@tiden/reporter-commons 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.1
+
+- **Fixed a polynomial ReDoS in `extractAndCleanStep`** (CodeQL `js/polynomial-redos`, high).
+  Its single regex spanned both the `TidenExpRes:` and `TidenData:` markers and needed an
+  ambiguous `\s*:?\s*` prefix: for a run of N spaces there are O(N) ways to split them across
+  the two `\s*`, so a step name containing a long run of spaces backtracked polynomially.
+  Replaced with index-based slicing, matching what upstream `qase-javascript-commons` moved to.
+- Two bugs fixed along the way: a single marker with no counterpart was silently ignored (the
+  old regex required both), and `.` dropped multiline marker values.
+
 ## 0.1.0
 
 Initial Tiden fork release of `@tiden/reporter-commons`.

package/README.md

@@ -9,7 +9,7 @@ See the [root README](https://github.com/qase-tms/tiden-javascript/blob/main/REA
 ## Who uses this
 
 This package is **not meant to be installed or configured directly** in a test project — it's a
-dependency of framework-specific reporters (currently [`@tiden/playwright-reporter`](https://github.com/qase-tms/tiden-javascript/blob/main/playwright/README.md)).
+dependency of framework-specific reporters ([`@tiden/playwright-reporter`](https://github.com/qase-tms/tiden-javascript/blob/main/playwright/README.md), [`@tiden/vitest-reporter`](https://github.com/qase-tms/tiden-javascript/blob/main/vitest/README.md), and [`@tiden/jest-reporter`](https://github.com/qase-tms/tiden-javascript/blob/main/jest/README.md)).
 Install and configure the reporter for your framework instead; it composes this package's config
 loader, env resolver, and API transport internally.
 

package/dist/internal/step-parser.d.ts

@@ -7,5 +7,10 @@ export interface ExtractedStep {
  * Parses a step string for inline `TidenExpRes:` (expected result) and `TidenData:`
  * (data) markers. Returns the extracted parts and the input string with markers
  * removed. If no markers are present, returns nulls and the original string.
+ *
+ * Index-based rather than regex-matched: a single pattern spanning both markers
+ * needs an ambiguous `\s*:?\s*` prefix, which backtracks polynomially on a step
+ * name containing a long run of spaces (CodeQL js/polynomial-redos). Slicing is
+ * linear, and it also keeps multiline marker values intact, which `.` did not.
  */
 export declare function extractAndCleanStep(input: string): ExtractedStep;

package/dist/internal/step-parser.js

@@ -1,28 +1,47 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractAndCleanStep = extractAndCleanStep;
+const EXPECTED_RESULT_MARKER = 'TidenExpRes:';
+const DATA_MARKER = 'TidenData:';
+/**
+ * Drops the marker's optional second colon and the surrounding whitespace, so
+ * that both `TidenExpRes: value` and `TidenExpRes:: value` yield `value`.
+ *
+ * Anchored and always matchable, so it cannot backtrack.
+ */
+function readMarkerValue(raw) {
+    return raw.replace(/^\s*:?\s*/, '').trim();
+}
 /**
  * Parses a step string for inline `TidenExpRes:` (expected result) and `TidenData:`
  * (data) markers. Returns the extracted parts and the input string with markers
  * removed. If no markers are present, returns nulls and the original string.
+ *
+ * Index-based rather than regex-matched: a single pattern spanning both markers
+ * needs an ambiguous `\s*:?\s*` prefix, which backtracks polynomially on a step
+ * name containing a long run of spaces (CodeQL js/polynomial-redos). Slicing is
+ * linear, and it also keeps multiline marker values intact, which `.` did not.
  */
 function extractAndCleanStep(input) {
-    let expectedResult = null;
-    let data = null;
-    let cleanedString = input;
-    const hasExpectedResult = input.includes('TidenExpRes:');
-    const hasData = input.includes('TidenData:');
-    if (hasExpectedResult || hasData) {
-        const regex = /TidenExpRes:\s*:?\s*(.*?)\s*(?=TidenData:|$)TidenData:\s*:?\s*(.*)?/;
-        const match = input.match(regex);
-        if (match) {
-            expectedResult = match[1]?.trim() ?? null;
-            data = match[2]?.trim() ?? null;
-            cleanedString = input
-                .replace(/TidenExpRes:\s*:?\s*.*?(?=TidenData:|$)/, '')
-                .replace(/TidenData:\s*:?\s*.*/, '')
-                .trim();
-        }
+    const expectedResultIndex = input.indexOf(EXPECTED_RESULT_MARKER);
+    const dataIndex = input.indexOf(DATA_MARKER);
+    if (expectedResultIndex === -1 && dataIndex === -1) {
+        return { expectedResult: null, data: null, cleanedString: input };
     }
-    return { expectedResult, data, cleanedString };
+    // Each marker's value runs until the next marker, or to the end of the input.
+    const expectedResultEnd = dataIndex > expectedResultIndex ? dataIndex : input.length;
+    const dataEnd = expectedResultIndex > dataIndex ? expectedResultIndex : input.length;
+    const expectedResult = expectedResultIndex === -1
+        ? null
+        : readMarkerValue(input.slice(expectedResultIndex + EXPECTED_RESULT_MARKER.length, expectedResultEnd));
+    const data = dataIndex === -1
+        ? ''
+        : readMarkerValue(input.slice(dataIndex + DATA_MARKER.length, dataEnd));
+    const markerIndexes = [expectedResultIndex, dataIndex].filter((index) => index !== -1);
+    return {
+        expectedResult,
+        // an omitted data value stays `null`, matching the long-standing contract
+        data: data === '' ? null : data,
+        cleanedString: input.slice(0, Math.min(...markerIndexes)).trim(),
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiden/reporter-commons",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Tiden JS Reporters",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",