configorama 0.9.5 → 0.9.11

package/src/resolvers/valueFromNumber.js

@@ -1,6 +1,9 @@
 const isNumber = require('lodash.isnumber')
 
 function isNumberVariable(variableString) {
+  if (!variableString || variableString.trim().length === 0) {
+    return false
+  }
   const num = Number(variableString)
   return !isNaN(num) && isNumber(num)
 }

package/src/utils/handleSignalEvents.js

@@ -24,10 +24,9 @@ Exit received. Waiting for current operation to finish...
     // Clean up readline interface when done
     process.once('exit', () => rl.close())
     
-    // Use once() instead of on()
-    rl.once('SIGINT', () => process.emit('SIGINT'))
-    rl.once('SIGTERM', () => process.emit('SIGTERM'))
-    rl.once('SIGBREAK', () => process.emit('SIGBREAK'))
+    rl.on('SIGINT', () => process.emit('SIGINT'))
+    rl.on('SIGTERM', () => process.emit('SIGTERM'))
+    rl.on('SIGBREAK', () => process.emit('SIGBREAK'))
   }
 
   // Remove any existing listeners before adding new ones

package/src/utils/lodash.js

@@ -47,26 +47,37 @@ function set(object, path, value) {
   return object;
 }
 
+// Cache for trim regex patterns (perf: avoid recompilation)
+const trimRegexCache = new Map()
+
 // Custom implementation of lodash.trim
 function trim(string, chars) {
   if (string === null || string === undefined) {
     return '';
   }
-  
+
   string = String(string);
-  
+
   if (!chars && String.prototype.trim) {
     return string.trim();
   }
-  
+
   if (!chars) {
     // Default characters to trim (whitespace)
     chars = ' \t\n\r\f\v\u00a0\u1680\u2000\u200a\u2028\u2029\u202f\u205f\u3000\ufeff';
   }
-  
-  // Create a regex pattern with the characters to trim
-  const pattern = new RegExp(`^[${chars.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, '\\$&')}]+|[${chars.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, '\\$&')}]+$`, 'g');
-  
+
+  // Check cache first
+  let pattern = trimRegexCache.get(chars)
+  if (!pattern) {
+    // Create and cache regex pattern with the characters to trim
+    const escaped = chars.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, '\\$&')
+    pattern = new RegExp(`^[${escaped}]+|[${escaped}]+$`, 'g')
+    trimRegexCache.set(chars, pattern)
+  }
+
+  // Reset lastIndex for global regex reuse
+  pattern.lastIndex = 0
   return string.replace(pattern, '');
 }
 

package/src/utils/parsing/cloudformationSchema.js

@@ -1,7 +1,6 @@
 const YAML = require('js-yaml');
 const includes = require('lodash.includes');
 const isString = require('lodash.isstring');
-const split = require('lodash.split');
 const flatten = require('lodash.flatten');
 const map = require('lodash.map');
 
@@ -67,7 +66,7 @@ const createSchema = () => {
       map(['mapping', 'scalar', 'sequence'], kind => yamlType(functionName, kind))
     )
   );
-  return YAML.Schema.create(types);
+  return YAML.Schema.create(YAML.DEFAULT_SAFE_SCHEMA, types);
 };
 
 module.exports = {

package/src/utils/parsing/cloudformationSchema.test.js

@@ -233,4 +233,18 @@ test('!EachMemberIn - member inclusion check', () => {
   assert.equal(parsed.Value['Fn::EachMemberIn'], [['a', 'b'], ['a', 'b', 'c']])
 })
 
+// ==========================================
+// Security - Unsafe YAML tags should be blocked
+// ==========================================
+
+test('security - !!js/function should be rejected', () => {
+  const maliciousYaml = `Handler: !!js/function 'function() { return "pwned"; }'`
+  assert.throws(() => parseCfYaml(maliciousYaml), /unknown tag/)
+})
+
+test('security - !!js/regexp should be rejected', () => {
+  const maliciousYaml = `Pattern: !!js/regexp /test/`
+  assert.throws(() => parseCfYaml(maliciousYaml), /unknown tag/)
+})
+
 test.run()

