tempest-react-sdk 0.81.0 → 0.83.0

package/bin/lib/openapi/generate.hostile.test.mjs

@@ -672,3 +672,231 @@ describe("generate — names that collide with what the generator itself declare
         );
     });
 });
+
+describe("generate — spec text that would leave its place in the output (#533)", () => {
+    const ESC_TAG = "items\u001b]0;PWNED\u0007\u009b31m\r";
+    const POST_BODY = {
+        "/a": { post: { tags: ["t"], requestBody: JSON_BODY("Body"), responses: OK } },
+    };
+
+    it("a path key that is an absolute URL is refused, so no method calls another origin", () => {
+        expect(() =>
+            generate(spec({ "https://other.example/x": { get: { tags: ["t"], responses: OK } } })),
+        ).toThrow(/path "https:\/\/other\.example\/x" does not start with "\/"/);
+    });
+
+    it.each(["/../x", "/a/./b", "/a/..", "/%2e%2E/x", "/a\\..\\x", "/./x?y=1"])(
+        "a path key with a dot segment (%s) is refused, so it cannot climb out of the baseURL path",
+        (path) => {
+            expect(() =>
+                generate(spec({ [path]: { get: { tags: ["t"], responses: OK } } })),
+            ).toThrow(/has a "\." or "\.\." segment/);
+        },
+    );
+
+    it("dots inside a segment, dots in the query and a doubled slash still generate", () => {
+        const { files } = generate(
+            spec({
+                "/v1.2/..cache/file.json": { get: { tags: ["t"], responses: OK } },
+                "//double/slash": { get: { tags: ["t"], responses: OK } },
+                "/search?q=..": { get: { tags: ["t"], responses: OK } },
+            }),
+        );
+        expect(files["t/service.ts"]).toContain('"/v1.2/..cache/file.json"');
+        expect(files["t/service.ts"]).toContain('"/search?q=.."');
+    });
+
+    it("a property named __proto__ is refused instead of silently vanishing from the Zod shape", () => {
+        const Body = JSON.parse(
+            '{"type":"object","required":["__proto__"],"properties":{"__proto__":{"type":"string"}}}',
+        );
+        expect(() => generate(spec(POST_BODY, { Body }))).toThrow(
+            /schema "Body" at \(root\): a property named "__proto__" cannot be validated/,
+        );
+    });
+
+    it("a default value with a nested __proto__ key is refused", () => {
+        const Body = JSON.parse(
+            '{"type":"object","properties":{"meta":{"type":"object","default":{"a":{"__proto__":{"admin":true}}}}}}',
+        );
+        expect(() => generate(spec(POST_BODY, { Body }))).toThrow(
+            /schema "Body" at properties\.meta: the default value has a "__proto__" key/,
+        );
+    });
+
+    const KEYWORD_NAMES = [
+        "pattern",
+        "default",
+        "enum",
+        "items",
+        "properties",
+        "additionalProperties",
+        "allOf",
+        "anyOf",
+        "oneOf",
+        "required",
+        "type",
+        "$ref",
+    ];
+
+    /**
+     * A `Body` schema with one property, named `name`, whose schema is `inner`.
+     *
+     * @param {string} name - The property name, often a JSON Schema keyword.
+     * @param {object} inner - The property's schema.
+     * @returns {object} The spec.
+     */
+    function keywordNamedProperty(name, inner) {
+        return spec(POST_BODY, {
+            Body: { type: "object", required: [name], properties: { [name]: inner } },
+        });
+    }
+
+    it.each(KEYWORD_NAMES)(
+        "a property named %s holding a required __proto__ is refused, naming where it sits (#562)",
+        (name) => {
+            const inner = JSON.parse(
+                '{"type":"object","required":["__proto__"],"properties":{"__proto__":{"type":"string"}}}',
+            );
+            expect(() => generate(keywordNamedProperty(name, inner))).toThrow(
+                `schema "Body" at properties.${name}: a property named "__proto__" cannot be validated`,
+            );
+        },
+    );
+
+    it.each(KEYWORD_NAMES)(
+        "a property named %s whose schema has a __proto__ default is refused at that property (#562)",
+        (name) => {
+            const inner = JSON.parse('{"type":"object","default":{"__proto__":{"admin":true}}}');
+            expect(() => generate(keywordNamedProperty(name, inner))).toThrow(
+                `schema "Body" at properties.${name}: the default value has a "__proto__" key`,
+            );
+        },
+    );
+
+    it.each(KEYWORD_NAMES)(
+        "an invalid regex under a property named %s fails generation (#562)",
+        (name) => {
+            const inner = {
+                type: "object",
+                properties: { code: { type: "string", pattern: "(" } },
+            };
+            expect(() => generate(keywordNamedProperty(name, inner))).toThrow(
+                `schema "Body" at properties.${name}.properties.code: pattern "(" is not a valid`,
+            );
+        },
+    );
+
+    it.each(KEYWORD_NAMES)(
+        "a nested-quantifier pattern under a property named %s comes back as a warning (#562)",
