@theia/core 1.73.0-next.7 → 1.73.0

package/src/node/hosting/browser-connection-token.spec.ts

@@ -0,0 +1,167 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import * as http from 'http';
+import {
+    BrowserConnectionToken,
+    BrowserConnectionTokenBackendContribution,
+    BROWSER_TOKEN_COOKIE_NAME,
+    createBrowserConnectionToken
+} from './browser-connection-token';
+
+describe('BrowserConnectionToken', () => {
+
+    it('should generate unique tokens', () => {
+        const token1 = createBrowserConnectionToken();
+        const token2 = createBrowserConnectionToken();
+        expect(token1.value).to.not.equal(token2.value);
+    });
+
+    it('should generate tokens of sufficient length', () => {
+        const token = createBrowserConnectionToken();
+        expect(token.value.length).to.be.greaterThan(16);
+    });
+});
+
+describe('BrowserConnectionTokenBackendContribution', () => {
+
+    const token: BrowserConnectionToken = createBrowserConnectionToken();
+
+    function createContribution(): BrowserConnectionTokenBackendContribution {
+        const contribution = new BrowserConnectionTokenBackendContribution();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (contribution as any)['browserConnectionToken'] = token;
+        return contribution;
+    }
+
+    function createRequest(cookieValue?: string): http.IncomingMessage {
+        const request = {
+            headers: {} as http.IncomingHttpHeaders
+        } as http.IncomingMessage;
+        if (cookieValue !== undefined) {
+            request.headers.cookie = `${BROWSER_TOKEN_COOKIE_NAME}=${cookieValue}`;
+        }
+        return request;
+    }
+
+    describe('allowWsUpgrade (WebSocket validation)', () => {
+
+        it('should allow WebSocket with valid token cookie', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest(token.value))).to.be.true;
+        });
+
+        it('should reject WebSocket with no cookie', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest())).to.be.false;
+        });
+
+        it('should reject WebSocket with invalid token', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest('wrong-token'))).to.be.false;
+        });
+
+        it('should reject WebSocket with stale token from previous server', () => {
+            const contribution = createContribution();
+            const staleToken = createBrowserConnectionToken().value;
+            expect(contribution.allowWsUpgrade(createRequest(staleToken))).to.be.false;
+        });
+
+        it('should reject WebSocket with empty token', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest(''))).to.be.false;
+        });
+
+        it('should handle multiple cookies correctly', () => {
+            const contribution = createContribution();
+            const request = {
+                headers: {
+                    cookie: `other-cookie=foo; ${BROWSER_TOKEN_COOKIE_NAME}=${token.value}; another=bar`
+                } as http.IncomingHttpHeaders
+            } as http.IncomingMessage;
+            expect(contribution.allowWsUpgrade(request)).to.be.true;
+        });
+    });
+
+    describe('expressMiddleware (HTTP cookie flow)', () => {
+
+        interface CookieCall {
+            name: string;
+            value: string;
+            options: Record<string, unknown>;
+        }
+
+        interface MockResponse {
+            cookieCalls: CookieCall[];
+            nextCalled: boolean;
+        }
+
+        function callMiddleware(cookieValue?: string): MockResponse {
+            const contribution = createContribution();
+            const result: MockResponse = { cookieCalls: [], nextCalled: false };
+
+            const req = {
+                headers: {} as Record<string, string | undefined>,
+                socket: { remoteAddress: '127.0.0.1' }
+            };
+            if (cookieValue !== undefined) {
+                req.headers.cookie = `${BROWSER_TOKEN_COOKIE_NAME}=${cookieValue}`;
+            }
+
+            const res = {
+                cookie: (name: string, value: string, options: Record<string, unknown>) => {
+                    result.cookieCalls.push({ name, value, options });
+                }
+            };
+
+            const next = (): void => { result.nextCalled = true; };
+
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (contribution as any).expressMiddleware(req, res, next);
+            return result;
+        }
+
+        it('should set cookie and allow request when no cookie present', () => {
+            const result = callMiddleware();
+            expect(result.nextCalled).to.be.true;
+            expect(result.cookieCalls).to.have.length(1);
+            expect(result.cookieCalls[0].name).to.equal(BROWSER_TOKEN_COOKIE_NAME);
+            expect(result.cookieCalls[0].value).to.equal(token.value);
+        });
+
+        it('should set cookie with HttpOnly, SameSite=Strict, and path=/', () => {
+            const result = callMiddleware();
+            const opts = result.cookieCalls[0].options;
+            expect(opts.httpOnly).to.be.true;
+            expect(opts.sameSite).to.equal('strict');
+            expect(opts.path).to.equal('/');
+        });
+
+        it('should allow request with valid cookie without re-setting it', () => {
+            const result = callMiddleware(token.value);
+            expect(result.nextCalled).to.be.true;
+            expect(result.cookieCalls).to.have.length(0);
+        });
+
+        it('should refresh stale cookie and allow request', () => {
+            const result = callMiddleware('stale-token-from-old-server');
+            expect(result.nextCalled).to.be.true;
+            expect(result.cookieCalls).to.have.length(1);
+            expect(result.cookieCalls[0].value).to.equal(token.value);
+        });
+    });
+});

