snap-validate 0.3.0 → 0.3.2

package/README.md

@@ -3,23 +3,28 @@
 [![npm version](https://img.shields.io/npm/v/snap-validate.svg?style=flat-square)](https://www.npmjs.com/package/snap-validate)
 [![Build Status](https://github.com/aniru-dh21/snap-validate/workflows/CI%2FCD%20Pipeline/badge.svg)](https://github.com/aniru-dh21/snap-validate/actions)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![install size](https://img.shields.io/badge/dynamic/json?url=https://packagephobia.com/v2/api.json?p=snap-validate&query=$.install.pretty&label=install%20size&style=flat-square)](https://packagephobia.now.sh/result?p=snap-validate)
+[![npm bundle size](https://img.shields.io/bundlephobia/minzip/snap-validate?style=flat-square)](https://bundlephobia.com/package/snap-validate@latest)
 [![npm downloads](https://img.shields.io/npm/dm/snap-validate.svg?style=flat-square)](https://npm-stat.com/charts.html?package=snap-validate)
 
-A lightning-fast, lightweight validation library for common patterns without heavy dependencies. Perfect for client-side and server-side validation with zero external dependencies.
+A lightning-fast, lightweight validation library for common patterns without heavy dependencies. Perfect for client-side and server-side validation with zero external dependencies and built-in protection against ReDoS (Regular Expression Denial of Service) attacks.
 
 ## Features
 
-- ⚡ **Lightning Fast**: Optimized for speed and performance
-- 🚀 **Lightweight**: No external dependencies, minimal footprint
-- 🔧 **Flexible**: Chainable validation rules and custom validators
-- 📧 **Common Patterns**: Email, phone, credit card, URL, password validation
-- 🌍 **International**: Support for different formats (US/International phone, postal codes)
-- 🔄 **Async Support**: Full async validation support for database checks and API calls
-- 🎯 **Conditional**: Advanced conditional validation with `when()` and `optional()`
-- 🛠️ **Custom Validators**: Add your own sync and async validation logic
-- 🧪 **Well Tested**: Comprehensive test suite with high coverage
-- 📦 **Easy Integration**: Works in Node.js and browsers
-- 🔗 **Chainable API**: Intuitive fluent interface
+- ⚡ **Lightning Fast**: Optimized for speed and performance  
+- 🚀 **Lightweight**: No external dependencies, minimal footprint  
+- 🔧 **Flexible**: Chainable validation rules and custom validators  
+- 📧 **Common Patterns**: Email, phone, credit card, URL, password validation  
+- 🌍 **International**: Support for different formats (US/International phone, postal codes)  
+- 🔄 **Async Support**: Full async validation support for database checks and API calls  
+- 🎯 **Conditional**: Advanced conditional validation with `when()` and `optional()`  
+- 🛠️ **Custom Validators**: Add your own sync and async validation logic  
+- 🔒 **Security First**: Built-in protection against ReDoS attacks and unsafe regex patterns  
+- 🛡️ **Timeout Protection**: Configurable timeout for regex operations to prevent DoS attacks  
+- 🧪 **Well Tested**: Comprehensive test suite with high coverage  
+- 📦 **Easy Integration**: Works in Node.js and browsers  
+- 🔗 **Chainable API**: Intuitive fluent interface  
+- 📘 **TypeScript Support**: Complete TypeScript definitions with full IntelliSense support  
 
 ## Installation
 
@@ -27,6 +32,15 @@ A lightning-fast, lightweight validation library for common patterns without hea
 npm install snap-validate
 ```
 
+### TypeScript
+
+For TypeScript projects, types are included automatically:
+
+```bash
+npm install snap-validate
+# Types are included - no need for @types/snap-validate
+```
+
 ## Quick Start
 
