n8n-nodes-redactor 4.3.0 → 5.1.0

package/dist/nodes/Redactor/Redactor.node.js

@@ -1040,7 +1040,7 @@ class Redactor {
                 reservedTokens: (0, engine_1.collectTokenLike)(items.map((it) => it.json)),
                 keyOrigins: new WeakMap(),
                 inputText: (0, engine_1.collectInputText)(items.map((it) => it.json)),
-                lockedSpans: new Map(),
+                lockedSpans: new WeakMap(),
             };
             const allHits = [];
             const returnData = [];

package/dist/nodes/Redactor/engine.js

@@ -57,7 +57,7 @@ function isAllowListed(value, allowList) {
                 case 'contains':
                     return value.includes(entry.value);
                 case 'regex':
-                    if (!isSafeRegex(entry.value))
+                    if (!isSafeRegex(entry.value) || value.length > USER_REGEX_MAX_INPUT)
                         return false;
                     return new RegExp(entry.value, 'i').test(value);
                 default:
@@ -70,7 +70,11 @@ function isAllowListed(value, allowList) {
     });
 }
 function generateToken(label, index) {
-    return `[${label}_${index}]`;
+    const safe = label.toUpperCase().replace(/[^A-Z0-9_]/g, '_');
+    return `[${/^[A-Z]/.test(safe) ? safe : `X${safe}`}_${index}]`;
+}
+function setOwn(obj, key, value) {
+    Object.defineProperty(obj, key, { value, enumerable: true, writable: true, configurable: true });
 }
 const TOKEN_RE = /^\[[A-Z][A-Z0-9_]*_\d+\]$/;
 function maskValue(value, label) {
@@ -414,7 +418,7 @@ function getSemanticLabel(fieldKey, siblingKeys) {
     return null;
 }
 function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
-    var _a, _b;
+    var _a;
     const semantic = getSemanticLabel(path, siblingKeys);
     if (!semantic || !semantic.label || raw.trim().length === 0)
         return null;
@@ -424,8 +428,7 @@ function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, displ
     if (semConf < ((_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0))
         return null;
     const replacement = applyRedaction(raw, { label: semantic.label, category: semantic.category }, ctx, vault, sessionId);
-    if (replacement)
-        (_b = ctx.lockedSpans) === null || _b === void 0 ? void 0 : _b.set(lockKey(itemIndex, display), [[0, replacement.length]]);
+    ctx.lastLocked = replacement ? [[0, replacement.length]] : undefined;
     hits.push({
         token: replacement, original: '***',
         patternName: `semantic_${semantic.label}`,
@@ -444,14 +447,13 @@ function numericMapping(out, text, ctx, vault, sessionId) {
         existing.numeric = true;
         return out;
     }
-    const token = existing ? freshToken('NUMBER', vault, sessionId, ctx.reservedTokens) : out;
+    const token = freshToken('NUMBER', vault, sessionId, ctx.reservedTokens);
     vault.addEntry(sessionId, {
         token, original: text, patternLabel: 'NUMBER', category: 'other', createdAt: new Date().toISOString(), numeric: true,
     });
     return token;
 }
 function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
-    var _a;
     const text = String(value);
     const numCtx = { ...ctx, dedup: false, numeric: true };
     let out = null;
@@ -461,10 +463,12 @@ function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, displ
         out = redactText(text, numCtx, vault, sessionId, hits, itemIndex, display);
     if (out === null || out === text)
         return value;
-    if (ctx.mode !== 'token' && ctx.mode !== 'pseudonymize')
+    if (ctx.mode !== 'token' && ctx.mode !== 'pseudonymize') {
+        ctx.lastLocked = numCtx.lastLocked;
         return out;
+    }
     const mapped = numericMapping(out, text, ctx, vault, sessionId);
-    (_a = ctx.lockedSpans) === null || _a === void 0 ? void 0 : _a.set(lockKey(itemIndex, display), [[0, mapped.length]]);
+    ctx.lastLocked = [[0, mapped.length]];
     return mapped;