+        (name) => {
+            const inner = { type: "string", pattern: "^(a+)+$" };
+            const { warnings } = generate(keywordNamedProperty(name, inner));
+            expect(warnings).toHaveLength(1);
+            expect(warnings[0]).toContain(`schema "Body" at properties.${name}: pattern`);
+        },
+    );
+
+    it("properties named after keywords generate, typecheck and are each validated (#562)", () => {
+        const properties = Object.fromEntries(
+            KEYWORD_NAMES.map((name) => [name, { type: "string", minLength: 2 }]),
+        );
+        const generated = spec(POST_BODY, {
+            Body: { type: "object", required: KEYWORD_NAMES, properties },
+        });
+        const { files, warnings } = generate(generated);
+        expect(warnings).toEqual([]);
+        expect(typecheck(files, "t")).toEqual([]);
+        const schemas = evaluate(files["t/schemas.ts"], vm.createContext({}), {});
+        const valid = Object.fromEntries(KEYWORD_NAMES.map((name) => [name, "ok"]));
+        expect(schemas.BodySchema.safeParse(valid).success).toBe(true);
+        for (const name of KEYWORD_NAMES) {
+            expect(schemas.BodySchema.safeParse({ ...valid, [name]: {} }).success).toBe(false);
+        }
+    });
+
+    it("properties called constructor or prototype still generate and are validated", () => {
+        const { files } = generate(
+            spec(POST_BODY, {
+                Body: {
+                    type: "object",
+                    required: ["constructor"],
+                    properties: {
+                        constructor: { type: "string" },
+                        prototype: { type: "string" },
+                    },
+                },
+            }),
+        );
+        const schemas = evaluate(files["t/schemas.ts"], vm.createContext({}), {});
+        expect(schemas.BodySchema.safeParse({ constructor: 1 }).success).toBe(false);
+        expect(schemas.BodySchema.safeParse({ constructor: "x" }).success).toBe(true);
+    });
+
+    it("a nested-quantifier pattern still generates and comes back as a warning naming the schema", () => {
+        const { files, warnings } = generate(
+            spec(POST_BODY, {
+                Body: {
+                    type: "object",
+                    properties: {
+                        slug: { type: "string", pattern: "^([a-z0-9]+-)*[a-z0-9]+$" },
+                        evil: { type: "string", pattern: "^(a+)+$" },
+                    },
+                },
+            }),
+        );
+        expect(files["t/schemas.ts"]).toContain('new RegExp("^(a+)+$")');
+        expect(warnings).toHaveLength(1);
+        expect(warnings[0]).toMatch(/schema "Body" at properties\.evil: pattern "\^\(a\+\)\+\$"/);
+    });
+
+    it("terminal control characters in a tag do not reach the generated doc comment", () => {
+        const { files, tags } = generate(
+            spec({ "/a": { get: { tags: [ESC_TAG], responses: OK } } }),
+        );
+        const service = Object.entries(files).find(([f]) => f.endsWith("/service.ts"))[1];
+        expect(tags).toEqual([ESC_TAG]);
+        expect(service).not.toMatch(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/);
+        expect(service).toContain('the "items]0;PWNED31m " routes');
+    });
+
+    it("the folder and class reported for each group are the ones written", () => {
+        const { files, services } = generate(
+            spec({ "/a": { get: { tags: ["Items API"], responses: OK } } }),
+        );
+        expect(services).toEqual([{ slug: "items-api", className: "ItemsApiService" }]);
+        expect(files["items-api/service.ts"]).toContain("export class ItemsApiService");
+    });
+
+    it("the output for a spec with control characters and a flagged pattern typechecks", () => {
+        const { files } = generate(
+            spec(
+                {
+                    "/a/{id}": {
+                        post: {
+                            tags: ["t"],
+                            summary: "x\u001b[2J\u009d8;;https://evil/\u009c",
+                            parameters: [
+                                {
+                                    name: "id",
+                                    in: "path",
+                                    required: true,
+                                    schema: { type: "string" },
+                                },
+                            ],
+                            requestBody: JSON_BODY("Body"),
+                            responses: OK,
+                        },
+                    },
+                },
+                {
+                    Body: {
+                        type: "object",
+                        properties: { evil: { type: "string", pattern: "(\\w+\\s?)*" } },
+                    },
+                },
+            ),
+        );
+        expect(typecheck(files, "t")).toEqual([]);
+    });
+});