 ```javascript
@@ -53,6 +67,76 @@ const result = validate(schema, data);
 console.log(result.isValid); // true
 ```
 
+## TypeScript Support
+
+Snap Validate includes comprehensive TypeScript definitions for enhanced developer experience:
+
+```typescript
+import { BaseValidator, validators, validate, ValidationResult } from 'snap-validate';
+
+// Full type safety and auto-completion
+const validator = new BaseValidator('test-value')
+  .required('This field is required')
+  .min(5, 'Must be at least 5 characters')
+  .pattern(/^[a-zA-Z]+$/, 'Only letters allowed');
+
+// Type-safe result handling
+const result: ValidationResult = validator.validate();
+
+// Schema validation with types
+interface UserData {
+  email: string;
+  phone: string;
+  password: string;
+}
+
+const userData: UserData = {
+  email: 'john@example.com',
+  phone: '1234567890',
+  password: 'StrongPass123'
+};
+
+const schema = {
+  email: validators.email,
+  phone: (value: string) => validators.phone(value, 'us'),
+  password: validators.password
+};
+
+const result = validate(schema, userData);
+```
+
+Features:
+
+- Complete type definitions for all classes and functions  
+- IntelliSense support in VS Code, WebStorm, and other editors  
+- Compile-time validation prevents common usage errors  
+- Generic support for flexible validation workflows  
+- Rich JSDoc comments for comprehensive documentation  
+
+## Security Features
+
+### ReDoS Protection
+
+Snap Validate includes built-in protection against Regular Expression Denial of Service (ReDoS) attacks:
+
+- **Regex Safety Detection**: Automatically detects and prevents potentially dangerous regex patterns
+- **Input Length Limits**: Protects against extremely long input strings (10,000 character limit)
+- **Timeout Protection**: Configurable timeout for regex operations (default: 1 second)
+- **Safe Defaults**: All predefined validators use safe, optimized regex patterns
+
+```javascript
+// Set custom timeout for regex operations
+const validator = new BaseValidator(value)
+  .setRegexTimeout(2000) // 2 second timeout
+  .pattern(/your-pattern/, 'Error message');
+
+// Use async pattern validation for complex patterns with timeout protection
+const validator = new BaseValidator(value)
+  .patternAsync(/complex-pattern/, 'Error message');
+
+const result = await validator.validateAsync();
+```
+
 ## Available Validators
 
 ### Email Validation
@@ -212,6 +296,39 @@ const asyncSchema = {
 const asyncResult = await validate.async(asyncSchema, userData);
 ```
 
+## Security and Pattern Validation
+
+### Safe Pattern Validation
+
+```javascript
+const { BaseValidator } = require('snap-validate');
+
+// Synchronous pattern validation with built-in safety checks
+const validator = new BaseValidator(value)
+  .pattern(/^[a-zA-Z0-9]+$/, 'Only alphanumeric characters allowed');
+
+// Asynchronous pattern validation with timeout protection
+const asyncValidator = new BaseValidator(value)
+  .patternAsync(/^[a-zA-Z0-9]+$/, 'Only alphanumeric characters allowed')
+  .setRegexTimeout(5000); // 5 second timeout
+
+const result = await asyncValidator.validateAsync();
+```
+
+### Configurable Security Settings
+
+```javascript
+const validator = new BaseValidator(value)
+  .setRegexTimeout(3000) // Set custom timeout (3 seconds)
+  .pattern(/your-pattern/, 'Error message');
+
+// The library automatically:
+// - Detects unsafe regex patterns
+// - Limits input length to prevent ReDoS
+// - Applies timeout protection for complex patterns
+// - Provides clear error messages for security violations
+```
+
 ## Custom Validation
 
