+  });
+
+  it('collapses internal non-alphanumeric runs to a single underscore', () => {
+    expect(normalizeRoleName('Team   Lead')).toBe('team_lead');
+    expect(normalizeRoleName('a__b')).toBe('a_b');
+  });
+
+  it('strips leading and trailing non-alphanumeric characters', () => {
+    expect(normalizeRoleName('  Team Lead  ')).toBe('team_lead');
+    expect(normalizeRoleName('!!!Role@@@')).toBe('role');
+    expect(normalizeRoleName('___')).toBe('');
+  });
+
+  it('handles a long non-alphanumeric run without catastrophic backtracking', () => {
+    const input = `${'!'.repeat(100_000)}role`;
+    const start = Date.now();
+    expect(normalizeRoleName(input)).toBe('role');
+    expect(Date.now() - start).toBeLessThan(1_000);
+  });
+});

package/src/utils/normalizeRoleName.ts

@@ -1,7 +1,7 @@
 export function normalizeRoleName(displayName: string): string {
   const key = displayName
     .trim() // remove leading/trailing whitespace
-    .replace(/^[\W_]+|[\W_]+$/g, '') // remove leading/trailing non-alphanumeric characters
-    .replace(/[\W_]+/g, '_'); // replace non-alphanumeric characters with underscores
+    .replace(/[\W_]+/g, '_') // collapse non-alphanumeric runs to a single underscore (linear)
+    .replace(/^_|_$/g, ''); // strip the single edge underscore left by the collapse step (no quantifier -> no polynomial shape)
   return key.toLowerCase();
 }