package/src/utils/parsing/parse.js

@@ -5,6 +5,7 @@ const YAML = require('../../parsers/yaml')
 const TOML = require('../../parsers/toml')
 const INI = require('../../parsers/ini')
 const JSON5 = require('../../parsers/json5')
+const HCL = require('../../parsers/hcl')
 const { executeTypeScriptFileSync } = require('../../parsers/typescript')
 const { executeESMFileSync } = require('../../parsers/esm')
 const cloudFormationSchema = require('./cloudformationSchema')
@@ -54,8 +55,17 @@ function parseFileContents({ contents, filePath, varRegex, dynamicArgs }) {
     configObject = TOML.parse(contents)
   } else if (fileType.match(/\.(ini)/i)) {
     configObject = INI.parse(contents)
-  } else if (fileType.match(/\.(json|json5)/i)) {
+  } else if (fileType.match(/\.(json|json5|jsonc)/i)) {
     configObject = JSON5.parse(contents)
+  } else if (fileType.match(/\.(tf|hcl)$/i) || filePath.match(/\.tf\.json$/i)) {
+    // Handle Terraform HCL files (.tf, .hcl) and Terraform JSON (.tf.json)
+    if (filePath.match(/\.tf\.json$/i)) {
+      // .tf.json files are just JSON
+      configObject = JSON5.parse(contents)
+    } else {
+      // .tf and .hcl files need HCL parsing
+      configObject = HCL.parse(contents, path.basename(filePath))
+    }
   // TODO detect js syntax and use appropriate parser
   } else if (fileType.match(/\.(js|cjs)/i)) {
     let jsFile

package/src/utils/parsing/preProcess.js

@@ -1,8 +1,10 @@
 /**
- * Preprocesses config to fix malformed fallback references
- * and escape variables inside help() filter arguments
+ * Preprocesses config to fix malformed fallback references,
+ * escape variables inside help() filter arguments,
+ * and convert bare references in if() expressions
  */
 const { splitByComma } = require('../strings/splitByComma')
+const { getQuoteRanges } = require('../strings/quoteAware')
 const { extractVariableWrapper } = require('../variables/variableUtils')
 
 /**
@@ -10,9 +12,12 @@ const { extractVariableWrapper } = require('../variables/variableUtils')
  * @param {Object} configObject - The parsed configuration object
  * @param {RegExp} variableSyntax - The variable syntax regex to use
  * @param {Array} [variableTypes] - Array of variable type definitions with type/prefix fields
+ * @param {Object} [options] - Options for preprocessing
+ * @param {boolean} [options.skipFallbackFix] - Skip fixing malformed fallbacks (for object configs)
  * @returns {Object} The preprocessed configuration object
  */
-function preProcess(configObject, variableSyntax, variableTypes) {
+function preProcess(configObject, variableSyntax, variableTypes, options = {}) {
+  const { skipFallbackFix = false } = options
   // Extract prefix/suffix from variable syntax for reconstructing variables
   const { prefix: varPrefix, suffix: varSuffix } = variableSyntax
     ? extractVariableWrapper(variableSyntax.source)
@@ -51,6 +56,214 @@ function preProcess(configObject, variableSyntax, variableTypes) {
     })
   }
 
