@wrongstack/core 0.3.3 → 0.3.4

package/dist/storage/index.d.ts

@@ -4,7 +4,7 @@ import { e as AttachmentStore, A as AddAttachmentInput, d as AttachmentRef, a as
 export { D as DefaultSessionReader } from '../session-reader-CcPi4BQ8.js';
 import { b as MemoryStore, a as MemoryScope } from '../memory-CEXuo7sz.js';
 import { a as WstackPaths } from '../wstack-paths-BGu2INTm.js';
-import { c as ConfigStore, a as Config, b as ConfigLoader } from '../config-D2qvAxVd.js';
+import { c as ConfigStore, a as Config, b as ConfigLoader } from '../config-DgE3JslD.js';
 import { S as SecretVault } from '../secret-vault-DoISxaKO.js';
 import '../models-registry-Y2xbog0E.js';
 

package/dist/storage/index.js

@@ -1357,6 +1357,42 @@ function defaultIsPidAlive(pid) {
   }
 }
 
+// src/utils/regex-guard.ts
+var MAX_PATTERN_LEN = 512;
+var DANGEROUS_PATTERNS = [
+  /(\([^)]*[+*][^)]*\))[+*]/,
+  // (a+)+, (.*)+, etc
+  /(\(\?:[^)]*[+*][^)]*\))[+*]/
+  // same, with non-capturing group
+];
+function compileUserRegex(pattern, flags) {
+  if (typeof pattern !== "string") {
+    return { ok: false, reason: "pattern must be a string" };
+  }
+  if (pattern.length === 0) {
+    return { ok: false, reason: "pattern is empty" };
+  }
+  if (pattern.length > MAX_PATTERN_LEN) {
+    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
+  }
+  for (const rx of DANGEROUS_PATTERNS) {
+    if (rx.test(pattern)) {
+      return {
+        ok: false,
+        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
+      };
+    }
+  }
+  try {
+    return { ok: true, regex: new RegExp(pattern, flags) };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err instanceof Error ? err.message : "invalid regex"
+    };
+  }
+}
+
 // src/storage/session-reader.ts
 var DefaultSessionReader = class {
   store;
@@ -1451,7 +1487,11 @@ function buildMatcher(q) {
   const ci = q.caseInsensitive ?? true;
   if (q.regex) {
     const flags = ci ? "i" : "";
-    const re = new RegExp(q.query, flags);
+    const compiled = compileUserRegex(q.query, flags);
+    if (!compiled.ok) {
+      throw new Error(`Invalid search regex "${q.query}": ${compiled.reason}`);
+    }
+    const re = compiled.regex;
     return (text) => {
       const m = re.exec(text);
       return m ? { start: m.index, end: m.index + m[0].length } : null;