agent-sanitizer 2.48.6 → 2.49.1

package/THREAT-MODEL.md

@@ -779,6 +779,72 @@ The knob adds no layer and changes no layer's semantics. Ambiguous input still
 fails open at the detection level (precision over recall), as it always has —
 that is a separate, and unrelated, sense of the phrase.
 
+## Linear-time guarantee
+
+Every layer here reads attacker-controlled text inside a hook the user waits on,
+so a cost blow-up is a denial of service against the agent: the sanitizer that
+hangs on a crafted paste has failed as completely as one that misses the
+payload. This is a property of the whole surface, not of any one layer, so it is
+stated once here rather than restated per layer.
+
+**The contract.** No entry point costs more than `n log n` in its input: linear
+up to the constant factors a parse pays, and one sort where findings or splice
+ranges arrive in an order the caller does not promise (`foldConfusables`,
+`mergeRanges`). The bound that matters is that nothing is _quadratic_ — a sort
+of the findings in a 1 MB paste is milliseconds, a quadratic rescan of it is
+minutes — and quadratic is what the two gates below are calibrated to catch,
+because neither can see what the other does.
+
+**Static — every pattern.** `tests/test_redos_js_static_guard.py` drives
+regexploit over an inventory that `scripts/extract-js-regexes.mjs` extracts by
+walking the TypeScript AST of every shipped `.mjs` (not by matching regex source
+with a regex), and fails on any pattern with super-linear backtracking. A
+`RegExp(…)` built at runtime must be statically resolvable or carry a written
+exemption, so a new dynamic pattern is a red build rather than a hole.
+`tests/secrets/test_redos_static_guard.py` is the twin over the Python engine,
+and `eslint-plugin-redos` reports the same class in the editor, before CI.
+
+**Empirical — everything the static gates cannot see.** Two shapes of quadratic
+carry no backtracking at all, so no pattern analyzer will ever report them:
+
+- an **unanchored** pattern retried at every start offset, each attempt linear
+  and none of them backtracking — `(?=.*[A-Z])(?=.*[0-9])` against a long value
+  carrying neither class, or a `[^>]*$` tail rescanned from every `<`;
+- work that is not a pattern at all — a string rebuilt once per finding, a
+  prefix re-sliced inside a loop, a re-walk of an already-walked node.
+
+`test/algorithmic-complexity.test.mjs` runs an entry point over an adversarial
+input at two sizes 8x apart and asserts the cost grew like the input rather than
+like its square, with a known-quadratic specimen as the control that proves the
+harness can still see one. Each case also asserts, at the size it measures, that
+the input still reaches the code the case is about — a length gate answering
+first is how such a case quietly degrades into timing nothing.
+`tests/secrets/test_algorithmic_complexity.py` is the twin over the Python
+engine. `test/hook-latency.test.mjs` covers the three blocking hook paths
+instead, in cost per calibration pass, with one wall-clock ceiling.
+
+**Idioms new code is held to.** Each is the fix for a defect one of the gates
+caught:
+
+- Anchor a tail scan, or slice the tail first (`lastIndexOf(">")`) and match a
+  fixed-length pattern against it — never `[^x]*$` over the whole input.
+- Spell alternatives disjointly (`\d+(?:\.\d+)?|\.\d+`, not `\d*\.?\d+`) so a
+  failing match gives up in constant time per step rather than retrying every
+  split of a long run.
+- Bound an unbounded quantifier that can span the input, and stitch the chunks
+  (`src/invisible.mjs`'s `LONG_RUN_CHUNK_RE`), so the backtrack stack has a
+  ceiling that does not move with the input.
+- Assemble a rewritten string once, from an array of pieces — never
+  `text.slice(0, i) + x + text.slice(j)` once per finding.
+- Bound every recursive walk by depth and memo, and thread the wall-clock
+  `Deadline` through the layers that can be skipped, so a budget already spent
+  refuses the work instead of starting it.
+
+The guarantee is about COST, not about verdicts. Where a bound and a detection
+disagree — a value too long to analyze, a walk past `MAX_DEPTH`, a spent
+deadline — the layer takes the false negative and says so, exactly as the
+precision-over-recall doctrine requires everywhere else.
+
 ## Benchmark (`test/injection-corpus.test.mjs`)
 