 }
 function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits) {
@@ -472,7 +476,7 @@ function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, key
     const out = redactText(key, ctx, vault, sessionId, keyHits, itemIndex, '');
     if (out === key)
         return key;
-    const clashes = (k) => k === '' || k in taken || sourceKeys.has(k);
+    const clashes = (k) => k === '' || Object.prototype.hasOwnProperty.call(taken, k) || sourceKeys.has(k);
     if (!clashes(out))
         return out;
     if (ctx.mode === 'token' || ctx.mode === 'pseudonymize') {
@@ -502,7 +506,7 @@ function redactObject(value, ctx, vault, sessionId, hits, itemIndex, path, displ
         const childDisplay = display ? `${display}.${outKey}` : outKey;
         for (const h of keyHits)
             hits.push({ ...h, field: childDisplay });
-        obj[outKey] = redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys, childDisplay);
+        setOwn(obj, outKey, lockChild(ctx, obj, outKey, () => redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys, childDisplay)));
     }
     (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.set(obj, origins);
     return obj;
@@ -525,7 +529,11 @@ function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath
         return redactNumber(value, ctx, vault, sessionId, hits, itemIndex, currentPath, displayPath, siblingKeys);
     }
     if (Array.isArray(value)) {
-        return value.map((v, i) => redactValue(v, ctx, vault, sessionId, hits, itemIndex, `${currentPath}[${i}]`, undefined, `${displayPath}[${i}]`));
+        const out = [];
+        value.forEach((v, i) => {
+            out.push(lockChild(ctx, out, String(i), () => redactValue(v, ctx, vault, sessionId, hits, itemIndex, `${currentPath}[${i}]`, undefined, `${displayPath}[${i}]`)));
+        });
+        return out;
     }
     if (value !== null && typeof value === 'object') {
         return redactObject(value, ctx, vault, sessionId, hits, itemIndex, currentPath, displayPath);
@@ -533,49 +541,40 @@ function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath
     return value;
 }
 const escapeRe = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-const USER_REGEX_WINDOW = 2048;
-function windows(seg, size) {
-    const out = [];
-    let at = 0;
-    while (seg.text.length - at > size) {
-        const cut = seg.text.lastIndexOf(' ', at + size);
-        const end = cut > at + size / 2 ? cut + 1 : at + size;
-        out.push({ text: seg.text.slice(at, end), locked: false, src: seg.src + at });
-        at = end;
-    }
-    out.push({ text: seg.text.slice(at), locked: false, src: seg.src + at });
-    return out;
+const USER_REGEX_MAX_INPUT = 20000;
+function assertUserRegexInput(text, what) {
+    if (text.length <= USER_REGEX_MAX_INPUT)
+        return;
+    throw new Error(`${what} cannot scan a value of ${text.length} characters, the limit is ${USER_REGEX_MAX_INPUT}. ` +
+        'Exclude the field with field rules, or remove the regex.');
 }
-function replaceInFree(seg, re, fn, into) {
-    var _a;
-    let last = 0;
-    for (const m of seg.text.matchAll(re)) {
-        const at = (_a = m.index) !== null && _a !== void 0 ? _a : 0;
-        if (m[0] === '')
-            continue;
-        const replacement = fn(m[0], seg.src + at);
-        if (replacement === null)
-            continue;
-        if (at > last)
-            into.push({ text: seg.text.slice(last, at), locked: false, src: seg.src + last });
-        into.push({ text: replacement, locked: true, src: -1 });
-        last = at + m[0].length;
-    }
-    if (last < seg.text.length)
-        into.push({ text: seg.text.slice(last), locked: false, src: seg.src + last });
+function freeSegmentAt(segs, start, end) {
+    return segs.findIndex((seg) => !seg.locked && seg.src <= start && end <= seg.src + seg.text.length);
 }
-function replaceFree(pass, re, fn, window) {
