expensify-common 2.0.211 → 2.0.213

package/dist/esm/ExpensiMark.js

@@ -21,6 +21,9 @@ const URL_TLD_LIST = TLD_REGEX.toLowerCase().split('|');
 const URL_TLDS = new Set(URL_TLD_LIST);
 // Caps TLD scanning at the longest known TLD so long invalid URL-like text avoids expensive regex work.
 const MAX_URL_TLD_LENGTH = Math.max(...URL_TLD_LIST.map((tld) => tld.length));
+const URL_HOSTNAME_LABEL_AT_POSITION_REGEX = new RegExp(UrlPatterns.URL_HOSTNAME_LABEL_REGEX, 'iy');
+const URL_HOSTNAME_BOUNDARY_AT_POSITION_REGEX = new RegExp(UrlPatterns.URL_HOSTNAME_BOUNDARY_REGEX, 'iy');
+const URL_SUFFIX_AT_POSITION_REGEX = new RegExp(`(?:\\:${UrlPatterns.URL_PORT_REGEX}(?![0-9]))?${UrlPatterns.URL_PATH_REGEX}(?:${UrlPatterns.URL_PARAM_REGEX}|${UrlPatterns.URL_FRAGMENT_REGEX})*`, 'iy');
 const PROTECTED_TAG_NAMES = new Set(['a', 'code', 'pre', 'video']);
 const MARKDOWN_LINK_REGEX = new RegExp(`\\[((?:[^\\[\\]\\r\\n]*(?:\\[[^\\[\\]\\r\\n]*][^\\[\\]\\r\\n]*)*))]\\(${UrlPatterns.MARKDOWN_URL_REGEX}\\)(?![^<]*(<\\/pre>|<\\/code>))`, 'gi');
 const MARKDOWN_IMAGE_REGEX = new RegExp(`\\!(?:\\[([^\\][]*(?:\\[[^\\][]*][^\\][]*)*)])?\\(${UrlPatterns.MARKDOWN_URL_REGEX}\\)(?![^<]*(<\\/pre>|<\\/code>))`, 'gi');
@@ -160,58 +163,50 @@ function getProtocolAt(text, position) {
     return URL_PROTOCOLS.find((protocol) => text.slice(position, position + protocol.length).toLowerCase() === protocol);
 }
 /**
- * Returns whether one dot-separated hostname label is valid.
+ * Finds the valid prefix of a hostname label using the shared URL label pattern.
  *
  * @param text - Candidate URL text containing the label.
  * @param start - Index of the label's first character.
- * @param end - Index immediately after the label's last character.
+ * @returns The index after the valid label prefix, or undefined when the label starts with invalid syntax.
  */
-function isValidHostnameLabel(text, start, end) {
-    if (start >= end || !isAsciiAlphaNumeric(text[start]) || !isAsciiAlphaNumeric(text[end - 1])) {
-        return false;
-    }
-    for (let index = start + 1; index < end - 1; index++) {
-        if (!isAsciiAlphaNumeric(text[index]) && text[index] !== '-') {
-            return false;
-        }
+function findValidHostnameLabelEnd(text, start) {
+    URL_HOSTNAME_LABEL_AT_POSITION_REGEX.lastIndex = start;
+    const match = URL_HOSTNAME_LABEL_AT_POSITION_REGEX.exec(text);
+    return match === null ? undefined : URL_HOSTNAME_LABEL_AT_POSITION_REGEX.lastIndex;
+}
+/**
+ * Finds the first character after a URL's hostname.
+ *
+ * @param text - Text containing the URL candidate.
+ * @param hostnameStart - Index of the hostname's first character.
+ * @returns The index immediately after the hostname.
+ */
+function findHostnameEnd(text, hostnameStart) {
+    let hostnameEnd = hostnameStart;
+    while (hostnameEnd < text.length && isHostnameCharacter(text[hostnameEnd])) {
+        hostnameEnd++;
     }
-    return true;
+    return hostnameEnd;
 }
 /**
- * Finds the first character of a valid hostname before the dot that starts its top-level domain.
+ * Finds where a separate hostname can start after punctuation inside the current hostname run.
  *
- * @param text - Candidate URL text containing the hostname.
- * @param dotPosition - Index of the dot immediately before the top-level domain.
- * @returns The hostname's first-character index, or undefined when no valid hostname precedes the dot.
+ * @param text - Text containing the hostname run.
+ * @param start - First index to check.
+ * @param end - Index immediately after the hostname run.