 The published "invisible prompt injection" corpora fall in two families, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.48.6",
+  "version": "2.49.1",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {
@@ -59,6 +59,7 @@
     "c8": "11.0.0",
     "esbuild": "0.28.1",
     "eslint": "10.4.0",
+    "eslint-plugin-redos": "4.5.0",
     "fast-check": "4.8.0",
     "globals": "17.6.0",
     "lint-staged": "^17.0.5",

package/src/confusables.mjs

@@ -198,21 +198,21 @@ function describeFolds(findings) {
 
 /**
  * Reject a finding that does not describe a real, foldable glyph at its reported
- * offset in `text`. Every consumer of a scanner finding runs this BEFORE acting
- * on it, so a buggy or adversarial scanner fails loud instead of silently
- * corrupting (or silently escaping the fold gate in) a path/command.
- * @param {string} text
+ * offset. Every consumer of a scanner finding runs this BEFORE acting on it, so
+ * a buggy or adversarial scanner fails loud instead of silently corrupting (or
+ * silently escaping the fold gate in) a path/command. `actual` is the bytes that
+ * sit at `finding.index` right now — from the input for an untouched region,
+ * from the folded output for one the caller has already rewritten.
  * @param {{ index: number, char: string, latinEquivalent: string }} finding
+ * @param {string} actual
  * @returns {void}
  */
-function assertFinding(text, finding) {
-  // Fail loud on a finding that does not match the actual bytes at its offset:
-  // a buggy/adversarial scanner reporting a wrong char/index would otherwise
-  // silently corrupt the path/command, defeating the deny-rule protection.
-  // A negative index is the gap the startsWith guard alone misses: when `char`
-  // is a prefix of the text, `startsWith(char, -1)` is true (the offset is
-  // clamped to 0), and the slice math below then mangles the string instead of
-  // throwing — so range-check the index explicitly first.
+function assertFinding(finding, actual) {
+  // A negative index is the gap the byte check alone misses: `String.slice`
+  // reads a negative offset from the END, so `actual` can be a genuine match
+  // taken from the wrong place — `{index: -2, char: "а"}` against `"aаb"`
+  // matches, and the splice math then folds a byte the finding never named.
+  // Range-check the index explicitly first.
   if (!Number.isInteger(finding.index) || finding.index < 0)
     throw new Error(
       `Confusable finding has an out-of-range index ${finding.index}`,
@@ -235,7 +235,7 @@ function assertFinding(text, finding) {
     throw new Error(
       `Confusable finding at index ${finding.index} names an ASCII char ${JSON.stringify(finding.char)}`,
     );
-  if (!text.startsWith(finding.char, finding.index))
+  if (!actual.startsWith(finding.char))
     throw new Error(
       `Confusable finding does not match input at index ${finding.index}: expected ${JSON.stringify(finding.char)}`,
     );
@@ -264,6 +264,17 @@ function assertFinding(text, finding) {
       );
 }
 
+/**
+ * The bytes `finding.char` claims to sit on, read from `text`. Bounded to the
+ * glyph's own length so validating a finding never copies the rest of the input.
+ * @param {string} text
+ * @param {{ index: number, char: string }} finding
+ * @returns {string}
+ */
+function bytesAt(text, finding) {
+  return text.slice(finding.index, finding.index + finding.char.length);
+}
+
 /**
  * True for a code point that ends a token: any ASCII character that is not a
  * letter or digit (space, `/`, `.`, `-`, `_`, quotes, shell metacharacters). A
@@ -295,7 +306,8 @@ function isTokenBoundary(ch) {
  * @returns {Array<{ index: number, char: string, latinEquivalent: string }>}
  */
 export function selectFoldableFindings(text, findings) {
-  for (const finding of findings) assertFinding(text, finding);
+  for (const finding of findings)
+    assertFinding(finding, bytesAt(text, finding));
 
   // Every UTF-16 offset a finding covers, not just its start: a scanner is free
   // to report a multi-code-point match, and treating only the first offset as
@@ -341,10 +353,15 @@ export function selectFoldableFindings(text, findings) {
 