package/src/node/hosting/browser-connection-token.ts

@@ -0,0 +1,126 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import * as cookie from 'cookie';
+import * as crypto from 'crypto';
+import * as http from 'http';
+import express = require('express');
+import { inject, injectable } from 'inversify';
+import { environment } from '../../common/index';
+import { MaybePromise } from '../../common';
+import { BackendApplicationContribution, EarlyExpressMiddleware } from '../backend-application';
+import { WsRequestValidatorContribution } from '../ws-request-validators';
+import { generateUuid } from '../../common/uuid';
+
+export const BrowserConnectionToken = Symbol('BrowserConnectionToken');
+
+export const BROWSER_TOKEN_COOKIE_NAME = 'theia-connection-token';
+
+export interface BrowserConnectionToken {
+    value: string;
+}
+
+/**
+ * Validates WebSocket and HTTP requests using a cookie-based connection token.
+ *
+ * In browser deployments, the server generates a random token at startup and sets it
+ * as a `SameSite=Strict; HttpOnly` cookie on the first page load. Cross-origin pages
+ * cannot obtain or send this cookie, so their requests are rejected.
+ *
+ * This complements the origin validator: non-browser callers that omit the Origin
+ * header (e.g. Node.js scripts) still cannot reach the backend without the cookie.
+ *
+ * Skipped in Electron deployments (which use their own `ElectronSecurityToken`).
+ */
+@injectable()
+export class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution {
+
+    @inject(BrowserConnectionToken)
+    protected readonly browserConnectionToken: BrowserConnectionToken;
+
+    @inject(EarlyExpressMiddleware)
+    protected readonly earlyMiddleware: EarlyExpressMiddleware;
+
+    /**
+     * Register the cookie middleware during `initialize()` via `EarlyExpressMiddleware`
+     * so it runs before `express.static()` (which is registered later during `configure()`).
+     * This ensures the browser receives the token cookie on the initial page load.
+     */
+    initialize(): void {
+        if (environment.electron.is()) {
+            return;
+        }
+        this.earlyMiddleware.handlers.push((req, res, next) => this.expressMiddleware(req, res, next));
+    }
+
+    /**
+     * Validate the connection token cookie on WebSocket upgrade requests.
+     * Non-browser callers that omit the Origin header (e.g. Node.js scripts)
+     * cannot provide the `SameSite=Strict` cookie either, so they are rejected.
+     */
+    allowWsUpgrade(request: http.IncomingMessage): MaybePromise<boolean> {
+        if (environment.electron.is()) {
+            return true;
+        }
+        const token = this.getTokenFromCookie(request);
+        if (token) {
+            return this.isTokenValid(token);
+        }
+        // No cookie: reject. Legitimate browsers always have the cookie
+        // because it is set on the initial page load.
+        return false;
+    }
+
+    protected expressMiddleware(req: express.Request, res: express.Response, next: express.NextFunction): void {
+        const existing = this.getTokenFromCookie(req);
+        if (!existing || !this.isTokenValid(existing)) {
+            // No cookie or stale cookie (e.g. after server restart) so (re-)issue it.
+            // The browser will use the fresh token on subsequent requests.
+            res.cookie(BROWSER_TOKEN_COOKIE_NAME, this.browserConnectionToken.value, {
+                httpOnly: true,
+                sameSite: 'strict',
+                path: '/'
+            });
+        }
+        next();
+    }
+
+    protected getTokenFromCookie(req: http.IncomingMessage): string | undefined {
+        const cookieHeader = req.headers.cookie;
+        if (cookieHeader) {
+            return cookie.parse(cookieHeader)[BROWSER_TOKEN_COOKIE_NAME];
+        }
+        return undefined;
+    }
+
+    protected isTokenValid(token: string): boolean {
+        try {
+            const received = Buffer.from(token, 'utf8');
+            const expected = Buffer.from(this.browserConnectionToken.value, 'utf8');
+            return received.byteLength === expected.byteLength && crypto.timingSafeEqual(received, expected);
+        } catch (error) {
+            console.error(error);
+        }
+        return false;
+    }
+}
+
+/**
+ * Creates a new browser connection token.
+ */
+export function createBrowserConnectionToken(): BrowserConnectionToken {
+    return { value: generateUuid() };
+}