+ * @returns The next hostname start allowed by the URL pattern, or `end` when none exists.
  */
-function findHostnameStart(text, dotPosition) {
-    let hostnameStart = dotPosition;
-    let labelEnd = dotPosition;
-    while (labelEnd > 0) {
-        let rawLabelStart = labelEnd - 1;
-        while (rawLabelStart >= 0 && text[rawLabelStart] !== '.' && isHostnameCharacter(text[rawLabelStart])) {
-            rawLabelStart--;
-        }
-        rawLabelStart++;
-        let labelStart = rawLabelStart;
-        while (labelStart < labelEnd && text[labelStart] === '-') {
-            labelStart++;
-        }
-        if (!isValidHostnameLabel(text, labelStart, labelEnd)) {
-            break;
-        }
-        hostnameStart = labelStart;
-        // A leading hyphen ends the hostname, but the existing URL regex can still match the valid suffix after it.
-        if (labelStart !== rawLabelStart) {
-            break;
+function findNextHostnameStart(text, start, end) {
+    for (let index = start; index < end; index++) {
+        if (text[index - 1] !== '.' && text[index - 1] !== '-') {
+            continue;
         }
-        const separatorPosition = labelStart - 1;
-        if (separatorPosition < 0 || text[separatorPosition] !== '.') {
-            break;
+        URL_HOSTNAME_BOUNDARY_AT_POSITION_REGEX.lastIndex = index;
+        if (URL_HOSTNAME_BOUNDARY_AT_POSITION_REGEX.test(text)) {
+            return index;
         }
-        labelEnd = separatorPosition;
     }
-    return hostnameStart === dotPosition ? undefined : hostnameStart;
+    return end;
 }
 /**
  * Finds the end of a known top-level domain after `dotPosition`.
@@ -235,17 +230,78 @@ function findKnownTldEnd(text, dotPosition) {
     }
     return undefined;
 }
-/** Expands example.com to include nearby @, *, _, or ~ in any order, plus its path, until whitespace or HTML. */
-function extendUrlCandidateBoundaries(text, start, end) {
+/**
+ * Validates a hostname and records a linkable prefix before a later malformed label.
+ * Preserves known-TLD prefixes before oversized continuations without recovering text inside an invalid leading label.
+ *
+ * @param text - Text containing the URL candidate.
+ * @param hostnameStart - Index of the hostname's first character.
+ * @param hostnameEnd - Index immediately after the hostname.
+ * @param hasProtocol - Whether the URL allows hostnames without a known TLD, including single-label hosts.
+ * @returns The hostname validity and any prefix that can be linked before a malformed or oversized continuation.
+ */
+function analyzeHostname(text, hostnameStart, hostnameEnd, hasProtocol) {
+    let hostnameContentEnd = hostnameEnd;
+    while (hostnameContentEnd > hostnameStart && (text[hostnameContentEnd - 1] === '.' || text[hostnameContentEnd - 1] === '-')) {
+        hostnameContentEnd--;
+    }
+    if (hostnameContentEnd === hostnameStart) {
+        return { isValid: false };
+    }
+    let labelStart = hostnameStart;
+    let validHostnamePrefixEnd;
+    let validKnownTldPrefixEnd;
+    for (let index = hostnameStart; index <= hostnameContentEnd; index++) {
+        if (index !== hostnameContentEnd && text[index] !== '.') {
+            continue;
+        }
+        const validLabelEnd = findValidHostnameLabelEnd(text, labelStart);
+        if (validLabelEnd === undefined) {
+            return { isValid: false, validHostnamePrefixEnd };
+        }
+        // Measure the valid label prefix before any trailing hyphens that end it.
+        let labelContentEnd = index;
+        while (labelContentEnd > labelStart && text[labelContentEnd - 1] === '-') {
+            labelContentEnd--;
+        }
+        if (labelContentEnd - labelStart > Constants.MAX_URL_HOSTNAME_LABEL_LENGTH || labelContentEnd - hostnameStart > Constants.MAX_URL_HOSTNAME_LENGTH) {
+            return { isValid: false, validHostnamePrefixEnd: validKnownTldPrefixEnd };
+        }
+        // Protocol URLs can end at any valid label; bare URLs still need a known TLD.
