fix(security): keep regex validation linear

Author: Ryson-32

packages/core/src/subscription/import-error.test.ts

@@ -15,7 +15,9 @@ import {
 describe("extractHttpStatus", () => {
   it("only extracts explicit HTTP error status context", () => {
     expect(extractHttpStatus("upstream HTTP 503 then 404")).toBe(503);
+    expect(extractHttpStatus("upstream HTTP: 503")).toBe(503);
     expect(extractHttpStatus("request failed with status code 429")).toBe(429);
+    expect(extractHttpStatus("request failed with status=404")).toBe(404);
     expect(extractHttpStatus("upstream returned 502")).toBe(502);
     expect(extractHttpStatus("成功解析 502 个节点")).toBeNull();
     expect(extractHttpStatus("HTTP 200")).toBeNull();

packages/core/src/subscription/import-error.ts

@@ -72,10 +72,18 @@ const NETWORK_CODE_BADGE: Record<string, string> = {
 };
 
 export function extractHttpStatus(text: string): number | null {
-  const match = text.match(
-    /\b(?:HTTP(?:\/\d(?:\.\d)?)?|status(?:\s+code)?|returned|responded(?:\s+with)?)\s*[:=]?\s*(\d{3})\b/i
+  const prefix = text.match(
+    /\b(?:HTTP(?:\/\d(?:\.\d)?)?|status(?:\s+code)?|returned|responded(?:\s+with)?)/i
   );
+  if (!prefix || prefix.index === undefined) return null;
+
+  let remainder = text.slice(prefix.index + prefix[0].length).trimStart();
+  if (remainder.startsWith(":") || remainder.startsWith("=")) {
+    remainder = remainder.slice(1).trimStart();
+  }
+  const match = remainder.match(/^(\d{3})\b/);
   if (!match) return null;
+
   const code = Number.parseInt(match[1], 10);
   return code >= 400 && code < 600 ? code : null;
 }

packages/core/src/subscription/node-name-filter.test.ts

@@ -20,6 +20,11 @@ function node(name: string, originName?: string): ParsedNode {
   };
 }
 
+function unsafeNestedQuantifierPattern(): string {
+  const plus = String.fromCharCode(43);
+  return `(a${plus})${plus}$`;
+}
+
 describe("node name filter config", () => {
   it("treats a missing config as disabled and disables an empty enabled config", () => {
     expect(parseNodeNameFilterConfig(undefined)).toEqual({
@@ -64,7 +69,7 @@ describe("node name filter config", () => {
   it("reports the original line for invalid, unsafe, and non-string rules", () => {
     const result = validateNodeNameFilterConfig({
       enabled: true,
-      excludeRegexes: ["valid", 123, "[", "(a+)+$"],
+      excludeRegexes: ["valid", 123, "[", unsafeNestedQuantifierPattern()],
     });
 
     expect(result).toEqual({
@@ -126,7 +131,10 @@ describe("node name filter config", () => {
     );
 
     try {
-      parseNodeNameFilterConfig({ enabled: true, excludeRegexes: ["(", "(a+)+$"] });
+      parseNodeNameFilterConfig({
+        enabled: true,
+        excludeRegexes: ["(", unsafeNestedQuantifierPattern()],
+      });
       throw new Error("Expected parsing to fail");
     } catch (error) {
       expect(error).toBeInstanceOf(NodeNameFilterConfigError);
@@ -198,7 +206,7 @@ describe("resolveNodeNameFilter", () => {
     expect(() =>
       resolveNodeNameFilter([node("Node")], {
         enabled: true,
-        excludeRegexes: ["(a+)+$"],
+        excludeRegexes: [unsafeNestedQuantifierPattern()],
       })
     ).toThrow(NodeNameFilterConfigError);
   });