package/src/node/hosting/ws-origin-validator.spec.ts

@@ -0,0 +1,193 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import * as http from 'http';
+import { WsOriginValidator } from './ws-origin-validator';
+import { BackendApplicationHosts } from './backend-application-hosts';
+
+describe('WsOriginValidator', () => {
+
+    function createValidator(hosts?: string[]): WsOriginValidator {
+        const backendHosts = new BackendApplicationHosts();
+        if (hosts) {
+            for (const h of hosts) {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                (backendHosts as any)['_hosts'].add(h);
+            }
+        }
+        const validator = new WsOriginValidator();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (validator as any)['backendApplicationHosts'] = backendHosts;
+        return validator;
+    }
+
+    function createRequest(origin?: string, host?: string): http.IncomingMessage {
+        const request = {
+            headers: {} as http.IncomingHttpHeaders
+        } as http.IncomingMessage;
+        if (origin !== undefined) {
+            request.headers.origin = origin;
+        }
+        if (host !== undefined) {
+            request.headers.host = host;
+        }
+        return request;
+    }
+
+    describe('when THEIA_HOSTS is not set', () => {
+
+        it('should allow same-origin requests', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://localhost:3000', 'localhost:3000')
+            )).to.be.true;
+        });
+
+        it('should allow same-origin requests on default ports', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://myhost.com', 'myhost.com')
+            )).to.be.true;
+        });
+
+        it('should reject cross-origin requests', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://evil.com', 'localhost:3000')
+            )).to.be.false;
+        });
+
+        it('should allow requests with no Origin header (same-origin polling)', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest(undefined, 'localhost:3000')
+            )).to.be.true;
+        });
+
+        it('should reject requests with no Host header when Origin is present', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://localhost:3000', undefined)
+            )).to.be.false;
+        });
+
+        it('should reject requests with malformed Origin', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('not-a-valid-url', 'localhost:3000')
+            )).to.be.false;
+        });
+    });
+
+    describe('when THEIA_HOSTS is set', () => {
+
+        it('should allow requests from a listed host', () => {
+            const validator = createValidator(['myhost.com']);
+            expect(validator.allowWsUpgrade(
+                createRequest('http://myhost.com', 'myhost.com')
+            )).to.be.true;
+        });
+
+        it('should allow requests from a listed host with port', () => {
+            const validator = createValidator(['myhost.com:8080']);
+            expect(validator.allowWsUpgrade(
+                createRequest('http://myhost.com:8080', 'myhost.com:8080')
+            )).to.be.true;
+        });
+
+        it('should reject requests from an unlisted host', () => {
+            const validator = createValidator(['myhost.com']);
+            expect(validator.allowWsUpgrade(
+                createRequest('http://evil.com', 'myhost.com')
+            )).to.be.false;
+        });
+
+        it('should allow requests with no Origin header (same-origin polling)', () => {
+            const validator = createValidator(['myhost.com']);
+            expect(validator.allowWsUpgrade(
+                createRequest(undefined, 'myhost.com')
+            )).to.be.true;
+        });
+
+        it('should allow when origin host is in the allowlist regardless of Host header', () => {
+            const validator = createValidator(['myhost.com']);
+            expect(validator.allowWsUpgrade(
+                createRequest('http://myhost.com', 'internal-host:3000')
+            )).to.be.true;
+        });
+
+        it('should reject malformed Origin even with THEIA_HOSTS', () => {
+            const validator = createValidator(['myhost.com']);
+            expect(validator.allowWsUpgrade(
+                createRequest('not-a-valid-url', 'myhost.com')
+            )).to.be.false;
+        });
+    });
+
+    describe('edge cases', () => {
+
+        it('should reject cross-origin with port mismatch', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://localhost:4000', 'localhost:3000')
+            )).to.be.false;
+        });
+
+        it('should handle HTTPS origins', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('https://localhost:3000', 'localhost:3000')
+            )).to.be.true;
+        });
+
+        it('should reject Origin: null (opaque origin from sandboxed pages)', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('null', 'localhost:3000')
+            )).to.be.false;
+        });
+
+        it('should allow empty Origin string (treated as absent)', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('', 'localhost:3000')
+            )).to.be.true;
+        });
+
+        it('should handle IPv6 same-origin', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://[::1]:3000', '[::1]:3000')
+            )).to.be.true;
+        });
+
+        it('should strip credentials from Origin when comparing', () => {
+            const validator = createValidator();
+            // new URL('http://user:pass@localhost:3000').host === 'localhost:3000'
+            expect(validator.allowWsUpgrade(
+                createRequest('http://user:pass@localhost:3000', 'localhost:3000')
+            )).to.be.true;
+        });
+
+        it('should ignore path component in Origin', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://localhost:3000/some/path', 'localhost:3000')
+            )).to.be.true;
+        });
+    });
+});