+        if (hasProtocol) {
+            validHostnamePrefixEnd = validLabelEnd;
+        }
+        if (validLabelEnd !== index) {
+            return { isValid: false, validHostnamePrefixEnd };
+        }
+        if (index !== hostnameContentEnd) {
+            const tldEnd = findKnownTldEnd(text, index);
+            if (tldEnd !== undefined && tldEnd <= hostnameContentEnd && tldEnd - hostnameStart <= Constants.MAX_URL_HOSTNAME_LENGTH) {
+                validKnownTldPrefixEnd = tldEnd;
+                if (!hasProtocol) {
+                    validHostnamePrefixEnd = tldEnd;
+                }
+            }
+        }
+        labelStart = index + 1;
+    }
+    return { isValid: true, validHostnamePrefixEnd };
+}
+/** Finds the candidate start, including any adjacent @, *, _, or ~ before the URL. */
+function findUrlCandidateStart(text, start) {
     let candidateStart = start;
     while (candidateStart > 0 && URL_CANDIDATE_PREFIX_CHARACTERS.includes(text[candidateStart - 1])) {
         candidateStart--;
     }
+    return candidateStart;
+}
+/** Expands example.com to include nearby @, *, _, or ~ in any order, plus its path, until whitespace or HTML. */
+function extendUrlCandidateBoundaries(text, start, end) {
     let candidateEnd = end;
     while (candidateEnd < text.length && !isUrlBoundarySpace(text[candidateEnd]) && text[candidateEnd] !== '<') {
         candidateEnd++;
     }
-    return { start: candidateStart, end: candidateEnd };
+    return { start: findUrlCandidateStart(text, start), end: candidateEnd };
 }
 /**
  * Checks whether lowercase `expected` occurs in `text` at `position`, ignoring letter case in `text`.
@@ -257,6 +313,167 @@ function extendUrlCandidateBoundaries(text, start, end) {
 function startsWithIgnoreCase(text, expected, position) {
     return text.slice(position, position + expected.length).toLowerCase() === expected;
 }
+/**
+ * Finds the first unmatched closing parenthesis, which ends a URL rather than belonging to its path.
+ *
+ * @param text - Text containing the URL or its suffix.
+ * @param start - First index to inspect, inclusive.
+ * @param end - Last index to inspect, exclusive.
+ * @returns The unmatched parenthesis index, or end when all closing parentheses are paired.
+ */
+function findUrlEndBeforeUnmatchedParenthesis(text, start, end) {
+    let unmatchedOpenParentheses = 0;
+    for (let index = start; index < end; index++) {
+        if (text[index] === '(') {
+            unmatchedOpenParentheses++;
+        }
+        else if (text[index] === ')') {
+            if (unmatchedOpenParentheses === 0) {
+                return index;
+            }
+            unmatchedOpenParentheses--;
+        }
+    }
+    return end;
+}
+/**
+ * Finds where a URL ends by matching its optional port, path, query, and fragment after the hostname.
+ *
+ * @param text - Text containing the URL candidate.
+ * @param hostnameEnd - Index immediately after the hostname.
+ * @returns The first index after the URL recognized by ExpensiMark.
+ */
+function findUrlEnd(text, hostnameEnd) {
+    var _a;
+    URL_SUFFIX_AT_POSITION_REGEX.lastIndex = hostnameEnd;
+    const match = URL_SUFFIX_AT_POSITION_REGEX.exec(text);
+    return findUrlEndBeforeUnmatchedParenthesis(text, hostnameEnd, hostnameEnd + ((_a = match === null || match === void 0 ? void 0 : match[0].length) !== null && _a !== void 0 ? _a : 0));
+}
+/**
+ * Analyzes a URL candidate and protects invalid ranges while allowing separate domains after punctuation.
+ *
+ * @param text - Text containing the URL candidate.
+ * @param urlStart - Index where the URL starts, excluding Markdown punctuation.
+ * @param hostnameStart - Index where the hostname starts.
+ * @returns The hostname end and any invalid ranges, plus the end of the connected URL text.
+ */
+function analyzeUrlRange(text, urlStart, hostnameStart) {
+    var _a;
+    const hostnameEnd = findHostnameEnd(text, hostnameStart);
+    const hostnameAnalysis = analyzeHostname(text, hostnameStart, hostnameEnd, hostnameStart !== urlStart);
+    if (hostnameAnalysis.isValid) {
+        return { hostnameEnd };
+    }
+    let invalidRangeEnd = findUrlEnd(text, hostnameEnd);
+    if (text[hostnameEnd] === ':') {
+        // The broad hostname scan can include the letters of the next protocol, as in example.com..http://valid.org.