+function lockRange(segs, index, start, end, replacement) {
+    const seg = segs[index];
+    const parts = [];
+    if (start > seg.src)
+        parts.push({ text: seg.text.slice(0, start - seg.src), locked: false, src: seg.src });
+    parts.push({ text: replacement, locked: true, src: -1 });
+    const tail = end - seg.src;
+    if (tail < seg.text.length)
+        parts.push({ text: seg.text.slice(tail), locked: false, src: end });
+    segs.splice(index, 1, ...parts);
+}
+function replaceFree(pass, re, fn) {
+    var _a;
     const flags = re.flags.includes('g') ? re.flags : `${re.flags}g`;
-    const global = new RegExp(re.source, flags);
-    const next = [];
-    for (const seg of pass.segs) {
-        if (seg.locked)
-            next.push(seg);
-        else
-            for (const piece of window ? windows(seg, window) : [seg])
-                replaceInFree(piece, global, fn, next);
+    for (const m of pass.source.matchAll(new RegExp(re.source, flags))) {
+        const start = (_a = m.index) !== null && _a !== void 0 ? _a : 0;
+        const end = start + m[0].length;
+        const index = m[0] === '' ? -1 : freeSegmentAt(pass.segs, start, end);
+        if (index < 0)
+            continue;
+        const replacement = fn(m[0], start);
+        if (replacement !== null)
+            lockRange(pass.segs, index, start, end, replacement);
     }
-    pass.segs = next;
 }
 function redactMatch(pass, match, pattern, detail) {
     const replacement = applyRedaction(match, pattern, pass.ctx, pass.vault, pass.sessionId);
@@ -590,16 +589,17 @@ function denyListRegex(entry) {
 function denyListStage(pass) {
     var _a;
     for (const entry of (_a = pass.ctx.denyList) !== null && _a !== void 0 ? _a : []) {
+        if (entry.type === 'regex')
+            assertUserRegexInput(pass.source, `Deny list regex "${entry.value}"`);
         try {
             const re = denyListRegex(entry);
             if (!re)
                 continue;
-            const window = entry.type === 'regex' ? USER_REGEX_WINDOW : undefined;
             replaceFree(pass, re, (match) => TOKEN_RE.test(match)
                 ? null
                 : redactMatch(pass, match, { label: 'DENY_LIST', category: 'other' }, {
                     patternName: 'denyList', patternLabel: 'DENY_LIST', category: 'other', confidence: context_1.DENY_LIST_CONFIDENCE,
-                }), window);
+                }));
         }
         catch { }
     }
@@ -623,28 +623,21 @@ function builtInStage(pass) {
         replaceFree(pass, pattern.regex, (match, offset) => builtInMatch(pass, pattern, match, offset));
     }
 }
-function freeNames(pass) {
-    const names = new Map();
-    for (const seg of pass.segs) {
-        if (seg.locked)
-            continue;
-        for (const nm of (0, names_1.detectNamesInText)(seg.text))
-            if (!names.has(nm.name))
-                names.set(nm.name, seg.src + nm.start);
-    }
-    return names;
+function sourceNames(pass) {
+    const names = new Set((0, names_1.detectNamesInText)(pass.source).map((nm) => nm.name));
+    return [...names].sort((x, y) => y.length - x.length);
 }
 function nameStage(pass) {
     if (pass.ctx.skipSemantic)
         return;
-    for (const [name, start] of freeNames(pass)) {
+    for (const name of sourceNames(pass)) {
         if ((name.includes('[') && name.includes(']')) || isAllowListed(name, pass.ctx.allowList))
             continue;
-        const confidence = (0, context_1.hasContextWords)(pass.source, start, start + name.length, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
-        if (confidence < pass.threshold)
-            continue;
         let replacement;
-        replaceFree(pass, new RegExp(escapeRe(name), 'g'), (match) => {
+        replaceFree(pass, new RegExp(escapeRe(name), 'g'), (match, start) => {