   // Every offset the finding covers, not just its first: `char` may span a
   // boundary into a token the gate rejected, and folding it would rewrite that
-  // token — the exact mangling this gate exists to prevent.
-  return findings.filter((finding) =>
-    [...finding.char].every((_, i) => foldableAt[finding.index + i] === 1),
-  );
+  // token — the exact mangling this gate exists to prevent. Counted in UTF-16
+  // units, which is what `foldableAt` is indexed by: an astral glyph occupies
+  // two of them, so a code-point walk would leave the tail of a `char` that
+  // carries one unchecked.
+  return findings.filter((finding) => {
+    for (let i = 0; i < finding.char.length; i++)
+      if (foldableAt[finding.index + i] !== 1) return false;
+    return true;
+  });
 }
 
 /**
@@ -365,7 +382,6 @@ export function foldConfusables(text, findings) {
   /** @type {string[]} */
   const tail = [];
   let cursor = text.length;
-  const rebuild = () => [...tail].reverse().join("");
   for (const finding of [...findings].sort(
     (lhs, rhs) => rhs.index - lhs.index,
   )) {
@@ -374,21 +390,53 @@ export function foldConfusables(text, findings) {
     // a glyph that is not there fails loud. Highest-index-first leaves every
     // offset below `cursor` byte-identical to `text`, so a finding ending there
     // is checked against `text` itself; one reaching PAST `cursor` overlaps a
-    // fold already applied, and only the rebuilt tail carries the bytes it now
-    // sits on.
+    // fold already applied, and only the folded bytes carry what it now sits on.
     if (end <= cursor) {
-      assertFinding(text, finding);
+      assertFinding(finding, bytesAt(text, finding));
       tail.push(text.slice(end, cursor));
     } else {
-      const folded = rebuild();
-      assertFinding(text.slice(0, cursor) + folded, finding);
-      tail.length = 0;
-      tail.push(folded.slice(end - cursor));
+      // The overlap reaches at most `char.length` past `cursor`, and those bytes
+      // are the ones pushed most recently, so take them off the tail instead of
+      // re-joining all of it — a whole-tail rebuild per overlapping finding is
+      // the O(findings x length) cost this assembly exists to avoid. Consuming
+      // them is also what the fold means: `char` replaces those bytes.
+      const overlap = takeFromTail(tail, end - cursor);
+      assertFinding(finding, text.slice(finding.index, cursor) + overlap);
     }
     tail.push(finding.latinEquivalent);
     cursor = finding.index;
   }
-  return text.slice(0, cursor) + rebuild();
+  return text.slice(0, cursor) + tail.reverse().join("");
+}
+
+/**
+ * Remove and return the first `count` characters of the folded tail. The tail is
+ * stored back-to-front, so its lowest-offset bytes are the entries pushed most
+ * recently and popping walks them in reading order; a partially consumed entry
+ * is pushed back minus what was taken.
+ * @param {string[]} tail
+ * @param {number} count
+ * @returns {string}
+ */
+function takeFromTail(tail, count) {
+  /** @type {string[]} */
+  const taken = [];
+  let remaining = count;
+  while (remaining > 0) {
+    const entry = tail.pop();
+    // A tail shorter than `count` means the finding claims bytes past the end of
+    // the folded text — a mismatching finding, which the caller's assertion
+    // rejects by name once it sees the short result. Stop rather than pretend.
+    if (entry === undefined) break;
+    if (entry.length > remaining) {
+      taken.push(entry.slice(0, remaining));
+      tail.push(entry.slice(remaining));
+      break;
+    }
+    taken.push(entry);
+    remaining -= entry.length;
+  }
+  return taken.join("");
 }
 