+        for (const protocol of URL_PROTOCOLS) {
+            const protocolStart = hostnameEnd - protocol.indexOf(':');
+            if (protocolStart >= hostnameStart && startsWithIgnoreCase(text, protocol, protocolStart)) {
+                invalidRangeEnd = protocolStart;
+                break;
+            }
+        }
+    }
+    const invalidRanges = [];
+    let invalidRangeStart = (_a = hostnameAnalysis.validHostnamePrefixEnd) !== null && _a !== void 0 ? _a : urlStart;
+    // Use the URL pattern's boundary rule to check each separate hostname after punctuation once.
+    let index = findNextHostnameStart(text, hostnameStart + 1, hostnameEnd);
+    while (index < hostnameEnd) {
+        const followingHostnameStart = index;
+        index = findNextHostnameStart(text, index + 1, hostnameEnd);
+        const followingHostnameAnalysis = analyzeHostname(text, followingHostnameStart, index, false);
+        if (followingHostnameAnalysis.validHostnamePrefixEnd === undefined) {
+            continue;
+        }
+        invalidRanges.push({ start: invalidRangeStart, end: followingHostnameStart });
+        // Only a valid final hostname owns the path/query; malformed continuations keep their nested domains plain.
+        invalidRangeStart = followingHostnameAnalysis.validHostnamePrefixEnd;
+        if (followingHostnameAnalysis.isValid && index === hostnameEnd) {
+            invalidRangeStart = invalidRangeEnd;
+        }
+    }
+    if (invalidRangeStart < invalidRangeEnd) {
+        invalidRanges.push({ start: invalidRangeStart, end: invalidRangeEnd });
+    }
+    return { hostnameEnd, invalidRanges, urlEnd: invalidRangeEnd };
+}
+/**
+ * Finds the first hostname character before a known top-level domain, including invalid labels.
+ *
+ * @param text - Text containing the bare hostname.
+ * @param dotPosition - Index of the dot immediately before the known top-level domain.
+ * @returns The start of the hostname run, including leading dots and hyphens.
+ */
+function findRawHostnameStart(text, dotPosition) {
+    let hostnameStart = dotPosition;
+    while (hostnameStart > 0 && isHostnameCharacter(text[hostnameStart - 1])) {
+        hostnameStart--;
+    }
+    return hostnameStart;
+}
+/**
+ * Finds URL ranges whose hostname is malformed or exceeds the supported DNS length limits.
+ * These ranges keep both URL parsing paths from matching domains inside invalid hostname labels or connected URL suffixes.
+ *
+ * @param text - Text containing possible protocol and bare URLs.
+ * @returns Connected invalid URL ranges that must remain plain text.
+ */
+function findInvalidUrlRanges(text) {
+    const ranges = [];
+    let index = 0;
+    while (index < text.length) {
+        const matchedProtocol = getProtocolAt(text, index);
+        let analysis;
+        if (matchedProtocol) {
+            analysis = analyzeUrlRange(text, index, index + matchedProtocol.length);
+        }
+        else {
+            if (text[index] !== '.') {
+                index++;
+                continue;
+            }
+            const tldEnd = findKnownTldEnd(text, index);
+            if (tldEnd === undefined) {
+                index++;
+                continue;
+            }
+            const hostnameStart = findRawHostnameStart(text, index);
+            analysis = analyzeUrlRange(text, hostnameStart, hostnameStart);
+        }
+        if (analysis.invalidRanges) {
+            for (const range of analysis.invalidRanges) {
+                ranges.push(range);
+            }
+            index = analysis.urlEnd;
+        }
+        else {
+            // Skip the valid URL's suffix so domains in its path, query, or fragment are not scanned again.
+            index = findUrlEnd(text, analysis.hostnameEnd);
+        }
+    }
+    return ranges;
+}
+/**
+ * Creates the text searched by the URL regex. It replaces rejected URL ranges with spaces
+ * so the regex can find other URLs. The result keeps the original length because the parser
+ * uses the match indexes to build output from the original text.
+ *
+ * @param text - Original text being parsed for URLs.
+ * @param invalidRanges - Ordered, non-overlapping ranges rejected by URL validation.
+ * @returns A copy of `text` with those ranges replaced by spaces.
+ */
+function maskInvalidUrlRanges(text, invalidRanges) {
+    const parts = [];
+    let start = 0;
+    for (const range of invalidRanges) {
+        // Output still comes from the original text; spaces only stop regexes from crossing invalid ranges.