+            const confidence = (0, context_1.hasContextWords)(pass.source, start, start + match.length, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
+            if (confidence < pass.threshold)
+                return null;
             replacement !== null && replacement !== void 0 ? replacement : (replacement = redactMatch(pass, match, { label: 'PERSON_NAME', category: 'identity' }, {
                 patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence,
             }));
@@ -659,20 +652,19 @@ function customStage(pass) {
         if (!cp.label || !cp.regex || !isSafeRegex(cp.regex))
             continue;
         const pattern = { label: cp.label.toUpperCase(), category: cp.category || 'identity' };
+        assertUserRegexInput(pass.source, `Custom pattern "${cp.label}"`);
         try {
             replaceFree(pass, new RegExp(cp.regex, 'g'), (match) => TOKEN_RE.test(match) || isAllowListed(match, pass.ctx.allowList)
                 ? null
                 : redactMatch(pass, match, pattern, {
                     patternName: `custom_${cp.label}`, patternLabel: pattern.label, category: pattern.category,
                     confidence: context_1.CUSTOM_PATTERN_CONFIDENCE,
-                }), USER_REGEX_WINDOW);
+                }));
         }
         catch { }
     }
 }
-function recordLocked(ctx, itemIndex, fieldPath, segs) {
-    if (!ctx.lockedSpans || fieldPath === '')
-        return;
+function recordLocked(ctx, segs) {
     const spans = [];
     let at = 0;
     for (const seg of segs) {
@@ -680,10 +672,20 @@ function recordLocked(ctx, itemIndex, fieldPath, segs) {
             spans.push([at, at + seg.text.length]);
         at += seg.text.length;
     }
-    if (spans.length > 0)
-        ctx.lockedSpans.set(lockKey(itemIndex, fieldPath), spans);
+    ctx.lastLocked = spans.length > 0 ? spans : undefined;
+}
+function lockChild(ctx, container, key, compute) {
+    var _a;
+    ctx.lastLocked = undefined;
+    const out = compute();
+    if (ctx.lastLocked && ctx.lockedSpans && typeof out === 'string') {
+        const byKey = (_a = ctx.lockedSpans.get(container)) !== null && _a !== void 0 ? _a : new Map();
+        byKey.set(key, ctx.lastLocked);
+        ctx.lockedSpans.set(container, byKey);
+    }
+    ctx.lastLocked = undefined;
+    return out;
 }
-const lockKey = (itemIndex, fieldPath) => `${itemIndex}\u0000${fieldPath}`;
 function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
     var _a;
     const pass = {
@@ -694,7 +696,7 @@ function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
     builtInStage(pass);
     nameStage(pass);
     customStage(pass);
-    recordLocked(ctx, itemIndex, fieldPath, pass.segs);
+    recordLocked(ctx, pass.segs);
     return pass.segs.map((s) => s.text).join('');
 }
 function makeRestorer(entries) {
@@ -716,7 +718,7 @@ function restoreWith(value, restore, entries) {
     if (value !== null && typeof value === 'object') {
         const obj = {};
         for (const [k, v] of Object.entries(value)) {
-            obj[restore(k)] = restoreWith(v, restore, entries);
+            setOwn(obj, restore(k), restoreWith(v, restore, entries));
         }
         return obj;
     }
@@ -745,18 +747,17 @@ function resolveOverlaps(spans) {
     }
     return kept.sort((a, b) => b.start - a.start);
 }
-function presidioSpans(value, entities, ctx, key) {
-    var _a, _b, _c;
+function presidioSpans(value, entities, ctx, locked) {
+    var _a;
     const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
-    const locked = (_c = (_b = ctx.lockedSpans) === null || _b === void 0 ? void 0 : _b.get(key)) !== null && _c !== void 0 ? _c : [];
     const free = (s) => !locked.some(([start, end]) => s.start < end && start < s.end);
     return resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold && free(s)));
 }
-async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path) {
+async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path, locked) {