 ### Using BaseValidator
@@ -282,6 +399,13 @@ try {
 } catch (error) {
   console.log('Validation exception:', error.message);
 }
+
+// Security-related errors
+const unsafeResult = validator.pattern(/potentially-dangerous-pattern/, 'Error').validate();
+if (!unsafeResult.isValid) {
+  console.log('Security errors:', unsafeResult.errors);
+  // Output: ['Potentially unsafe regex pattern detected']
+}
 ```
 
 ## Browser Usage
@@ -308,7 +432,9 @@ try {
 - `required(message?)` - Field is required
 - `min(length, message?)` - Minimum length validation
 - `max(length, message?)` - Maximum length validation
-- `pattern(regex, message?)` - Pattern matching validation
+- `pattern(regex, message?)` - Pattern matching validation with safety checks
+- `patternAsync(regex, message?)` - Async pattern validation with timeout protection
+- `setRegexTimeout(timeoutMs)` - Set custom timeout for regex operations
 - `when(condition, validator)` - Conditional validation
 - `optional()` - Skip validation if empty/null/undefined
 - `custom(fn, message?)` - Custom synchronous validation
@@ -327,11 +453,32 @@ try {
 - `validators.numeric(value)`
 - `validators.zipCode(value, country?)`
 
+### TypeScript Types
+
+- `ValidationResult` - Interface for validation results  
+- `ValidatorFunction` - Type for validator functions used in schemas  
+- `ValidationSchema` - Type for validation schema objects  
+- `PasswordOptions` - Interface for password validation configuration  
+- `BaseValidator<T>` - Generic base validator class
+
 ### Validation Functions
 
 - `validate(schema, data)` - Synchronous schema validation
 - `validate.async(schema, data)` - Asynchronous schema validation
 
+### Security Functions
+
+- `isRegexSafe(regex)` - Check if a regex pattern is safe to use
+- `safeRegexText(regex, str, timeoutMs)` - Execute regex with timeout protection
+
+## Security Best Practices
+
+1. **Use Built-in Validators**: The predefined validators are optimized for security and performance
+2. **Validate Input Length**: Large inputs are automatically limited to prevent ReDoS attacks
+3. **Set Appropriate Timeouts**: Configure regex timeouts based on your application's needs
+4. **Test Custom Patterns**: Use `isRegexSafe()` to check custom regex patterns before deployment
+5. **Handle Async Errors**: Always use try-catch blocks with async validation
+
 ## Contributing
 
 We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) for details.
@@ -362,6 +509,15 @@ npm run lint
 
 # Format code
 npm run format
+
+# Security audit
+npm audit
+
+# Type checking (for TypeScript users)
+npm run type-check
+
+# Validate TypeScript definitions
+npm run validate-types
 ```
 
 ## License
@@ -374,4 +530,4 @@ See [CHANGELOG.md](CHANGELOG.md) for a detailed history of changes.
 
 ---
 
-Made with ⚡ by [Ramachandra Anirudh Vemulapalli](https://github.com/aniru-dh21)
+Made with ⚡ by [Ramachandra Anirudh Vemulapalli](https://github.com/aniru-dh21)

package/package.json

@@ -1,9 +1,17 @@
 {
   "name": "snap-validate",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Lightweight validation library for common patterns without heavy dependencies",
   "main": "src/index.js",
   "types": "types/index.d.ts",
+  "typings": "types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./types/index.d.ts",
+      "require": "./src/index.js",
+      "import": "./src/index.js"
+    }
+  },
   "scripts": {
     "test": "jest",
     "test:watch": "jest --watch",
@@ -14,7 +22,12 @@
     "prepare": "husky install",
     "prepublishOnly": "npm test && npm run lint",
     "build": "echo 'No build step required for this library'",
-    "example": "node examples/basic-usage.js"
+    "example": "node examples/basic-usage.js",
+    "type-check": "tsc --noEmit",
+    "test-types": "tsc test-types.ts --noEmit",
+    "validate-types": "tsc --noEmit && echo 'TypeScript definitions are valid!'",
+    "lint-types": "eslint types/**/*.ts",
+    "check-exports": "node -e \"console.log(Object.keys(require('./src/index.js')))\""
   },
   "keywords": [
     "validation",

package/src/index.js

@@ -1,8 +1,76 @@
 /**
  * Snap Validate - Enhanced Lightweight validator library
- * @version 0.3.0
+ * @version 0.3.2 - Typescript Patch
  */
 