+        parts.push(text.slice(start, range.start), ' '.repeat(range.end - range.start));
+        start = range.end;
+    }
+    parts.push(text.slice(start));
+    return parts.join('');
+}
 /**
  * Removes candidates that the original full-text URL regex would reject because of later HTML.
  * It scans right to left so each candidate can use the nearest later HTML boundary without copying a long suffix.
@@ -310,7 +527,7 @@ function filterUrlCandidatesBlockedByFollowingHtml(text, candidates) {
     }
     return validCandidates.reverse();
 }
-/** Finds possible URL ranges, skips URL-looking text inside protected tags, and leaves final validity to the existing regex. */
+/** Finds possible URL ranges, skips URL-looking text inside protected tags, rejects malformed or oversized hostnames, and leaves remaining validation to the existing regex. */
 function findUrlCandidates(text) {
     const candidates = [];
     const protectedTags = [];
@@ -331,25 +548,43 @@ function findUrlCandidates(text) {
             continue;
         }
         const matchedProtocol = getProtocolAt(text, index);
+        let urlStart = index;
+        let candidateEnd;
         if (matchedProtocol) {
-            const candidate = extendUrlCandidateBoundaries(text, index, index + matchedProtocol.length);
-            candidates.push(candidate);
-            index = candidate.end;
-            continue;
+            candidateEnd = index + matchedProtocol.length;
         }
-        if (text[index] !== '.') {
-            index++;
-            continue;
+        else {
+            if (text[index] !== '.') {
+                index++;
+                continue;
+            }
+            const tldEnd = findKnownTldEnd(text, index);
+            if (tldEnd === undefined) {
+                index++;
+                continue;
+            }
+            urlStart = findRawHostnameStart(text, index);
+            candidateEnd = tldEnd;
         }
-        const tldEnd = findKnownTldEnd(text, index);
-        const hostnameStart = tldEnd === undefined ? undefined : findHostnameStart(text, index);
-        if (tldEnd === undefined || hostnameStart === undefined) {
-            index++;
+        const analysis = analyzeUrlRange(text, urlStart, matchedProtocol ? candidateEnd : urlStart);
+        if (analysis.invalidRanges) {
+            // Match valid portions separately so long rejected gaps never reach the full URL regex.
+            let candidateStart = urlStart;
+            for (const range of analysis.invalidRanges) {
+                if (candidateStart < range.start) {
+                    candidates.push({ start: findUrlCandidateStart(text, candidateStart), end: range.start });
+                }
+                candidateStart = range.end;
+            }
+            if (candidateStart < analysis.urlEnd) {
+                candidates.push({ start: findUrlCandidateStart(text, candidateStart), end: analysis.urlEnd });
+            }
+            index = analysis.urlEnd;
             continue;
         }
-        const candidate = extendUrlCandidateBoundaries(text, hostnameStart, tldEnd);
-        candidates.push(candidate);
-        index = candidate.end;
+        const broadCandidate = extendUrlCandidateBoundaries(text, urlStart, candidateEnd);
+        candidates.push(broadCandidate);
+        index = broadCandidate.end;
     }
     return filterUrlCandidatesBlockedByFollowingHtml(text, candidates);
 }
@@ -906,7 +1141,7 @@ class ExpensiMark {
                 process: (textToProcess, replacement, _shouldKeepRawInput, shouldEscapeText) => {
                     const regex = new RegExp(`(?![^<]*>|[^<>]*<\\/(?!h1>))([_*~]*?)${UrlPatterns.MARKDOWN_URL_REGEX}\\1(?!((?:(?!<a).)+)?<\\/a>|[^<]*(<\\/pre>|<\\/code>))`, 'gi');
                     // Raw HTML depends on complete-text lookaheads. Text without user-provided HTML can safely use the faster candidate scanner.
-                    return this.modifyTextForUrlLinks(regex, textToProcess, replacement, canUseCandidateScanning(textToProcess, shouldEscapeText));
+                    return this.modifyTextForUrlLinks(regex, textToProcess, replacement, canUseCandidateScanning(textToProcess, shouldEscapeText), true);
                 },
                 replacement: (_extras, _match, g1, g2) => {
                     const href = Str.sanitizeURL(g2);
@@ -1474,9 +1709,16 @@ class ExpensiMark {
         return restoreVictoryChartTags(replacedText, victoryChartTags);
     }
     /**
-     * Checks matched URLs for validity and replace valid links with html elements
+     * Replaces valid URL matches and optionally narrows parsing to URL candidates.