     if (value.trim().length === 0 || TOKEN_RE.test(value))
         return value;
     const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000, ctx.presidioRequest);
-    const spans = presidioSpans(value, entities, ctx, lockKey(itemIndex, path));
+    const spans = presidioSpans(value, entities, ctx, locked);
     let text = value;
     for (const span of spans) {
         const matchedText = value.slice(span.start, span.end);
@@ -776,13 +777,13 @@ async function presidioRedactString(value, ctx, vault, sessionId, hits, itemInde
     }
     return text;
 }
-async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath) {
-    var _a, _b;
+async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath, locked = []) {
+    var _a, _b, _c, _d, _e, _f;
     if (typeof value === 'string') {
         if (!shouldProcessField(policyPath, ctx.fieldMode, ctx.fieldRules))
             return value;
         try {
-            return await presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path);
+            return await presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path, locked);
         }
         catch {
             return value;
@@ -791,18 +792,20 @@ async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path,
     if (Array.isArray(value)) {
         const out = [];
         for (let i = 0; i < value.length; i++) {
-            out.push(await presidioWalk(value[i], ctx, vault, sessionId, hits, itemIndex, `${path}[${i}]`, `${policyPath}[${i}]`));
+            const lock = (_b = (_a = ctx.lockedSpans) === null || _a === void 0 ? void 0 : _a.get(value)) === null || _b === void 0 ? void 0 : _b.get(String(i));
+            out.push(await presidioWalk(value[i], ctx, vault, sessionId, hits, itemIndex, `${path}[${i}]`, `${policyPath}[${i}]`, lock));
         }
         return out;
     }
     if (value !== null && typeof value === 'object') {
-        const origins = (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.get(value);
+        const origins = (_c = ctx.keyOrigins) === null || _c === void 0 ? void 0 : _c.get(value);
         const out = {};
         for (const [k, v] of Object.entries(value)) {
-            const original = (_b = origins === null || origins === void 0 ? void 0 : origins.get(k)) !== null && _b !== void 0 ? _b : k;
+            const original = (_d = origins === null || origins === void 0 ? void 0 : origins.get(k)) !== null && _d !== void 0 ? _d : k;
             const child = path ? `${path}.${k}` : k;
             const childPolicy = policyPath ? `${policyPath}.${original}` : original;
-            out[k] = await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy);
+            const lock = (_f = (_e = ctx.lockedSpans) === null || _e === void 0 ? void 0 : _e.get(value)) === null || _f === void 0 ? void 0 : _f.get(k);
+            setOwn(out, k, await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy, lock));
         }
         return out;
     }

package/dist/nodes/Redactor/regexCharset.js

@@ -3,19 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.emptySet = void 0;
 exports.union = union;
 exports.overlaps = overlaps;
+exports.readEscape = readEscape;
 exports.atomCharset = atomCharset;
 const emptySet = () => ({ ascii: new Array(128).fill(false), other: false });
 exports.emptySet = emptySet;
 const fullSet = () => ({ ascii: new Array(128).fill(true), other: true });
 function addCode(set, code) {
-    if (code >= 128) {
+    if (code >= 128)
         set.other = true;
-        return;
-    }
-    set.ascii[code] = true;
-    const ch = String.fromCharCode(code);
-    for (const folded of [ch.toLowerCase(), ch.toUpperCase()])
-        set.ascii[folded.charCodeAt(0)] = true;
+    else
+        set.ascii[code] = true;
 }
 function addRange(set, from, to) {
     for (let c = from; c <= Math.min(to, 127); c++)
@@ -32,11 +29,18 @@ function overlaps(a, b) {