package/bin/lib/openapi/generate.mjs

@@ -1,6 +1,13 @@
 // OpenAPI 3.x → per-tag { schemas.ts (Zod), types.ts, service.ts (class) }.
 // Pure: takes the parsed spec object, returns a { path: contents } map. No I/O.
-import { assertNoCollision, commentText, toIdentifier, urlTemplate } from "./escape.mjs";
+import {
+    assertNoCollision,
+    assertSafePath,
+    commentText,
+    toIdentifier,
+    urlTemplate,
+} from "./escape.mjs";
+import { hasNestedQuantifier } from "./pattern-risk.mjs";
 import { refName, schemaToZod, typeName, zodName } from "./schema-to-zod.mjs";
 
 const HTTP_METHODS = ["get", "post", "put", "patch", "delete"];
@@ -157,37 +164,123 @@ function isSegmentScalar(schema, schemas, depth = 0) {
 }
 
 /**
- * Check every `pattern` in a schema compiles as a JavaScript regex.
+ * Whether a JSON value has an own key `__proto__` at any depth.
  *
- * The generated Zod schema builds it with `new RegExp(...)` when the module is
- * imported, so an invalid one would only surface in the app at runtime — a blank
- * screen. Failing here names the schema and where in it the pattern sits.
+ * @param {unknown} value - A value parsed from the spec.
+ * @returns {boolean}
+ */
+function hasProtoKey(value) {
+    if (!value || typeof value !== "object") return false;
+    if (Object.hasOwn(value, "__proto__")) return true;
+    return Object.values(value).some(hasProtoKey);
+}
+
+/**
+ * Keywords whose value maps a name the spec author picked to a sub-schema.
+ *
+ * Their keys are data, not keywords: a property may be called `pattern`,
+ * `default` or `$ref`. {@link checkSchema} walks into every entry as a schema
+ * and never reads the map itself as one — it used to, so a property named
+ * `pattern` or `default` was skipped as if it were the keyword, and its schema
+ * escaped every check below (#562).
+ */
+const SCHEMA_MAPS = new Set([
+    "properties",
+    "patternProperties",
+    "dependentSchemas",
+    "$defs",
+    "definitions",
+]);
+
+/**
+ * Check a component schema before it is turned into Zod source.
+ *
+ * - Every `pattern` must compile as a JavaScript regex. The generated schema
+ *   builds it with `new RegExp(...)` when the module is imported, so an invalid
+ *   one would only surface in the app at runtime — a blank screen.
+ * - A `pattern` with the nested-quantifier shape ({@link hasNestedQuantifier})
+ *   is pushed to `warnings`: it compiles, and it can freeze the tab on one
+ *   crafted value, but a heuristic does not get to fail the run.
+ * - A property, or a key inside a `default`, named `__proto__` is refused. The
+ *   generated source is an object literal, where `"__proto__": ...` sets the
+ *   prototype instead of adding a key: the field vanished from the Zod shape and
+ *   the value went unvalidated, and Zod 4 drops the key even when it is written
+ *   as a computed `["__proto__"]` (measured on 4.6.7: a required `__proto__:
+ *   z.string()` accepted `{}` and `5`). There is no source that validates it, so
+ *   the spec is refused (#533).
+ *
+ * Every failure names the schema and where in it the problem sits.
+ *
+ * The walk reaches every sub-schema. Only a schema's own `pattern` string and
+ * `default` value are not walked as schemas — the checks above read them — and
+ * the entries of a {@link SCHEMA_MAPS} keyword are always walked, whatever the
+ * property is called (#562).
  *
  * @param {unknown} node - The schema (sub)node.
- * @param {string} schema - The component schema name, for the error.
+ * @param {string} schema - The component schema name, for the messages.
+ * @param {string[]} warnings - Collects the non-fatal findings.
  * @param {string[]} [at] - Keys from the schema root to `node`.
- * @throws {Error} When a pattern does not compile.
+ * @throws {Error} When a pattern does not compile, or a `__proto__` key would be
+ *   emitted.
  */
-function assertPatterns(node, schema, at = []) {
+function checkSchema(node, schema, warnings, at = []) {
     if (!node || typeof node !== "object") return;
+    const where = `OpenAPI schema ${JSON.stringify(schema)} at ${at.join(".") || "(root)"}`;
     if (typeof node.pattern === "string") {
         try {
             new RegExp(node.pattern);
         } catch (err) {
             throw new Error(
-                `OpenAPI schema ${JSON.stringify(schema)} at ${at.join(".") || "(root)"}: pattern ${JSON.stringify(node.pattern)} is not a valid JavaScript regular expression (${err.message}).`,
+                `${where}: pattern ${JSON.stringify(node.pattern)} is not a valid JavaScript regular expression (${err.message}).`,
+            );
+        }
+        if (hasNestedQuantifier(node.pattern)) {
+            warnings.push(
+                `${where}: pattern ${JSON.stringify(node.pattern)} repeats a group that ends in a repetition; it can backtrack exponentially on a near-miss value and freeze the tab that validates it.`,
             );
         }
     }
+    if (
+        node.properties &&
+        typeof node.properties === "object" &&
+        Object.hasOwn(node.properties, "__proto__")
+    ) {
+        throw new Error(
+            `${where}: a property named "__proto__" cannot be validated — in the generated object literal it sets the prototype instead of declaring the field. Rename it in the spec.`,
+        );
+    }
+    if (hasProtoKey(node.default)) {
+        throw new Error(
+            `${where}: the default value has a "__proto__" key, which the generated object literal would turn into its prototype. Remove it from the spec.`,
+        );
+    }
     for (const [key, value] of Object.entries(node)) {
-        if (key !== "pattern") assertPatterns(value, schema, [...at, key]);
+        if (SCHEMA_MAPS.has(key) && value && typeof value === "object" && !Array.isArray(value)) {
+            for (const [name, sub] of Object.entries(value)) {
+                checkSchema(sub, schema, warnings, [...at, key, name]);
+            }
+        } else if (key !== "pattern" && key !== "default") {
+            checkSchema(value, schema, warnings, [...at, key]);
+        }
     }
 }
 