+// Utility function to safely test regex with timeout protection
+const safeRegexTest = (regex, str, timeoutMs = 1000) => {
+  return new Promise((resolve, reject) => {
+    // SECURITY FIX: Add input length validation before regex test
+    if (str.length > 10000) {
+      reject(new Error('Input too long for regex validation'));
+      return;
+    }
+
+    // SECURITY FIX: Add regex safety check before execution
+    if (!isRegexSafe(regex)) {
+      reject(new Error('Unsafe regex pattern detected'));
+      return;
+    }
+
+    const timeout = setTimeout(() => {
+      reject(new Error('Regex execution timeout - potential ReDoS attack'));
+    }, timeoutMs);
+
+    try {
+      const result = regex.test(str);
+      clearTimeout(timeout);
+      resolve(result);
+    } catch (error) {
+      clearTimeout(timeout);
+      reject(error);
+    }
+  });
+};
+
+// Synchronous safe regex test with input length protection
+const safeRegexTestSync = (regex, str, maxLength = 10000) => {
+  // Limit input length to prevent ReDoS
+  if (str.length > maxLength) {
+    throw new Error('Input too long for pattern validation');
+  }
+
+  // For additional safety, we could add a timeout using a worker thread or 
+  // other mechanism, but for now we rely on input length limiting
+  return regex.test(str);
+};
+
+// Function to detect potentially dangerous regex patterns
+const isRegexSafe = (regex) => {
+  const regexStr = regex.toString();
+
+  // Check for common ReDoS patterns - more precise detection
+  const dangerousPatterns = [
+    // Nested quantifiers like (a+)+ or (a*)* or (a?)?
+    /\([^)]*[+*?][^)]*\)[+*?]/,
+    // Alternation with overlapping and quantifiers like (a|a)*
+    /\([^)]*\|[^)]*\)[+*]/,
+    // Catastrophic backtracking with greedy quantifiers
+    /\([^)]*\.\*[^)]*\)\*/,
+    // Multiple consecutive quantifiers (not separated by characters)
+    /[+*?]{2,}/,
+    // Exponential alternation patterns
+    /\([^)]*\|[^)]*\)\+.*\([^)]*\|[^)]*\)\+/
+  ];
+
+  // Check if the pattern has obvious ReDoS vulnerabilities
+  const isDangerous = dangerousPatterns.some((pattern) =>
+    pattern.test(regexStr)
+  );
+
+  return !isDangerous;
+};
+
 // Core validation class
 class ValidationResult {
   constructor(isValid, errors = []) {
@@ -24,16 +92,24 @@ class BaseValidator {
     this.rules = [];
     this.asyncRules = [];
     this.isOptional = false;
+    this.regexTimeout = 1000; // Default timeout for regex operations
   }
 
   required(message = 'This field is required') {
     this.rules.push(() => {
       // Skip validation if optional and empty
-      if (this.isOptional && (this.value === null || this.value === undefined || this.value === '')) {
+      if (
+        this.isOptional &&
+        (this.value === null || this.value === undefined || this.value === '')
+      ) {
         return new ValidationResult(true);
       }
 
-      if (this.value === null || this.value === undefined || this.value === '') {
+      if (
+        this.value === null ||
+        this.value === undefined ||
+        this.value === ''
+      ) {
         return new ValidationResult(false, [message]);
       }
       return new ValidationResult(true);
@@ -46,10 +122,18 @@ class BaseValidator {
     return this;
   }
 
+  setRegexTimeout(timeoutMs) {
+    this.regexTimeout = timeoutMs;
+    return this;
+  }
+
   min(length, message = `Minimum length is ${length}`) {
     this.rules.push(() => {
       // Skip validation if optional and empty
-      if (this.isOptional && (this.value === null || this.value === undefined || this.value === '')) {
+      if (
+        this.isOptional &&
+        (this.value === null || this.value === undefined || this.value === '')
+      ) {
         return new ValidationResult(true);
       }
 
@@ -66,7 +150,9 @@ class BaseValidator {
             return new ValidationResult(false, [message]);
           }
         } else {
-          return new ValidationResult(false, ['Value must be a string, array, or number']);
+          return new ValidationResult(false, [
+            'Value must be a string, array, or number'
+          ]);
         }
       }
       return new ValidationResult(true);
@@ -77,7 +163,10 @@ class BaseValidator {
   max(length, message = `Maximum length is ${length}`) {
     this.rules.push(() => {
       // Skip validation if optional and empty
-      if (this.isOptional && (this.value === null || this.value === undefined || this.value === '')) {
+      if (
+        this.isOptional &&
+        (this.value === null || this.value === undefined || this.value === '')
+      ) {
         return new ValidationResult(true);
       }
 
@@ -94,7 +183,9 @@ class BaseValidator {
             return new ValidationResult(false, [message]);
           }
         } else {
-          return new ValidationResult(false, ['Value must be a string, array or number']);
+          return new ValidationResult(false, [
+            'Value must be a string, array or number'
+          ]);
         }
       }
       return new ValidationResult(true);
@@ -103,9 +194,61 @@ class BaseValidator {
   }
 