 function complement(set) {
     return { ascii: set.ascii.map((v) => !v), other: true };
 }
+function fold(set) {
+    const ascii = [...set.ascii];
+    for (let c = 65; c <= 90; c++)
+        ascii[c] = ascii[c + 32] = set.ascii[c] || set.ascii[c + 32];
+    return { ascii, other: set.other };
+}
 const CLASS_ESCAPES = {
     d: (s) => addRange(s, 48, 57),
     w: (s) => {
         addRange(s, 48, 57);
         addRange(s, 65, 90);
+        addRange(s, 97, 122);
         addCode(s, 95);
     },
     s: (s) => {
@@ -45,26 +49,53 @@ const CLASS_ESCAPES = {
         s.other = true;
     },
 };
-function escapeSet(letter) {
-    const lower = letter.toLowerCase();
-    const fill = CLASS_ESCAPES[lower];
-    if (fill) {
-        const set = (0, exports.emptySet)();
-        fill(set);
-        return letter === lower ? set : complement(set);
-    }
-    if (/[a-zA-Z0-9]/.test(letter))
-        return fullSet();
+const HEX = /^[0-9a-fA-F]+$/;
+const CONTROL = { n: 10, r: 13, t: 9, v: 11, f: 12 };
+function readEscape(src, i) {
+    var _a, _b;
+    const e = (_a = src[i + 1]) !== null && _a !== void 0 ? _a : '';
+    const hex = (n) => (HEX.test(src.slice(i + 2, i + 2 + n)) && src.length >= i + 2 + n ? n : 0);
+    if (e === 'x' && hex(2))
+        return { length: 4, code: parseInt(src.slice(i + 2, i + 4), 16) };
+    if (e === 'u' && hex(4))
+        return { length: 6, code: parseInt(src.slice(i + 2, i + 6), 16) };
+    if (e === 'c' && /[A-Za-z]/.test((_b = src[i + 2]) !== null && _b !== void 0 ? _b : ''))
+        return { length: 3, code: src.charCodeAt(i + 2) % 32 };
+    if (e === '0')
+        return { length: 2, code: 0 };
+    const control = CONTROL[e];
+    if (control !== undefined)
+        return { length: 2, code: control };
+    if (/[a-zA-Z0-9]/.test(e))
+        return { length: 2, code: null };
+    return { length: 2, code: e.charCodeAt(0) };
+}
+function codeSet(code) {
     const set = (0, exports.emptySet)();
-    addCode(set, letter.charCodeAt(0));
+    addCode(set, code);
     return set;
 }
+function escapeSet(src, i) {
+    var _a;
+    const { code } = readEscape(src, i);
+    const set = (0, exports.emptySet)();
+    if (code !== null) {
+        addCode(set, code);
+        return set;
+    }
+    const letter = (_a = src[i + 1]) !== null && _a !== void 0 ? _a : '';
+    const fill = CLASS_ESCAPES[letter.toLowerCase()];
+    if (!fill)
+        return fullSet();
+    fill(set);
+    return letter === letter.toLowerCase() ? set : complement(set);
+}
 function classMember(body, j) {
-    var _a, _b;
+    if (body[j] === '\\' && body[j + 1] === 'b')
+        return { set: codeSet(8), next: j + 2, code: 8 };
     if (body[j] === '\\') {
-        const set = escapeSet((_a = body[j + 1]) !== null && _a !== void 0 ? _a : '\\');
-        const single = /[a-zA-Z0-9]/.test((_b = body[j + 1]) !== null && _b !== void 0 ? _b : '') ? null : body.charCodeAt(j + 1);
-        return { set, next: j + 2, code: single };
+        const { length, code } = readEscape(body, j);
+        return { set: escapeSet(body, j), next: j + length, code };
     }
     const set = (0, exports.emptySet)();
     addCode(set, body.charCodeAt(j));
@@ -90,13 +121,13 @@ function classSet(body) {
     }
     return negated ? complement(set) : set;
 }
-function atomCharset(src, start, end) {
-    var _a, _b;
+function rawCharset(src, start, end) {
+    var _a;
     const c = src[start];
     if (c === '^' || c === '$')
         return null;
     if (c === '\\')
-        return /[bB]/.test((_a = src[start + 1]) !== null && _a !== void 0 ? _a : '') ? null : escapeSet((_b = src[start + 1]) !== null && _b !== void 0 ? _b : '\\');
+        return /[bB]/.test((_a = src[start + 1]) !== null && _a !== void 0 ? _a : '') ? null : escapeSet(src, start);
     if (c === '[')
         return classSet(src.slice(start + 1, end - 1));
     if (c === '.')