+  /**
+   * Convert bare config references inside if() expressions to ${...} syntax
+   * Also wraps unquoted ${...} refs in quotes for proper string comparison
+   * e.g., ${if(provider.stage === "prod")} => ${if("${provider.stage}" === "prod")}
+   * e.g., ${if(${provider.stage} === "prod")} => ${if("${provider.stage}" === "prod")}
+   * @param {string} str - String potentially containing if() expressions
+   * @returns {string} String with bare refs converted
+   */
+  function convertBareRefsInIf(str) {
+    if (typeof str !== 'string') return str
+
+    const reserved = ['true', 'false', 'null', 'undefined', 'NaN', 'Infinity']
+    const prefixLen = varPrefix.length
+    const suffixLen = varSuffix.length
+
+    // Find if( blocks and process them
+    let result = str
+    let i = 0
+
+    while (i < result.length) {
+      // Look for ${if( or similar with custom prefix
+      const ifStart = result.indexOf(varPrefix + 'if(', i)
+      if (ifStart === -1) break
+
+      // Find the matching closing suffix by counting nested prefixes/suffixes
+      const contentStart = ifStart + prefixLen + 3 // after "${if("
+      let depth = 1
+      let j = contentStart
+
+      while (j < result.length && depth > 0) {
+        if (result.substring(j, j + prefixLen) === varPrefix) {
+          depth++
+          j += prefixLen
+        } else if (result.substring(j, j + suffixLen) === varSuffix) {
+          depth--
+          if (depth > 0) j += suffixLen
+        } else {
+          j++
+        }
+      }
+
+      if (depth === 0) {
+        // Extract the if content (everything between "if(" and the final ")")
+        const fullContent = result.substring(contentStart, j)
+
+        // Process the content: wrap bare refs and unquoted var refs in quotes
+        let processed = fullContent
+
+        // 1. First convert bare refs (word.word or word:word) to quoted var refs
+        // Must do this BEFORE handling ${...} to avoid double-wrapping
+        // Pattern excludes refs inside ${...} by using negative lookbehind for varPrefix
+        const escapedPrefix = varPrefix.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+        const bareRefPattern = new RegExp(
+          `(?<!${escapedPrefix}[^${varSuffix}]*)(?<!")(?<!')(?<=^|[^.\\w])([a-zA-Z_][a-zA-Z0-9_]*(?:[.:][a-zA-Z_][a-zA-Z0-9_]*)+)(?![.\\w])`,
+          'g'
+        )
+
+        // Simpler approach: find bare refs that are NOT inside ${...}
+        // Build list of ${...} ranges to exclude
+        const varRanges = []
+        let pos = 0
+        while (pos < processed.length) {
+          if (processed.substring(pos, pos + prefixLen) === varPrefix) {
+            const start = pos
+            let varDepth = 1
+            pos += prefixLen
+            while (pos < processed.length && varDepth > 0) {
+              if (processed.substring(pos, pos + prefixLen) === varPrefix) {
+                varDepth++
+                pos += prefixLen
+              } else if (processed.substring(pos, pos + suffixLen) === varSuffix) {
+                varDepth--
+                if (varDepth > 0) pos += suffixLen
+              } else {
+                pos++
+              }
+            }
+            pos += suffixLen
+            varRanges.push([start, pos])
+          } else {
+            pos++
+          }
+        }
+
+        // Build list of quoted string ranges to exclude
+        const quoteRanges = getQuoteRanges(fullContent)
+
+        // Comparison operators for detecting string comparison context
+        const comparisonOps = ['===', '!==', '==', '!=']
+
+        // Find and replace bare refs, skipping those inside ${...} or quoted strings
+        // Only quote bare refs that are in string comparison context
+        const simpleBarePat = /([a-zA-Z_][a-zA-Z0-9_]*(?:[.:][a-zA-Z_][a-zA-Z0-9_]*)+)/g
+        let offset = 0
+        let match
+        while ((match = simpleBarePat.exec(fullContent)) !== null) {
+          const bareRef = match[1]
+          const matchStart = match.index
+          const matchEnd = matchStart + bareRef.length
+
+          // Skip if inside a ${...} range
+          const insideVar = varRanges.some(([s, e]) => matchStart >= s && matchEnd <= e)
+          if (insideVar) continue
+
+          // Skip if inside a quoted string
+          const insideQuote = quoteRanges.some(([s, e]) => matchStart >= s && matchEnd <= e)
+          if (insideQuote) continue
+
+          // Skip reserved words
+          if (reserved.includes(bareRef)) continue
+
+          // Check if this ref is in a string comparison context
+          const afterRef = fullContent.substring(matchEnd).trimStart()
+          const beforeRef = fullContent.substring(0, matchStart).trimEnd()