   pattern(regex, message = 'Invalid format') {
+    // SECURITY FIX: Add regex safety check
+    if (!isRegexSafe(regex)) {
+      throw new Error(
+        'Potentially unsafe regex pattern detected. Please use a simple pattern.'
+      );
+    }
+
     this.rules.push(() => {
       // Skip validation if optional and empty
-      if (this.isOptional && (this.value === null || this.value === undefined || this.value === '')) {
+      if (
+        this.isOptional &&
+        (this.value === null || this.value === undefined || this.value === '')
+      ) {
+        return new ValidationResult(true);
+      }
+
+      // Only test pattern if value exists and is not empty
+      if (this.value != null && this.value !== '') {
+        // Ensure value is a string before testing regex
+        const stringValue = String(this.value);
+
+        try {
+          // SECURITY FIX: Use safe regex test with input length protection
+          if (!safeRegexTestSync(regex, stringValue)) {
+            return new ValidationResult(false, [message]);
+          }
+        } catch (error) {
+          if (error.message.includes('Input too long')) {
+            return new ValidationResult(false, [
+              'Input too long for pattern validation'
+            ]);
+          }
+          return new ValidationResult(false, ['Pattern validation failed']);
+        }
+      }
+      return new ValidationResult(true);
+    });
+    return this;
+  }
+
+  // New method for async pattern validation with timeout protection
+  patternAsync(regex, message = 'Invalid format') {
+    // Security Fix: Add regex safety check
+    if (!isRegexSafe(regex)) {
+      throw new Error(
+        'Potentially unsafe regex pattern detected. Please use a simple pattern.'
+      );
+    }
+
+    this.asyncRules.push(async () => {
+      // Skip validation if optional and empty
+      if (
+        this.isOptional &&
+        (this.value === null || this.value === undefined || this.value === '')
+      ) {
         return new ValidationResult(true);
       }
 
@@ -113,8 +256,31 @@ class BaseValidator {
       if (this.value != null && this.value !== '') {
         // Ensure value is a string before testing regex
         const stringValue = String(this.value);
-        if (!regex.test(stringValue)) {
-          return new ValidationResult(false, [message]);
+
+        // Security Fix: Limit input length to prevent ReDoS
+        if (stringValue.length > 10000) {
+          return new ValidationResult(false, [
+            'Input too long for pattern validation'
+          ]);
+        }
+
+        try {
+          // Security Fix: Use timeout protection for regex execution
+          const result = await safeRegexTest(
+            regex,
+            stringValue,
+            this.regexTimeout
+          );
+          if (!result) {
+            return new ValidationResult(false, [message]);
+          }
+        } catch (error) {
+          if (error.message.includes('timeout')) {
+            return new ValidationResult(false, [
+              'Pattern validation timeout - pattern too complex'
+            ]);
+          }
+          return new ValidationResult(false, ['Pattern validation failed']);
         }
       }
       return new ValidationResult(true);
@@ -125,7 +291,8 @@ class BaseValidator {
   when(condition, validator) {
     this.rules.push(() => {
       // Evaluate condition
-      const shouldValidate = typeof condition === 'function' ? condition(this.value) : condition;
+      const shouldValidate =
+        typeof condition === 'function' ? condition(this.value) : condition;
 
       if (shouldValidate) {
         // Apply the conditional validator
@@ -146,7 +313,10 @@ class BaseValidator {
   custom(validatorFn, message = 'Custom validation failed') {
     this.rules.push(() => {
       // Skip validation if optional and empty
-      if (this.isOptional && (this.value === null || this.value === undefined || this.value === '')) {
+      if (
+        this.isOptional &&
+        (this.value === null || this.value === undefined || this.value === '')
+      ) {
         return new ValidationResult(true);
       }
 
@@ -155,7 +325,9 @@ class BaseValidator {
 
         // Handle boolean result
         if (typeof result === 'boolean') {
-          return result ? new ValidationResult(true) : new ValidationResult(false, [message]);
+          return result
+            ? new ValidationResult(true)
+            : new ValidationResult(false, [message]);
         }
 
         // Handle ValidationResult object
@@ -171,7 +343,9 @@ class BaseValidator {
         // Default to true if no clear result
         return new ValidationResult(true);
       } catch (error) {
-        return new ValidationResult(false, [`Custom validation error: ${error.message}`]);
+        return new ValidationResult(false, [
+          `Custom validation error: ${error.message}`
+        ]);
       }
     });
     return this;
@@ -180,7 +354,10 @@ class BaseValidator {
   customAsync(validatorFn, message = 'Async validation failed') {
     this.asyncRules.push(async () => {
       // Skip validation if optional and empty
-      if (this.isOptional && (this.value === null || this.value === undefined || this.value === '')) {
+      if (
+        this.isOptional &&
+        (this.value === null || this.value === undefined || this.value === '')
+      ) {
         return new ValidationResult(true);
       }
 