-/** Collect component-schema names referenced (transitively) by a schema node. */
+/**
+ * Collect component-schema names referenced (transitively) by a schema node.
+ *
+ * Only a string `$ref` is a reference: inside `properties`, `$ref` can be a
+ * property name whose value is a schema, and reading it as a reference crashed
+ * the run with `ref.lastIndexOf is not a function` (#562).
+ *
+ * @param {unknown} node - The schema (sub)node.
+ * @param {Record<string, object>} schemas - `components.schemas`.
+ * @param {Set<string>} [acc] - Collects the referenced names.
+ * @param {Set<string>} [seen] - Names already expanded, against cycles.
+ * @returns {Set<string>} `acc`.
+ */
 function collectRefs(node, schemas, acc = new Set(), seen = new Set()) {
     if (!node || typeof node !== "object") return acc;
-    if (node.$ref) {
+    if (typeof node.$ref === "string") {
         const name = refName(node.$ref);
         if (!acc.has(name)) {
             acc.add(name);
@@ -432,8 +525,15 @@ function compareNames(a, b) {
  * because a browser `fetch` cannot set `Cookie` — the browser sends its own
  * cookies with `credentials`, which is how a cookie parameter reaches the server.
  *
+ * Every path key that has an operation goes through {@link assertSafePath}, and
+ * every emitted component schema through {@link checkSchema}: spec text that
+ * would turn into a call to another origin, or into an object literal whose
+ * prototype the spec picks, fails the run before anything is written (#533).
+ *
  * @param {object} doc - The parsed OpenAPI 3.x spec.
- * @returns {{ files: Record<string, string>, tags: string[] }}
+ * @returns {{ files: Record<string, string>, tags: string[], services: { slug: string, className: string }[], warnings: string[] }}
+ *   The files by relative path; each group's spec tag, folder and service class
+ *   (in the same order); and the non-fatal findings the CLI prints.
  */
 export function generate(doc) {
     const schemas = doc.components?.schemas ?? {};
@@ -444,6 +544,7 @@ export function generate(doc) {
         for (const method of HTTP_METHODS) {
             const op = item[method];
             if (!op) continue;
+            assertSafePath(path);
             const tag = op.tags?.[0] ?? "default";
             const slug = tagSlug(tag);
             if (!groups.has(slug)) groups.set(slug, { tag, slug, ops: [] });
@@ -459,10 +560,13 @@ export function generate(doc) {
 
