From 4c926631540a5a00ea7b825d76c3dcf0be7db330 Mon Sep 17 00:00:00 2001 From: Sharma SK Date: Sat, 27 Jun 2026 14:14:55 +0530 Subject: [PATCH] fix: improve regex comment for URL matching efficiency --- src/egress/index.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/egress/index.ts b/src/egress/index.ts index 86b8a1f..49e458f 100644 --- a/src/egress/index.ts +++ b/src/egress/index.ts @@ -31,7 +31,10 @@ export interface EgressResult { } // Matches markdown images ![alt](url) and bare http/https/ftp URLs. -const URL_RE = /!\[([^\]]*)\]\(\s*([^)\s]+)(?:\s+"[^"]*")?\)|(?:https?|ftp):\/\/[^\s)<>"']+/g; +// Alt excludes '[' and the image URL excludes '(' so a partial "![..." / "![](..." +// start that never completes fails in O(1) instead of re-scanning to the end of the +// input, which would make matching quadratic on adversarial egress text (ReDoS). +const URL_RE = /!\[([^\]\[]*)\]\(\s*([^)\s(]+)(?:\s+"[^"]*")?\)|(?:https?|ftp):\/\/[^\s)<>"']+/g; function urlAllowed(url: string, allowlist: (string | RegExp)[]): boolean { return allowlist.some((entry) => {