@@ -189,7 +366,9 @@ class BaseValidator {
 
         // Handle boolean result
         if (typeof result === 'boolean') {
-          return result ? new ValidationResult(true) : new ValidationResult(false, [message]);
+          return result
+            ? new ValidationResult(true)
+            : new ValidationResult(false, [message]);
         }
 
         // Handle ValidationResult object
@@ -205,7 +384,9 @@ class BaseValidator {
         // Default to true if no clear result
         return new ValidationResult(true);
       } catch (error) {
-        return new ValidationResult(false, [`Async validation error: ${error.message}`]);
+        return new ValidationResult(false, [
+          `Async validation error: ${error.message}`
+        ]);
       }
     });
     return this;
@@ -261,6 +442,7 @@ class BaseValidator {
 }
 
 // Predefined validators
+// Security Fix: Updated predefined validators with safer regex patterns
 const validators = {
   email: (value) => {
     const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
@@ -270,15 +452,25 @@ const validators = {
   },
 
   phone: (value, format = 'us') => {
+    // FIXED: Much simpler phone regex patterns to avoid ReDoS detection
     const phoneRegex = {
-      us: /^\+?1?[-.\s]?\(?([0-9]{3})\)?[-.\s]?([0-9]{3})[-.\s]?([0-9]{4})$/,
-      international: /^\+[1-9]\d{1,14}$/,
-      simple: /^\d{10,15}$/
+      us: /^[+]?[1]?[0-9]{10}$/,
+      international: /^[+][1-9][0-9]{7,14}$/,
+      simple: /^[0-9]{10,15}$/
     };
 
     return new BaseValidator(value)
       .required('Phone number is required')
-      .pattern(phoneRegex[format] || phoneRegex.simple, 'Invalid phone number format');
+      .custom((val) => {
+        // Remove all non-digit characters except +
+        const cleaned = String(val).replace(/[^+0-9]/g, '');
+        const regex = phoneRegex[format] || phoneRegex.simple;
+
+        if (!safeRegexTestSync(regex, cleaned)) {
+          return 'Invalid phone number format';
+        }
+        return true;
+      });
   },
 
   creditCard: (value) => {
@@ -305,22 +497,30 @@ const validators = {
       return sum % 10 === 0;
     };
 
-    const validator = new BaseValidator(value)
-      .required('Credit card number is required');
+    const validator = new BaseValidator(value).required(
+      'Credit card number is required'
+    );
 
     // Add custom validation for credit card format and Luhn check
     validator.rules.push(() => {
       // Skip validation if optional and empty
-      if (validator.isOptional && (validator.value === null || validator.value === undefined || validator.value === '')) {
+      if (
+        validator.isOptional &&
+        (validator.value === null ||
+          validator.value === undefined ||
+          validator.value === '')
+      ) {
         return new ValidationResult(true);
       }
 
       if (validator.value) {
         const cleanValue = String(validator.value).replace(/\s/g, '');
 
-        // Check length (13-19 digits)
-        if (!/^\d{13,19}$/.test(cleanValue)) {
-          return new ValidationResult(false, ['Credit card must be 13-19 digits']);
+        // Check length (13-19 digits) using safe regex
+        if (!safeRegexTestSync(/^\d{13,19}$/, cleanValue)) {
+          return new ValidationResult(false, [
+            'Credit card must be 13-19 digits'
+          ]);
         }
 
         // Check Luhn algorithm
@@ -355,16 +555,25 @@ const validators = {
       .min(minLength, `Password must be at least ${minLength} characters`);
 
     if (requireUppercase) {
-      validator.pattern(/[A-Z]/, 'Password must contain at least one uppercase letter');
+      validator.pattern(
+        /[A-Z]/,
+        'Password must contain at least one uppercase letter'
+      );
     }
     if (requireLowercase) {
-      validator.pattern(/[a-z]/, 'Password must contain at least one lowercase letter');
+      validator.pattern(
+        /[a-z]/,
+        'Password must contain at least one lowercase letter'
+      );
     }
     if (requireNumbers) {
       validator.pattern(/\d/, 'Password must contain at least one number');
     }
     if (requireSpecialChars) {
-      validator.pattern(/[!@#$%^&*(),.?":{}|<>]/, 'Password must contain at least one special character');
+      validator.pattern(
+        /[!@#$%^&*(),.?":{}|<>]/,
+        'Password must contain at least one special character'
+      );
     }
 