+
+          const isComparedToString = comparisonOps.some(op => {
+            // Check if followed by: op "string"
+            if (afterRef.startsWith(op)) {
+              const afterOp = afterRef.substring(op.length).trimStart()
+              return afterOp.startsWith('"') || afterOp.startsWith("'")
+            }
+            // Check if preceded by: "string" op
+            for (const o of comparisonOps) {
+              const pattern = new RegExp(`["'][^"']*["']\\s*${o.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*$`)
+              if (pattern.test(beforeRef)) return true
+            }
+            return false
+          })
+
+          // Replace with var ref - quoted if string comparison, unquoted otherwise
+          const replacement = isComparedToString
+            ? `"${varPrefix}${bareRef}${varSuffix}"`
+            : `${varPrefix}${bareRef}${varSuffix}`
+          processed = processed.substring(0, matchStart + offset) + replacement + processed.substring(matchEnd + offset)
+          offset += replacement.length - bareRef.length
+        }
+
+        // 2. Quote unquoted ${...} refs that are used in string comparisons
+        // Pattern: ref followed by comparison operator and string, or string followed by operator and ref
+        // e.g., ${foo} === "bar" or "bar" === ${foo}
+        // Find ${...} refs that are in comparison context
+        pos = 0
+        let newProcessed = ''
+        while (pos < processed.length) {
+          if (processed.substring(pos, pos + prefixLen) === varPrefix) {
+            const precededByQuote = pos > 0 && processed[pos - 1] === '"'
+
+            // Find matching suffix
+            let varDepth = 1
+            let endPos = pos + prefixLen
+            while (endPos < processed.length && varDepth > 0) {
+              if (processed.substring(endPos, endPos + prefixLen) === varPrefix) {
+                varDepth++
+                endPos += prefixLen
+              } else if (processed.substring(endPos, endPos + suffixLen) === varSuffix) {
+                varDepth--
+                if (varDepth > 0) endPos += suffixLen
+              } else {
+                endPos++
+              }
+            }
+            endPos += suffixLen
+
+            const varRef = processed.substring(pos, endPos)
+            const followedByQuote = endPos < processed.length && processed[endPos] === '"'
+
+            // Check if this ref is in a string comparison context
+            const afterRef = processed.substring(endPos).trimStart()
+            const beforeRef = processed.substring(0, pos).trimEnd()
+
+            const isComparedToString = comparisonOps.some(op => {
+              // Check if followed by: op "string"
+              if (afterRef.startsWith(op)) {
+                const afterOp = afterRef.substring(op.length).trimStart()
+                return afterOp.startsWith('"') || afterOp.startsWith("'")
+              }
+              // Check if preceded by: "string" op
+              for (const o of comparisonOps) {
+                const pattern = new RegExp(`["'][^"']*["']\\s*${o.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*$`)
+                if (pattern.test(beforeRef)) return true
+              }
+              return false
+            })
+
+            if (!precededByQuote && !followedByQuote && isComparedToString) {
+              newProcessed += '"' + varRef + '"'
+            } else {
+              newProcessed += varRef
+            }
+            pos = endPos
+          } else {
+            newProcessed += processed[pos]
+            pos++
+          }
+        }
+        processed = newProcessed
+
+        // Reconstruct
+        result = result.substring(0, contentStart) + processed + result.substring(j)
+        i = contentStart + processed.length + suffixLen
+      } else {
+        i = ifStart + prefixLen
+      }
+    }
+
+    return result
+  }
+
   /**
    * Fix malformed fallback references in a string
    * @param {string} str - String potentially containing variables
@@ -154,9 +367,11 @@ function preProcess(configObject, variableSyntax, variableTypes) {
    */
   function traverseAndFix(obj) {
     if (typeof obj === 'string') {
-      // First escape help() variables, then fix fallbacks
+      // First escape help() variables, convert bare refs in if(), then fix fallbacks
       const withHelpEscaped = escapeHelpVariables(obj)
-      return fixFallbacksInString(withHelpEscaped)
+      const withBareRefsConverted = convertBareRefsInIf(withHelpEscaped)
+      // Skip fallback fixing for object configs (they handle bare refs differently)
+      return skipFallbackFix ? withBareRefsConverted : fixFallbacksInString(withBareRefsConverted)
     }
 
