bank20baht-validator 0.1.0 → 0.1.1

package/dist/index.js

@@ -443,6 +443,25 @@ function assertValidFields(form) {
         }
     }
 }
+/**
+ * True for the textbook ReDoS shape: an unbounded quantifier (`* + {n,}`)
+ * applied to a group whose ENTIRE body is one unboundedly-quantified atom —
+ * `(a+)+`, `(\d*)*`, `(?:\w+){2,}`. That exact nesting is always either
+ * redundant (matches the same language as a single quantifier) or exponential
+ * to backtrack, so rejecting it has no legitimate false positives. It is
+ * deliberately NARROW: longer bodies like `(abc+)+` are safe (the literal
+ * prefix removes the cross-iteration ambiguity) and other catastrophic shapes
+ * (e.g. overlapping alternation `(a|a)*`) are out of scope — patterns are
+ * builder-authored, so the goal is catching the classic authoring mistake at
+ * save time, not sandboxing hostile regexes.
+ */
+function hasNestedUnboundedQuantifier(pattern) {
+    // Strip escaped chars and character classes first so `\+`, `[+]` etc.
+    // aren't mistaken for quantifiers or group delimiters.
+    const stripped = pattern.replace(/\\./g, 'x').replace(/\[[^\]]*\]/g, 'C');
+    const unbounded = '(?:[*+]|\\{\\d+,\\})';
+    return new RegExp(`\\((?:\\?:)?[^()|]${unbounded}\\??\\)${unbounded}`).test(stripped);
+}
 function assertFieldShape(field, formName) {
     if (typeof field.type !== 'string' || !FIELD_TYPES.has(field.type)) {
         throw new Error(`unknown field type ${JSON.stringify(field.type)} on ${formName}`);
@@ -473,12 +492,18 @@ function assertFieldShape(field, formName) {
             if (v.type === 'pattern') {
                 // compile now — an invalid regex would otherwise throw (or hang, if
                 // catastrophic) inside validateField on every future submission
+                const pattern = String(v.value);
                 try {
-                    new RegExp(String(v.value));
+                    new RegExp(pattern);
                 }
                 catch {
                     throw new Error(`invalid pattern ${JSON.stringify(v.value)} on ${formName}.${field.key}`);
                 }
+                if (hasNestedUnboundedQuantifier(pattern)) {
+                    throw new Error(`pattern on ${formName}.${field.key} nests unbounded quantifiers ` +
+                        `(e.g. "(a+)+") — this backtracks catastrophically on hostile input; ` +
+                        `an equivalent single quantifier matches the same strings`);
+                }
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bank20baht-validator",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "description": "Runtime validation for bahtui form/workflow JSON — the exact engine rules the client runs, on the server.",
   "license": "MIT",