     return validator;
@@ -412,9 +621,10 @@ const validate = (schema, data) => {
   for (const [field, validator] of Object.entries(schema)) {
     try {
       const fieldValue = data[field];
-      const result = typeof validator === 'function'
-        ? validator(fieldValue).validate()
-        : validator.validate();
+      const result =
+        typeof validator === 'function'
+          ? validator(fieldValue).validate()
+          : validator.validate();
 
       results[field] = result;
       if (!result.isValid) {
@@ -422,7 +632,9 @@ const validate = (schema, data) => {
       }
     } catch (error) {
       // Handle validation setup errors
-      results[field] = new ValidationResult(false, [`Validation setup error: ${error.message}`]);
+      results[field] = new ValidationResult(false, [
+        `Validation setup error: ${error.message}`
+      ]);
       isValid = false;
     }
   }
@@ -463,13 +675,15 @@ const validateAsync = async (schema, data) => {
       let result;
       if (typeof validator === 'function') {
         const validatorInstance = validator(fieldValue);
-        result = validatorInstance.asyncRules.length > 0
-          ? await validatorInstance.validateAsync()
-          : validatorInstance.validate();
+        result =
+          validatorInstance.asyncRules.length > 0
+            ? await validatorInstance.validateAsync()
+            : validatorInstance.validate();
       } else {
-        result = validator.asyncRules && validator.asyncRules.length > 0
-          ? await validator.validateAsync()
-          : validator.validate();
+        result =
+          validator.asyncRules && validator.asyncRules.length > 0
+            ? await validator.validateAsync()
+            : validator.validate();
       }
 
       results[field] = result;
@@ -478,7 +692,9 @@ const validateAsync = async (schema, data) => {
       }
     } catch (error) {
       // Handle validation setup errors
-      results[field] = new ValidationResult(false, [`Validation setup error: ${error.message}`]);
+      results[field] = new ValidationResult(false, [
+        `Validation setup error: ${error.message}`
+      ]);
       isValid = false;
     }
   }
@@ -503,5 +719,8 @@ module.exports = {
   ValidationResult,
   validators,
   validate,
-  validateAsync
+  validateAsync,
+  safeRegexTest,
+  safeRegexTestSync,
+  isRegexSafe
 };

package/types/index.d.ts

@@ -63,6 +63,7 @@ declare module 'snap-validate' {
     rules: Array<() => ValidationResult>;
     asyncRules: Array<() => Promise<ValidationResult>>;
     isOptional: boolean;
+    regexTimeout: number;
 
     /**
      * Make field required
@@ -74,6 +75,11 @@ declare module 'snap-validate' {
      */
     optional(): BaseValidator;
 
+    /**
+     * Set timeout for regex operations in milliseconds
+     */
+    setRegexTimeout(timeoutMs: number): BaseValidator;
+
     /**
      * Set minimum length/value
      */
@@ -85,10 +91,15 @@ declare module 'snap-validate' {
     max(length: number, message?: string): BaseValidator;
 
     /**
-     * Validate against regex pattern
+     * Validate against regex pattern (synchronous)
      */
     pattern(regex: RegExp, message?: string): BaseValidator;
 
+    /**
+     * Validate against regex pattern with timeout protection (asynchronous)
+     */
+    patternAsync(regex: RegExp, message?: string): BaseValidator;
+
     /**
      * Conditional validation
      */
@@ -177,4 +188,27 @@ declare module 'snap-validate' {
     schema: Schema,
     data: { [key: string]: any }
   ): Promise<SchemaValidationResult>;
+
+  /**
+   * Safely test regex with timeout protection (asynchronous)
+   */
+  export function safeRegexTest(
+    regex: RegExp,
+    str: string,
+    timeoutMs?: number
+  ): Promise<boolean>;
+
+  /**
+   * Safely test regex with input length protection (synchronous)
+   */
+  export function safeRegexTestSync(
+    regex: RegExp,
+    str: string,
+    maxLength?: number
+  ): boolean;
+
+  /**
+   * Check if a regex pattern is safe to use (ReDoS protection)
+   */
+  export function isRegexSafe(regex: RegExp): boolean;
 }