     const files = {};
     const tags = [];
+    const services = [];
+    const warnings = [];
 
     for (const { tag, slug, ops } of groups.values()) {
         tags.push(tag);
         const Class = `${slugIdent(pascal(slug))}Service`;
+        services.push({ slug, className: Class });
 
         const usedNames = new Set(CLASS_MEMBERS);
         const signature = { refs: new Set(), validates: false, sendsHeaders: false };
@@ -483,7 +587,7 @@ export function generate(doc) {
             sorted.map((n) => [n, typeName(n)]),
             "schema names",
         );
-        for (const name of sorted) assertPatterns(schemas[name], name);
+        for (const name of sorted) checkSchema(schemas[name], name, warnings);
 
         const schemaLines = sorted.map((name) => {
             const expr = schemaToZod(schemas[name], (ref) => {
@@ -542,7 +646,7 @@ export function generate(doc) {
             .map((slug) => `export * as ${slugIdent(slug)} from "./${slug}";`)
             .join("\n") + "\n";
 
-    return { files, tags };
+    return { files, tags, services, warnings };
 }
 
 /**

package/bin/lib/openapi/pattern-risk.mjs

@@ -0,0 +1,134 @@
+/**
+ * Static check for the regular expressions a spec's `pattern` keywords become.
+ *
+ * The generated Zod schema compiles each `pattern` with `new RegExp(...)` and
+ * runs it on every value the app validates. V8 backtracks, so a pattern with a
+ * repeated group whose body can itself match a variable amount — `^(a+)+$` — is
+ * exponential on a near-miss input: 28 characters took 873 ms and every extra
+ * one doubles it (Node 24.15, `/^(a+)+$/.test("a".repeat(28) + "!")`). The app
+ * tab freezes on its own data. A spec is input the developer does not control,
+ * so `tempest gen api` flags such a pattern when it generates the schema (#533).
+ */
+
+/**
+ * Parse the quantifier starting at `pattern[i]`, if any.
+ *
+ * @param {string} pattern - The regex source.
+ * @param {number} i - Index right after an atom.
+ * @returns {{ min: number, max: number, length: number } | null} The bounds
+ *   (`max` is `Infinity` when unbounded) and how many characters the quantifier
+ *   spans, its lazy `?` included; `null` when no quantifier starts there.
+ */
+function quantifierAt(pattern, i) {
+    const ch = pattern[i];
+    let q = null;
+    if (ch === "*") q = { min: 0, max: Infinity, length: 1 };
+    else if (ch === "+") q = { min: 1, max: Infinity, length: 1 };
+    else if (ch === "?") q = { min: 0, max: 1, length: 1 };
+    else if (ch === "{") {
+        const m = /^\{(\d+)(,(\d*))?\}/.exec(pattern.slice(i));
+        if (m) {
+            const min = Number(m[1]);
+            const max = m[2] === undefined ? min : m[3] === "" ? Infinity : Number(m[3]);
+            q = { min, max, length: m[0].length };
+        }
+    }
+    if (q && pattern[i + q.length] === "?") q.length += 1;
+    return q;
+}
+
+/**
+ * Index right after the character class that opens at `pattern[i]` (`[`).
+ *
+ * @param {string} pattern - The regex source.
+ * @param {number} i - Index of the `[`.
+ * @returns {number} Index after the closing `]`, or the pattern's length.
+ */
+function classEnd(pattern, i) {
+    let j = i + 1;
+    while (j < pattern.length && pattern[j] !== "]") j += pattern[j] === "\\" ? 2 : 1;
+    return j + 1;
+}
+
+/**
+ * Length of a group's opening syntax at `pattern[i]` (`(`, `(?:`, `(?=`,
+ * `(?<name>`, ...), so its `?` is not read as a quantifier.
+ *
+ * @param {string} pattern - The regex source.
+ * @param {number} i - Index of the `(`.
+ * @returns {number} Characters to skip.
+ */
+function groupOpenLength(pattern, i) {
+    if (pattern[i + 1] !== "?") return 1;
+    if (pattern[i + 2] === "<" && pattern[i + 3] !== "=" && pattern[i + 3] !== "!") {
+        const close = pattern.indexOf(">", i);
+        return close === -1 ? 1 : close - i + 1;
+    }
+    return pattern[i + 2] === "<" ? 4 : 3;
+}
+
+/**
+ * Whether a regex source has a repeated group whose body ends in a
+ * variable-length repetition — the nested-quantifier shape behind most
+ * catastrophic backtracking (`(a+)+`, `(\w+\s?)*`, `((x*))+`).
+ *
+ * "Ends in" is what keeps the common safe patterns quiet: in
+ * `^([a-z0-9]+-)*[a-z0-9]+$` every iteration must end on the mandatory `-`, so
+ * the inner `+` cannot trade characters with the next iteration and the group is
+ * not flagged; only optional atoms (`?`, `*`, `{0,n}`) may follow the inner
+ * repetition for the group to count. Fixed counts (`(\d{3})+`) are not variable
+ * and do not count.
+ *
+ * This is a heuristic for one shape, not a proof of safety: overlapping
+ * alternation (`(a|aa)+`) and backreferences are not analysed. A flag is a
+ * warning to read the pattern, not a verdict.
+ *
+ * @param {string} pattern - The regex source from the spec.
+ * @returns {boolean} `true` when the nested-quantifier shape is present.
+ */
+export function hasNestedQuantifier(pattern) {
+    const frames = [{ tail: false, anyAlternative: false }];
+    let i = 0;
+    while (i < pattern.length) {
+        const ch = pattern[i];
+        const frame = frames[frames.length - 1];
+        if (ch === "|") {
+            frame.anyAlternative ||= frame.tail;
+            frame.tail = false;
+            i += 1;
+            continue;
+        }
+        if (ch === "(") {
+            frames.push({ tail: false, anyAlternative: false });
+            i += groupOpenLength(pattern, i);
+            continue;
+        }
+        let groupTail = false;
+        let isGroup = false;
+        if (ch === ")") {
+            if (frames.length === 1) {
+                i += 1;
+                continue;
+            }
+            const closed = frames.pop();
+            groupTail = closed.anyAlternative || closed.tail;
+            isGroup = true;
+            i += 1;
+        } else if (ch === "[") {
+            i = classEnd(pattern, i);
+        } else if (ch === "\\") {
+            i += 2;
+        } else {
+            i += 1;
+        }
+        const outer = frames[frames.length - 1];
+        const q = quantifierAt(pattern, i);
+        if (q) i += q.length;
+        const repeats = q !== null && q.max > 1;
+        if (isGroup && groupTail && repeats) return true;
+        const variable = repeats && q.max > q.min;
+        if (variable || (isGroup && groupTail && !repeats)) outer.tail = true;
+        else if (!q || q.min > 0) outer.tail = false;
+    }
+    return false;
+}