+     *
+     * @param regex - The URL pattern used for the final match.
+     * @param textToCheck - The text containing possible URLs.
+     * @param replacement - The replacement applied to each accepted URL.
+     * @param shouldScanForUrls - Whether to scan URL candidates before running the regex.
+     * @param shouldRejectPartialHostnameMatches - Whether to mask invalid URL ranges before matching.
+     * @param followingText - Text after the candidate that the regex needs to distinguish URLs from emails.
      */
-    modifyTextForUrlLinks(regex, textToCheck, replacement, shouldScanForUrls = false) {
+    modifyTextForUrlLinks(regex, textToCheck, replacement, shouldScanForUrls = false, shouldRejectPartialHostnameMatches = false, followingText = '') {
         if (shouldScanForUrls) {
             const candidates = findUrlCandidates(textToCheck);
             if (candidates.length === 0) {
@@ -1487,36 +1729,42 @@ class ExpensiMark {
             let outputStart = 0;
             for (const { start, end } of candidates) {
                 const candidate = textToCheck.slice(start, end);
+                // A shortened candidate can end at an email's local part, so keep its domain visible to the regex.
+                const contextEnd = textToCheck[end] === '@' ? findHostnameEnd(textToCheck, end + 1) : end;
                 candidateRegex.lastIndex = 0;
                 output.push(textToCheck.slice(outputStart, start));
-                output.push(this.modifyTextForUrlLinks(candidateRegex, candidate, replacement));
+                output.push(this.modifyTextForUrlLinks(candidateRegex, candidate, replacement, false, shouldRejectPartialHostnameMatches, textToCheck.slice(end, contextEnd)));
                 outputStart = end;
             }
             output.push(textToCheck.slice(outputStart));
             return output.join('');
         }
-        let match = regex.exec(textToCheck);
+        const matchingRegex = regex;
+        const textWithContext = textToCheck + followingText;
+        const invalidUrlRanges = shouldRejectPartialHostnameMatches ? findInvalidUrlRanges(textWithContext) : [];
+        const maskedText = invalidUrlRanges.length > 0 ? maskInvalidUrlRanges(textWithContext, invalidUrlRanges) : textWithContext;
+        const textToMatch = maskedText.slice(0, textToCheck.length);
+        const contextRegex = followingText ? new RegExp(regex.source, regex.flags.replace('g', 'y')) : undefined;
+        let match = matchingRegex.exec(textToMatch);
         let replacedText = '';
         let startIndex = 0;
         while (match !== null) {
-            // We end the link at the last closing parenthesis that matches an opening parenthesis because unmatched closing parentheses are unlikely to be in the url
-            // and can be part of markdown for example
-            let unmatchedOpenParentheses = 0;
-            let url = match[2];
-            for (let i = 0; i < url.length; i++) {
-                if (url[i] === '(') {
-                    unmatchedOpenParentheses++;
-                }
-                else if (url[i] === ')') {
-                    // Unmatched closing parenthesis
-                    if (unmatchedOpenParentheses <= 0) {
-                        const numberOfCharsToRemove = url.length - i;
-                        match[0] = match[0].substr(0, match[0].length - numberOfCharsToRemove);
-                        url = url.substr(0, url.length - numberOfCharsToRemove);
-                        break;
-                    }
-                    unmatchedOpenParentheses--;
+            if (contextRegex && match.index + match[0].length === textToCheck.length) {
+                // Recheck only this match with its following text, without searching outside the candidate.