package/src/node/hosting/ws-origin-validator.ts

@@ -16,7 +16,6 @@
 
 import * as http from 'http';
 import { inject, injectable } from 'inversify';
-import * as url from 'url';
 import { WsRequestValidatorContribution } from '../ws-request-validators';
 import { BackendApplicationHosts } from './backend-application-hosts';
 
@@ -27,10 +26,30 @@ export class WsOriginValidator implements WsRequestValidatorContribution {
     protected readonly backendApplicationHosts: BackendApplicationHosts;
 
     allowWsUpgrade(request: http.IncomingMessage): boolean {
-        if (!this.backendApplicationHosts.hasKnownHosts() || !request.headers.origin) {
+        if (!request.headers.origin) {
+            // Browsers omit the Origin header for same-origin requests (e.g. Socket.IO polling).
+            // Absent Origin is safe: cross-origin browser requests always include it.
             return true;
         }
-        const origin = url.parse(request.headers.origin);
-        return this.backendApplicationHosts.hosts.has(origin.host!);
+
+        let originHost: string;
+        try {
+            originHost = new URL(request.headers.origin).host;
+        } catch {
+            return false;
+        }
+
+        if (this.backendApplicationHosts.hasKnownHosts()) {
+            // When THEIA_HOSTS is configured, validate against the explicit allowlist.
+            return this.backendApplicationHosts.hosts.has(originHost);
+        }
+
+        // When THEIA_HOSTS is not configured (the common development/default case),
+        // enforce same-origin: the Origin's host must match the request's Host header.
+        const hostHeader = request.headers.host;
+        if (!hostHeader) {
+            return false;
+        }
+        return originHost === hostHeader;
     }
 }

package/src/node/index.ts

@@ -22,3 +22,4 @@ export * from './messaging';
 export * from './cli';
 export * from './setting-service';
 export { FileSystemLocking } from './filesystem-locking';
+export { BackendRequestAllowedContribution } from './request/backend-request-facade';