package/bin/lib/openapi/pattern-risk.test.mjs

@@ -0,0 +1,45 @@
+import { describe, expect, it } from "vitest";
+
+import { hasNestedQuantifier } from "./pattern-risk.mjs";
+
+describe("hasNestedQuantifier — flags the repeated-repetition shape (#533)", () => {
+    it.each([
+        "^(a+)+$",
+        "^(a*)*$",
+        "(\\w+\\s?)*",
+        "^((x+))+$",
+        "(?:a+){2,}",
+        "(?<word>\\d+)+",
+        "^(a|b+)*$",
+        "(a{1,5})+",
+    ])("%s is flagged", (pattern) => {
+        expect(hasNestedQuantifier(pattern)).toBe(true);
+    });
+
+    it.each([
+        "^[a-z]+$",
+        "^([a-z0-9]+-)*[a-z0-9]+$",
+        "^(\\d{3})+$",
+        "^(ab)+$",
+        "^(a+)$",
+        "^(a+)?$",
+        "[(a+)+]",
+        "\\(a+\\)+",
+        "^(?=a+)b$",
+        "^\\d{5}-?\\d{3}$",
+        "^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$",
+        ")a+(",
+    ])("%s is not flagged", (pattern) => {
+        expect(hasNestedQuantifier(pattern)).toBe(false);
+    });
+
+    it("the flagged shape really is exponential in V8, so the warning is not theoretical", () => {
+        const time = (n) => {
+            const start = performance.now();
+            /^(a+)+$/.test(`${"a".repeat(n)}!`);
+            return performance.now() - start;
+        };
+        time(14);
+        expect(time(22)).toBeGreaterThan(time(14) * 4);
+    });
+});