@@ -105,3 +136,7 @@ function atomCharset(src, start, end) {
     addCode(set, src.charCodeAt(start));
     return set;
 }
+function atomCharset(src, start, end) {
+    const set = rawCharset(src, start, end);
+    return set && fold(set);
+}

package/dist/nodes/Redactor/regexSafety.js

@@ -5,7 +5,13 @@ const regexCharset_1 = require("./regexCharset");
 const MAX_REGEX_LENGTH = 500;
 const newFrame = (zeroWidth = false) => ({
     hasVariableQuantifier: false, hasAlternation: false, run: null, chars: (0, regexCharset_1.emptySet)(), zeroWidth,
+    branchConsumes: false, allConsume: true, nullable: false,
 });
+function endBranch(frame) {
+    frame.allConsume && (frame.allConsume = frame.branchConsumes);
+    frame.branchConsumes = false;
+    frame.nullable = !frame.allConsume;
+}
 function readBraces(src, i) {
     const m = /^\{(\d+)(,(\d*))?\}/.exec(src.slice(i));
     if (!m)
@@ -48,13 +54,27 @@ function groupPrefixLength(src, i) {
     const look = /^\(\?(?::|=|!|<=|<!)/.exec(src.slice(i));
     return look ? look[0].length : 1;
 }
+function alternation(stack, i) {
+    const top = stack[stack.length - 1];
+    top.hasAlternation = true;
+    top.run = null;
+    endBranch(top);
+    return { atomEnd: i, closed: null, next: i + 1 };
+}
+function closeGroup(c, stack) {
+    if (c !== ')' || stack.length <= 1)
+        return null;
+    const closed = stack.pop();
+    endBranch(closed);
+    return closed;
+}
 function readToken(src, i, stack) {
     var _a;
     const c = src[i];
     if (c === '\\') {
         if (/[1-9k]/.test((_a = src[i + 1]) !== null && _a !== void 0 ? _a : ''))
             return { atomEnd: i, closed: null, error: 'back-references are not supported' };
-        return { atomEnd: i + 2, closed: null };
+        return { atomEnd: i + (0, regexCharset_1.readEscape)(src, i).length, closed: null };
     }
     if (c === '[')
         return { atomEnd: skipClass(src, i), closed: null };
@@ -62,13 +82,9 @@ function readToken(src, i, stack) {
         stack.push(newFrame(/^\(\?(?:=|!|<=|<!)/.test(src.slice(i))));
         return { atomEnd: i, closed: null, next: i + groupPrefixLength(src, i) };
     }
-    if (c === '|') {
-        stack[stack.length - 1].hasAlternation = true;
-        stack[stack.length - 1].run = null;
-        return { atomEnd: i, closed: null, next: i + 1 };
-    }
-    const closed = c === ')' && stack.length > 1 ? stack.pop() : null;
-    return { atomEnd: i + 1, closed };
+    if (c === '|')
+        return alternation(stack, i);
+    return { atomEnd: i + 1, closed: closeGroup(c, stack) };
 }
 const NESTED = 'a repeated group contains a quantifier or alternation (catastrophic backtracking)';
 function isRisky(frame) {
@@ -106,13 +122,21 @@ function stepChars(src, i, step) {
         return (0, regexCharset_1.atomCharset)(src, i, step.atomEnd);
     return closed.zeroWidth ? null : closed.chars;
 }
+function consumes(q, chars, closed) {
+    if (chars === null || (q !== null && q.min < 1))
+        return false;
+    return !(closed === null || closed === void 0 ? void 0 : closed.nullable);
+}
 function stepProblem(src, i, step, q, top) {
-    var _a, _b;
+    var _a;
     const problem = applyQuantifier(q, step.closed, top);