 /**

package/src/html.mjs

@@ -590,13 +590,19 @@ function hexByte(n) {
  * clamps out-of-range) or a percentage `0%..100%` scaled to `0..255`. Returns
  * null (fail open) on any other shape — a `none`/`calc()`/negative channel we
  * cannot resolve to a concrete byte.
+ *
+ * The number shape here (and in `hueDegrees`/`hslPercent`) spells the integer
+ * and leading-`.` forms as disjoint alternatives rather than `\d*\.?\d+`: the
+ * latter's `\d*` and `\d+` both match a digit, so every split of a long digit
+ * run is retried against the rest of the pattern and a failing token costs
+ * O(n^2). Disjoint arms fail each backtrack step in constant time.
  * @param {string} token
  * @returns {number | null}
  */
 function rgbChannel(token) {
-  const pct = token.match(/^\+?(\d*\.?\d+)%$/);
+  const pct = token.match(/^\+?(\d+(?:\.\d+)?|\.\d+)%$/);
   if (pct) return (Math.min(100, parseFloat(pct[1])) / 100) * 255;
-  const num = token.match(/^\+?(\d*\.?\d+)$/);
+  const num = token.match(/^\+?(\d+(?:\.\d+)?|\.\d+)$/);
   if (num) return parseFloat(num[1]);
   return null;
 }
@@ -608,7 +614,9 @@ function rgbChannel(token) {
  * @returns {number | null}
  */
 function hueDegrees(token) {
-  const match = token.match(/^([+-]?\d*\.?\d+)(deg|grad|rad|turn)?$/);
+  const match = token.match(
+    /^([+-]?(?:\d+(?:\.\d+)?|\.\d+))(deg|grad|rad|turn)?$/,
+  );
   if (!match) return null;
   const value = parseFloat(match[1]);
   const unit = match[2] || "deg";
@@ -630,7 +638,7 @@ function hueDegrees(token) {
  * @returns {number | null}
  */
 function hslPercent(token) {
-  const match = token.match(/^\+?(\d*\.?\d+)%?$/);
+  const match = token.match(/^\+?(\d+(?:\.\d+)?|\.\d+)%?$/);
   return match ? Math.min(100, parseFloat(match[1])) : null;
 }
 
@@ -688,7 +696,11 @@ function canonicalizeColorFunction(value) {
   }
   // A literal-zero alpha is fully transparent — bare number (`0`, `0.0`) or the
   // CSS Color 4 percentage form (`0%`), which a browser also renders invisible.
-  if (alpha !== null && /^\+?0*\.?0+%?$/.test(alpha)) return "transparent";
+  // Disjoint arms for the same reason the channel patterns above carry them:
+  // `0*` and `0+` both match a zero, so a long run of them would be retried at
+  // every split before the match could fail.
+  if (alpha !== null && /^\+?(?:0+(?:\.0+)?|\.0+)%?$/.test(alpha))
+    return "transparent";
   if (parts.length !== 3) return null;
   if (isRgb) {
     const channels = parts.map(rgbChannel);
@@ -1806,7 +1818,11 @@ const BOGUS_COMMENT_OPEN_RE = /<[!?]/g;
 // html-property "second pass changes nothing"). An open/end tag requires a
 // name letter after the `<`/`</`, so literal prose like `a < b` or an `i <3 u`
 // emoticon is not mistaken for markup.
-const UNTERMINATED_MARKUP_TAIL_RE = /<(?:[!?]|\/?[a-zA-Z])[^>]*$/;
+// Matched against the slice after the last `>` rather than as a `[^>]*$` tail:
+// the tail form has to rescan to end-of-input from every `<` in the source, so
+// a document of many `<` and no `>` costs O(n^2). This form is fixed-length, so
+// each start offset is constant.
+const MARKUP_OPENER_RE = /<(?:[!?]|\/?[a-zA-Z])/;
 
 /**
  * Fold a raw source slice into the "inside an unterminated tag" state. A `>`
@@ -1820,8 +1836,10 @@ const UNTERMINATED_MARKUP_TAIL_RE = /<(?:[!?]|\/?[a-zA-Z])[^>]*$/;
  * @returns {boolean}
  */
 function foldAbsorb(absorbing, raw) {
-  if (raw.includes(">")) return UNTERMINATED_MARKUP_TAIL_RE.test(raw);
-  return absorbing || UNTERMINATED_MARKUP_TAIL_RE.test(raw);
+  const lastClose = raw.lastIndexOf(">");
+  const opensMarkup = MARKUP_OPENER_RE.test(raw.slice(lastClose + 1));
+  if (lastClose !== -1) return opensMarkup;
+  return absorbing || opensMarkup;
 }
 
