From 3cf0b1cd580bdcfaf4d9a010ed7e30c7a12dc944 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Date: Mon, 13 Jul 2026 05:00:49 -0300
Subject: [PATCH] fix(security): linear-time Basic-auth regex in the dev webdav
 handler (CodeQL js/polynomial-redos #708)

---
 scripts/dev/webdav-handler.mjs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/dev/webdav-handler.mjs b/scripts/dev/webdav-handler.mjs
index 3b0a0893b4..8dfd97b6de 100644
--- a/scripts/dev/webdav-handler.mjs
+++ b/scripts/dev/webdav-handler.mjs
@@ -205,7 +205,7 @@ export function resolveDestinationPath(vaultRoot, destinationHeader) {
 export function verifyBasicAuth(authHeader, expectedUsername, expectedPassword) {
   if (!authHeader || typeof authHeader !== "string") return false;
 
-  const match = /^Basic\s+(.+)$/i.exec(authHeader.trim());
+  const match = /^Basic[ \t]+(\S+)$/i.exec(authHeader.trim()); // linear-time: no overlapping \s+/.+ backtracking (CodeQL js/polynomial-redos #708)
   if (!match) return false;
 
   let decoded;