     if (Array.isArray(obj)) {

package/src/utils/paths/getFullFilePath.js

@@ -19,8 +19,12 @@ function resolveFilePath(pathToResolve, basePath) {
     fullFilePath = fs.realpathSync(fullFilePath)
   // Only use findUp for relative paths (not absolute paths)
   } else if (!path.isAbsolute(pathToResolve)) {
-    const cleanName = path.basename(pathToResolve)
-    const findUpResult = findUp.sync(cleanName, { cwd: basePath })
+    // Strip ./ and ../ prefixes for findUp, but preserve directory structure like utils/
+    let searchPath = pathToResolve
+    while (searchPath.startsWith('./') || searchPath.startsWith('../')) {
+      searchPath = searchPath.replace(/^\.\.?\//, '')
+    }
+    const findUpResult = findUp.sync(searchPath, { cwd: basePath })
     if (findUpResult) {
       fullFilePath = findUpResult
     }

package/src/utils/paths/getFullFilePath.test.js

@@ -109,6 +109,24 @@ test('resolveFilePath - relative path without ./ prefix triggers findUp', () =>
   assert.is(result, expected)
 })
 
+test('resolveFilePath - preserves directory structure when using findUp', () => {
+  // Create additional structure for this test:
+  // _test-getFullFilePath/
+  //   config.yml           <- WRONG file
+  //   utils/
+  //     config.yml         <- CORRECT file
+  //   subdir/deepdir/      <- searching from here
+  const utilsDir = path.join(testDir, 'utils')
+  fs.mkdirSync(utilsDir, { recursive: true })
+  fs.writeFileSync(path.join(utilsDir, 'config.yml'), 'correct: true')
+
+  // From deepDir, request "utils/config.yml" - should find testDir/utils/config.yml
+  const result = resolveFilePath('utils/config.yml', deepDir)
+  const expected = path.join(utilsDir, 'config.yml')
+  assert.is(result, expected,
+    `Should preserve 'utils/' directory and find utils/config.yml, not root config.yml. Got ${result}`)
+})
+
 // ==========================================
 // getFullPath - wrapper function
 // ==========================================

package/src/utils/regex/index.js

@@ -27,12 +27,27 @@ function parseFunctionCall(str) {
   
   let depth = 1
   let pos = startPos
-  
+  let inString = null // null, '"', or "'"
+
   // Track parenthesis depth to find matching closing paren
   while (pos < str.length && depth > 0) {
     const char = str[pos]
-    if (char === '(') depth++
-    else if (char === ')') depth--
+    const prevChar = pos > 0 ? str[pos - 1] : ''
+
+    // Toggle string state on unescaped quotes
+    if ((char === '"' || char === "'") && prevChar !== '\\') {
+      if (!inString) {
+        inString = char
+      } else if (char === inString) {
+        inString = null
+      }
+    }
+
+    // Only count parens outside strings
+    if (!inString) {
+      if (char === '(') depth++
+      else if (char === ')') depth--
+    }
     pos++
   }
   

package/src/utils/regex/index.test.js

@@ -91,6 +91,30 @@ test('parseFunctionCall - handles multiple parens in text', () => {
   assert.is(result[2], "'Choose option (A) or (B) or (C)'")
 })
 
+test('parseFunctionCall - handles unbalanced close paren in string', () => {
+  const result = parseFunctionCall('func("value)")')
+  assert.ok(result)
+  assert.is(result[0], 'func("value)")')
+  assert.is(result[1], 'func')
+  assert.is(result[2], '"value)"')
+})
+
+test('parseFunctionCall - handles unbalanced open paren in string', () => {
+  const result = parseFunctionCall("func('open (')")
+  assert.ok(result)
+  assert.is(result[0], "func('open (')")
+  assert.is(result[1], 'func')
+  assert.is(result[2], "'open ('")
+})
+
+test('parseFunctionCall - handles multiple unbalanced parens in string', () => {
+  const result = parseFunctionCall('func("))))")')
+  assert.ok(result)
+  assert.is(result[0], 'func("))))")')
+  assert.is(result[1], 'func')
+  assert.is(result[2], '"))))"')
+})
+
 // ==========================================
 // parseFunctionCall - edge cases
 // ==========================================

