ticketlens 0.40.0 → 0.40.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -105,7 +105,17 @@ const HARD_REJECT_PATTERNS = [
|
|
|
105
105
|
{ name: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{20,}\b/ },
|
|
106
106
|
];
|
|
107
107
|
|
|
108
|
-
|
|
108
|
+
// Bounded quantifiers (RFC 5321-realistic: 64-char local part, 253-char
|
|
109
|
+
// domain, 24-char TLD — no real email exceeds these) are load-bearing, not
|
|
110
|
+
// cosmetic: an unbounded `+` here is a textbook O(n^2) ReDoS on any long
|
|
111
|
+
// token with no '@' — the unanchored regex tries every starting position,
|
|
112
|
+
// and at each one backtracks the whole remaining length one char at a time
|
|
113
|
+
// before giving up. Found 2026-09-23 via adversarial testing of 49e: a
|
|
114
|
+
// 500KB error message with no '@' hung the process for minutes. Affects
|
|
115
|
+
// every caller of scanForSecrets (note add/patch, Recall push, and now
|
|
116
|
+
// error-reporter.mjs) — fixed once here rather than length-capping each
|
|
117
|
+
// call site, since the regex itself is the actual bug.
|
|
118
|
+
const EMAIL_RE = /[a-zA-Z0-9._%+-]{1,64}@[a-zA-Z0-9.-]{1,253}\.[a-zA-Z]{2,24}/;
|
|
109
119
|
|
|
110
120
|
// Shared between CODE_FILENAME_RE below and FILENAME_REFERENCE_RE further
|
|
111
121
|
// down, the same way WHITESPACE_CLASS is shared across the whitespace
|