package/src/node/logger-cli-contribution.spec.ts

@@ -257,4 +257,69 @@ describe('log-level-cli-contribution', () => {
             world: LogLevel.FATAL,
         });
     });
+
+    describe('Wildcard Matching', () => {
+
+        async function setupLogLevels(levels: { [key: string]: string }): Promise<void> {
+            const file = track.openSync();
+            fs.writeFileSync(file.fd, JSON.stringify({
+                defaultLevel: 'info',
+                levels
+            }));
+            fs.fsyncSync(file.fd);
+            fs.closeSync(file.fd);
+
+            const args: yargs.Arguments = await yargs.parse(['--log-config', file.path]);
+            await cli.setArguments(args);
+        }
+
+        it('should respect exact matches without wildcards', async () => {
+            await setupLogLevels({
+                'unrelated:Service': 'debug'
+            });
+            expect(cli.logLevelFor('unrelated:Service')).to.equal(LogLevel.DEBUG);
+            expect(cli.logLevelFor('something-else')).to.equal(LogLevel.INFO);
+        });
+
+        it('should match prefix wildcards', async () => {
+            await setupLogLevels({
+                'ai-core*': 'error'
+            });
+            expect(cli.logLevelFor('ai-core:SomeOtherService')).to.equal(LogLevel.ERROR);
+        });
+
+        it('should match suffix wildcards', async () => {
+            await setupLogLevels({
+                '*TokenUsageFrontendServiceImpl': 'warn'
+            });
+            expect(cli.logLevelFor('my-package:MyTokenUsageFrontendServiceImpl')).to.equal(LogLevel.WARN);
+        });
+
+        it('should match middle wildcards', async () => {
+            await setupLogLevels({
+                '*ai*:*': 'warn'
+            });
+            expect(cli.logLevelFor('foo-ai-bar:SomeService')).to.equal(LogLevel.WARN);
+        });
+
+        it('should enforce perfect match first, then last wildcard wins', async () => {
+            await setupLogLevels({
+                'ai-core*': 'error',
+                '*ai*:*': 'warn',
+                'ai-core:SpecificService': 'debug'
+            });
+
+            expect(cli.logLevelFor('ai-core:SpecificService')).to.equal(LogLevel.DEBUG);
+
+            expect(cli.logLevelFor('ai-core:OtherService')).to.equal(LogLevel.WARN);
+        });
+
+        it('should properly escape regex specifics like periods', async () => {
+            await setupLogLevels({
+                '.*': 'error'
+            });
+            expect(cli.logLevelFor('anything-else')).to.equal(LogLevel.INFO);
+            expect(cli.logLevelFor('.*')).to.equal(LogLevel.ERROR);
+        });
+    });
 });

package/src/node/logger-cli-contribution.ts

@@ -23,6 +23,7 @@ import { AsyncSubscription, subscribe } from '@parcel/watcher';
 import { Event, Emitter } from '../common/event';
 import * as path from 'path';
 import { Disposable, DisposableCollection } from '../common';
+import { escapeRegExpCharacters } from '../common/strings';
 
 /** Maps logger names to log levels.  */
 export interface LogLevels {
@@ -38,6 +39,7 @@ export interface LogLevels {
 export class LogLevelCliContribution implements CliContribution, Disposable {
 
     protected _logLevels: LogLevels = {};
+    protected wildcardRegexCache = new Map<string, RegExp>();
     protected asyncSubscriptions: AsyncSubscription[] = [];
     protected toDispose = new DisposableCollection();
 
@@ -190,6 +192,7 @@ export class LogLevelCliContribution implements CliContribution, Disposable {
 
             this._defaultLogLevel = newDefaultLogLevel;
             this._logLevels = newLogLevels;
+            this.wildcardRegexCache.clear();
 
             console.log(`Successfully read new log config from ${filename}.`);
         } catch (e) {
@@ -202,13 +205,23 @@ export class LogLevelCliContribution implements CliContribution, Disposable {
     }
 
     logLevelFor(loggerName: string): LogLevel {
-        const level = this._logLevels[loggerName];
+        if (loggerName in this._logLevels) {
+            return this._logLevels[loggerName];
+        }
+
+        const keys = Object.keys(this._logLevels);
+        for (let i = keys.length - 1; i >= 0; i--) {
+            const pattern = keys[i];
 
-        if (level !== undefined) {
-            return level;
-        } else {
-            return this.defaultLogLevel;
+            if (pattern.includes('*')) {
+                const regex = this.getWildcardRegex(pattern);
+                if (regex.test(loggerName)) {
+                    return this._logLevels[pattern];
+                }
+            }
         }
+
+        return this.defaultLogLevel;
     }
 
     /**
@@ -223,4 +236,18 @@ export class LogLevelCliContribution implements CliContribution, Disposable {
 
         return level;
     }
+
+    /**
+     * Converts a wildcard string into a strict regular expression and caches it.
+     * Example: "ai-core*" -> /^ai-core.*$/
+     */
+    protected getWildcardRegex(pattern: string): RegExp {
+        let regex = this.wildcardRegexCache.get(pattern);
+        if (!regex) {
+            const escapedPattern = pattern.split('*').map(escapeRegExpCharacters).join('.*');
+            regex = new RegExp(`^${escapedPattern}$`);
+            this.wildcardRegexCache.set(pattern, regex);
+        }
+        return regex;
+    }
 }