+                contextRegex.lastIndex = match.index;
+                const contextMatch = contextRegex.exec(maskedText);
+                if (contextMatch === null) {
+                    match = matchingRegex.exec(textToMatch);
+                    continue;
                 }
+                match = contextMatch;
+                matchingRegex.lastIndex = contextRegex.lastIndex;
+            }
+            let url = match[2];
+            const urlEnd = findUrlEndBeforeUnmatchedParenthesis(url, 0, url.length);
+            if (urlEnd < url.length) {
+                match[0] = match[0].slice(0, match[0].length - (url.length - urlEnd));
+                url = url.slice(0, urlEnd);
             }
             // Because we are removing ) parenthesis, some special characters that shouldn't be in the href are in the href
             // For example google.com/toto.) is accepted by the regular expression above and we remove the ) parenthesis, so the link becomes google.com/toto. which is not a valid link
@@ -1579,7 +1827,7 @@ class ExpensiMark {
             }
             startIndex = match.index + match[0].length;
             // Now we move to the next match that the js regex found in the text
-            match = regex.exec(textToCheck);
+            match = matchingRegex.exec(textToMatch);
         }
         if (startIndex < textToCheck.length) {
             replacedText = replacedText.concat(textToCheck.substr(startIndex));

package/dist/esm/Url.d.ts

@@ -1,3 +1,5 @@
+export const URL_HOSTNAME_BOUNDARY_REGEX: "(?=[a-z0-9])(?<![a-z0-9]-*)(?<![a-z0-9]\\.)";
+export const URL_HOSTNAME_LABEL_REGEX: "[a-z0-9](?=(?<label>[-a-z0-9]{0,61}[a-z0-9])?)\\k<label>";
 export const URL_WEBSITE_REGEX: string;
 export const URL_PATH_REGEX: string;
 export const URL_PARAM_REGEX: string;
@@ -5,6 +7,7 @@ export const URL_FRAGMENT_REGEX: string;
 export const URL_REGEX: string;
 export const URL_REGEX_WITH_REQUIRED_PROTOCOL: string;
 export const URL_PROTOCOL_REGEX: "((ht|f)tps?:\\/\\/)";
+export const URL_PORT_REGEX: "([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])";
 export const LOOSE_URL_REGEX: string;
-export const LOOSE_URL_WEBSITE_REGEX: "((ht|f)tps?:\\/\\/)((?!-)[-a-z0-9]+(?<!-)(?:\\.(?!-)[-a-z0-9]+(?<!-))*)(?:\\:([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])|\\b|(?=_))";
+export const LOOSE_URL_WEBSITE_REGEX: "((ht|f)tps?:\\/\\/)(?!(?:(?!\\.[.-]|-\\.)[-a-z0-9.]){253}(?:(?!\\.[.-]|-\\.)[-a-z0-9.])*[a-z0-9](?:\\b|(?=_)))((?!-)[-a-z0-9]{1,63}(?<!-)(?:\\.(?!-)[-a-z0-9]{1,63}(?<!-))*)(?:\\:([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])|\\b|(?=_))";
 export const MARKDOWN_URL_REGEX: string;

package/dist/esm/Url.js

@@ -1,15 +1,26 @@
 import TLD_REGEX from './tlds';
-const ALLOWED_PORTS = '([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])';
+import { MAX_URL_HOSTNAME_LABEL_LENGTH, MAX_URL_HOSTNAME_LENGTH } from './CONST';
+const URL_PORT_REGEX = '([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])';
 const URL_PROTOCOL_REGEX = '((ht|f)tps?:\\/\\/)';
-const URL_WEBSITE_REGEX = `${URL_PROTOCOL_REGEX}?((?:www\\.)?[a-z0-9](?=(?<label>[-a-z0-9]*[a-z0-9])?)\\k<label>\\.)+(?:${TLD_REGEX})\
-(?:\\:${ALLOWED_PORTS}|\\b|(?=_))(?!@(?:[a-z\\d-]+\\.)+[a-z]{2,})`;
+const MAX_URL_HOSTNAME_LABEL_BODY_LENGTH = MAX_URL_HOSTNAME_LABEL_LENGTH - 2;
+const URL_HOSTNAME_LABEL_REGEX = `[a-z0-9](?=(?<label>[-a-z0-9]{0,${MAX_URL_HOSTNAME_LABEL_BODY_LENGTH}}[a-z0-9])?)\\k<label>`;
+const LOOSE_URL_HOSTNAME_LABEL_REGEX = `(?!-)[-a-z0-9]{1,${MAX_URL_HOSTNAME_LABEL_LENGTH}}(?<!-)`;
+// Dots and leading hyphens can separate text from a domain; keep letters and attached label hyphens together.
+// Check the first character before looking back so long punctuation runs do not repeatedly scan backward.
+const URL_HOSTNAME_BOUNDARY_REGEX = '(?=[a-z0-9])(?<![a-z0-9]-*)(?<![a-z0-9]\\.)';
+// Repeated dots and leading or trailing label hyphens end the hostname before malformed continuation text.
+const URL_HOSTNAME_LENGTH_CHARACTER_REGEX = '(?:(?!\\.[.-]|-\\.)[-a-z0-9.])';
+// Reject oversized hostnames without counting malformed continuations, ports, paths, queries, fragments, or trailing punctuation.