     if (problem || (q === null || q === void 0 ? void 0 : q.max) === 0)
         return problem;
-    const variable = isVariable(q) || ((_a = step.closed) === null || _a === void 0 ? void 0 : _a.hasVariableQuantifier) === true;
-    return applySequence(stepChars(src, i, step), variable, ((_b = q === null || q === void 0 ? void 0 : q.min) !== null && _b !== void 0 ? _b : 1) >= 1, top);
+    const chars = stepChars(src, i, step);
+    const required = consumes(q, chars, step.closed);
+    if (required)
+        top.branchConsumes = true;
+    return applySequence(chars, isVariable(q) || !!((_a = step.closed) === null || _a === void 0 ? void 0 : _a.hasVariableQuantifier), required, top);
 }
 function structuralProblem(src) {
     const stack = [newFrame()];
@@ -133,7 +157,45 @@ function structuralProblem(src) {
     }
     return null;
 }
+const KNOWN_ESCAPES = /^(?:[dDwWsSbBnrtvf]|x[0-9a-fA-F]{2}|u[0-9a-fA-F]{4}|c[A-Za-z]|0(?![0-9])|[^A-Za-z0-9])/;
+const CLASS_ESCAPE_RANGE = /\\[dDwWsS]-[^\]]|[^[^\\]-\\[dDwWsS]/;
+const BAD_ESCAPE = 'uses an escape that is not supported (octal, back-reference or unknown letter)';
+const EMPTY_CLASS = 'uses an empty class [] or [^], which is not supported';
+const ESCAPE_RANGE = 'uses a range with \\d, \\w or \\s as an end, which is not supported';
+function classProblem(src, i) {
+    if (/^\[\^?\]/.test(src.slice(i)))
+        return { end: i, problem: EMPTY_CLASS };
+    const end = skipClass(src, i);
+    const body = src.slice(i, end);
+    for (let j = 1; j < body.length; j++) {
+        if (body[j] === '\\' && !KNOWN_ESCAPES.test(body.slice(j + 1)))
+            return { end, problem: BAD_ESCAPE };
+        if (body[j] === '\\')
+            j++;
+    }
+    return { end, problem: CLASS_ESCAPE_RANGE.test(body) ? ESCAPE_RANGE : null };
+}
+function unsupportedSyntax(src) {
+    let i = 0;
+    while (i < src.length) {
+        if (src[i] === '[') {
+            const { end, problem } = classProblem(src, i);
+            if (problem)
+                return problem;
+            i = end;
+        }
+        else if (src[i] === '\\') {
+            if (!KNOWN_ESCAPES.test(src.slice(i + 1)))
+                return BAD_ESCAPE;
+            i += 2;
+        }
+        else
+            i++;
+    }
+    return null;
+}
 function checkRegex(regexStr) {
+    var _a;
     if (typeof regexStr !== 'string' || regexStr.length === 0)
         return 'is empty';
     if (regexStr.length > MAX_REGEX_LENGTH)
@@ -144,5 +206,5 @@ function checkRegex(regexStr) {
     catch {
         return 'is not a valid regular expression';
     }
-    return structuralProblem(regexStr);
+    return (_a = unsupportedSyntax(regexStr)) !== null && _a !== void 0 ? _a : structuralProblem(regexStr);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-redactor",
-  "version": "4.3.0",
+  "version": "5.1.0",
   "description": "Redact, mask and anonymize PII before it reaches an LLM, then restore it. 216 patterns for emails, phones, addresses, IBAN, cards, names, SSN, passport and tax IDs. Reversible encrypted vault, GDPR Art.30 ROPA record, prompt-injection check. Runs on n8n Cloud and self-hosted n8n 2.x.",
   "keywords": [
     "n8n-community-node-package",