package/src/utils/strings/quoteAware.js

@@ -0,0 +1,141 @@
+/* Quote-aware string processing utilities */
+
+/**
+ * Find index of a character/pattern outside of quoted strings
+ * @param {string} str - String to search
+ * @param {string|function} matcher - Char to find, or function(str, idx) => matchLength|0
+ * @param {number} [startIdx=0] - Start index
+ * @returns {number} Index of match, or -1 if not found
+ */
+function findOutsideQuotes(str, matcher, startIdx = 0) {
+  let inQuote = false
+  let quoteChar = ''
+
+  for (let i = startIdx; i < str.length; i++) {
+    const ch = str[i]
+
+    if (!inQuote && (ch === '"' || ch === "'")) {
+      inQuote = true
+      quoteChar = ch
+    } else if (inQuote && ch === quoteChar) {
+      inQuote = false
+    } else if (!inQuote) {
+      if (typeof matcher === 'function') {
+        const matchLen = matcher(str, i)
+        if (matchLen > 0) return i
+      } else if (ch === matcher) {
+        return i
+      }
+    }
+  }
+
+  return -1
+}
+
+/**
+ * Replace a pattern only outside of quoted strings
+ * @param {string} str - String to process
+ * @param {string|RegExp} pattern - Pattern to match (if string, must be exact match)
+ * @param {string|function} replacement - Replacement string or function(match) => string
+ * @returns {string} Processed string
+ */
+function replaceOutsideQuotes(str, pattern, replacement) {
+  let result = ''
+  let inQuote = false
+  let quoteChar = ''
+  let i = 0
+
+  const patternStr = typeof pattern === 'string' ? pattern : null
+  const patternLen = patternStr ? patternStr.length : 0
+
+  while (i < str.length) {
+    const ch = str[i]
+
+    if (!inQuote && (ch === '"' || ch === "'")) {
+      inQuote = true
+      quoteChar = ch
+      result += ch
+      i++
+    } else if (inQuote && ch === quoteChar) {
+      inQuote = false
+      result += ch
+      i++
+    } else if (!inQuote && patternStr) {
+      // String pattern - check for exact match with word boundaries
+      if (str.substring(i, i + patternLen) === patternStr) {
+        const before = i === 0 || !/\w/.test(str[i - 1])
+        const after = i + patternLen >= str.length || !/\w/.test(str[i + patternLen])
+        if (before && after) {
+          const rep = typeof replacement === 'function' ? replacement(patternStr) : replacement
+          result += rep
+          i += patternLen
+          continue
+        }
+      }
+      result += ch
+      i++
+    } else {
+      result += ch
+      i++
+    }
+  }
+
+  return result
+}
+
+/**
+ * Check if an index is inside a quoted string
+ * @param {string} str - String to check
+ * @param {number} idx - Index to check
+ * @returns {boolean} True if index is inside quotes
+ */
+function isInsideQuotes(str, idx) {
+  let inQuote = false
+  let quoteChar = ''
+
+  for (let i = 0; i < str.length && i <= idx; i++) {
+    const ch = str[i]
+    if (!inQuote && (ch === '"' || ch === "'")) {
+      inQuote = true
+      quoteChar = ch
+    } else if (inQuote && ch === quoteChar) {
+      inQuote = false
+    }
+  }
+
+  return inQuote
+}
+
+/**
+ * Get ranges of quoted strings in a string
+ * @param {string} str - String to analyze
+ * @returns {Array<[number, number]>} Array of [start, end] ranges
+ */
+function getQuoteRanges(str) {
+  /** @type {Array<[number, number]>} */
+  const ranges = []
+  let inQuote = false
+  let quoteChar = ''
+  let quoteStart = 0
+
+  for (let i = 0; i < str.length; i++) {
+    const ch = str[i]
+    if (!inQuote && (ch === '"' || ch === "'")) {
+      inQuote = true
+      quoteChar = ch
+      quoteStart = i
+    } else if (inQuote && ch === quoteChar) {
+      ranges.push([quoteStart, i + 1])
+      inQuote = false
+    }
+  }
+
+  return ranges
+}
+
+module.exports = {
+  findOutsideQuotes,
+  replaceOutsideQuotes,
+  isInsideQuotes,
+  getQuoteRanges
+}

package/src/utils/strings/replaceAll.js

@@ -1,5 +1,8 @@
 const REPLACE_PATTERN = /([\/\,\!\\\^\$\{\}\[\]\(\)\.\*\+\?\|<>\-\&])/g
 
+// Cache for compiled regex patterns (perf: avoid recompilation)
+const regexCache = new Map()
+
 /**
  * Replace all occurrences of a string while handling regex special characters
  * @param {string} replaceThis - String to replace
@@ -9,7 +12,16 @@ const REPLACE_PATTERN = /([\/\,\!\\\^\$\{\}\[\]\(\)\.\*\+\?\|<>\-\&])/g
  */
 function replaceAll(replaceThis, withThis, inThis) {
   withThis = withThis.replace(/\$/g, '$$$$')
-  const pat = new RegExp(replaceThis.replace(REPLACE_PATTERN, '\\$&'), 'g')
+
+  // Check cache first
+  let pat = regexCache.get(replaceThis)
+  if (!pat) {
+    pat = new RegExp(replaceThis.replace(REPLACE_PATTERN, '\\$&'), 'g')
+    regexCache.set(replaceThis, pat)
+  }
+
+  // Reset lastIndex for global regex reuse
+  pat.lastIndex = 0
   return inThis.replace(pat, withThis)
 }