 /**
@@ -2499,7 +2517,22 @@ const DIGEST_HEX_LENGTHS = new Set([32, 40, 56, 64, 96, 128]);
 // the slug benign (no uppercase) while catching the scattered-separator blob the
 // run gate missed. Anchored to the whole value for the same RAW-query reason.
 const BLOB_VALUE_B64URL_RE = /^[A-Za-z0-9_-]{40,}={0,2}$/;
-const B64URL_MIXED_RE = /(?=.*[A-Z])(?=.*[0-9])/;
+
+/**
+ * True when `value` carries at least one uppercase letter AND one digit — the
+ * character mix that separates bulk-encoded bytes from a lowercase word-slug.
+ * Two single-character-class scans rather than one `(?=.*[A-Z])(?=.*[0-9])`
+ * regex: an unanchored lookahead pair costs a full scan at EVERY start offset,
+ * so a long value that carries neither class is quadratic to reject. The two
+ * agree on any value without a newline, which every caller guarantees by
+ * gating on an anchored pattern over a newline-free alphabet first — `.` in
+ * that lookahead does not cross a line, so only there could they differ.
+ * @param {string} value
+ * @returns {boolean}
+ */
+function hasUpperAndDigit(value) {
+  return /[A-Z]/.test(value) && /[0-9]/.test(value);
+}
 
 // A path segment whose whole value is a base64/hex run longer than any standard
 // content hash (SHA-512 hex is 128, base64 88; SHA-256 hex 64) is bulk encoded
@@ -2510,6 +2543,8 @@ const B64URL_MIXED_RE = /(?=.*[A-Z])(?=.*[0-9])/;
 // standard arm so a long word-slug (`the-secret-history-of-…`) is not mistaken
 // for a payload; the url-safe arm re-admits `-`/`_` but, like the query arm
 // above, gates on a contiguous 40+ alphanumeric run to keep the slug benign.
+// The two arms overlap on `[A-Fa-f0-9]` but stay linear: `={0,2}$` fails in
+// constant time after the first giveback, so each arm costs one pass.
 const PATH_BLOB_RE = /^(?:[A-Za-z0-9+/]+={0,2}|[A-Fa-f0-9]+)$/;
 // SHA-512 is 128 hex characters and no standard digest is longer, so a run past
 // this is bulk encoded data rather than any fingerprint. Shared by the two path
@@ -2526,7 +2561,7 @@ const DIGEST_MAX_LEN = 128;
  * @returns {boolean}
  */
 function isBase64UrlBlob(value) {
-  return BLOB_VALUE_B64URL_RE.test(value) && B64URL_MIXED_RE.test(value);
+  return BLOB_VALUE_B64URL_RE.test(value) && hasUpperAndDigit(value);
 }
 
 // `.` and `,` are legal in a URL but sit outside every blob alphabet above, so
@@ -2570,7 +2605,7 @@ function isChunkedPathBlob(segment) {
   return (
     joined !== null &&
     joined.length > DIGEST_MAX_LEN &&
-    ((PATH_BLOB_RE.test(joined) && B64URL_MIXED_RE.test(joined)) ||
+    ((PATH_BLOB_RE.test(joined) && hasUpperAndDigit(joined)) ||
       isBase64UrlBlob(joined))
   );
 }
@@ -2968,7 +3003,12 @@ function parseSrcset(value) {
     const start = i;
     while (i < n && !SRCSET_WS_RE.test(value[i])) i++;
     const run = value.slice(start, i);
-    const url = run.replace(/,+$/, "");
+    // The trailing commas come off by scanning back rather than by replacing
+    // `,+$`: that pattern is unanchored at the start, so a run of commas costs
+    // one match attempt per comma.
+    let cut = run.length;
+    while (cut > 0 && run[cut - 1] === ",") cut--;
+    const url = run.slice(0, cut);
     if (url) urls.push(url);
     // A URL run ending in a comma is a bare candidate (no descriptor); the
     // comma already delimits the next one, so skip descriptor parsing.