+const URL_HOSTNAME_MAX_LENGTH_ASSERTION = `(?!${URL_HOSTNAME_LENGTH_CHARACTER_REGEX}{${MAX_URL_HOSTNAME_LENGTH}}${URL_HOSTNAME_LENGTH_CHARACTER_REGEX}*[a-z0-9](?:\\b|(?=_)))`;
+const URL_WEBSITE_REGEX = `${URL_PROTOCOL_REGEX}?${URL_HOSTNAME_BOUNDARY_REGEX}${URL_HOSTNAME_MAX_LENGTH_ASSERTION}((?:www\\.)?${URL_HOSTNAME_LABEL_REGEX}\\.)+(?:${TLD_REGEX})\
+(?:\\:${URL_PORT_REGEX}|\\b|(?=_))(?!@(?:[a-z\\d-]+\\.)+[a-z]{2,})`;
 const addEscapedChar = (reg) => `(?:${reg}|&(?:amp|#x27);)`;
 const URL_PATH_REGEX = `(?:${addEscapedChar('[.,=(+$!*]')}?\\/${addEscapedChar('[-\\w$@.+!*:(),=%~]')}*${addEscapedChar('[-\\w~@:%)]')}|\\/)*`;
 const URL_PARAM_REGEX = `(?:\\?${addEscapedChar('[-\\w$@.+!*()\\/,=%{}:;\\[\\]\\|_|~]')}+)?`;
 const URL_FRAGMENT_REGEX = `(?:#${addEscapedChar('[-\\w$@.+!*()[\\],=%;\\/:~]')}*)?`;
 const URL_REGEX = `((${URL_WEBSITE_REGEX})${URL_PATH_REGEX}(?:${URL_PARAM_REGEX}|${URL_FRAGMENT_REGEX})*)`;
 const URL_REGEX_WITH_REQUIRED_PROTOCOL = URL_REGEX.replace(`${URL_PROTOCOL_REGEX}?`, URL_PROTOCOL_REGEX);
-const LOOSE_URL_WEBSITE_REGEX = `${URL_PROTOCOL_REGEX}((?!-)[-a-z0-9]+(?<!-)(?:\\.(?!-)[-a-z0-9]+(?<!-))*)(?:\\:${ALLOWED_PORTS}|\\b|(?=_))`;
+const LOOSE_URL_WEBSITE_REGEX = `${URL_PROTOCOL_REGEX}${URL_HOSTNAME_MAX_LENGTH_ASSERTION}(${LOOSE_URL_HOSTNAME_LABEL_REGEX}(?:\\.${LOOSE_URL_HOSTNAME_LABEL_REGEX})*)(?:\\:${URL_PORT_REGEX}|\\b|(?=_))`;
 const LOOSE_URL_REGEX = `((${LOOSE_URL_WEBSITE_REGEX})${URL_PATH_REGEX}(?:${URL_PARAM_REGEX}|${URL_FRAGMENT_REGEX})*)`;
 const MARKDOWN_URL_REGEX = `(${LOOSE_URL_REGEX}|${URL_REGEX})`;
-export { URL_WEBSITE_REGEX, URL_PATH_REGEX, URL_PARAM_REGEX, URL_FRAGMENT_REGEX, URL_REGEX, URL_REGEX_WITH_REQUIRED_PROTOCOL, URL_PROTOCOL_REGEX, LOOSE_URL_REGEX, LOOSE_URL_WEBSITE_REGEX, MARKDOWN_URL_REGEX, };
+export { URL_HOSTNAME_BOUNDARY_REGEX, URL_HOSTNAME_LABEL_REGEX, URL_WEBSITE_REGEX, URL_PATH_REGEX, URL_PARAM_REGEX, URL_FRAGMENT_REGEX, URL_REGEX, URL_REGEX_WITH_REQUIRED_PROTOCOL, URL_PROTOCOL_REGEX, URL_PORT_REGEX, LOOSE_URL_REGEX, LOOSE_URL_WEBSITE_REGEX, MARKDOWN_URL_REGEX, };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expensify-common",
-  "version": "2.0.211",
+  "version": "2.0.213",
   "author": "Expensify, Inc.",
   "description": "Expensify libraries and components shared across different repos",
   "homepage": "https://expensify.com",
@@ -260,7 +260,7 @@
   "devEngines": {
     "runtime": {
       "name": "node",
-      "version": ">=24.19.0",
+      "version": ">=24.22.1",
       "onFail": "error"
     },
     "packageManager": {