From f9a93f4ea4d5dd0445875b16df81ccacbf2c1eae Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouza.pw@gmail.com>
Date: Tue, 9 Jun 2026 14:42:10 -0300
Subject: [PATCH] fix(opencode-plugin): bound regex quantifiers in
 normaliseFreeLabel (polynomial-ReDoS)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CodeQL js/polynomial-redos: unbounded \s* before an anchored \s*$ allowed
O(n²) backtracking on attacker-influenced display names. Bounded to {0,8}/{1,8}
(ample for any real label spacing). Plugin builds + 254 tests green.
---
 @omniroute/opencode-plugin/src/naming.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/@omniroute/opencode-plugin/src/naming.ts b/@omniroute/opencode-plugin/src/naming.ts
index b125b98fab..f1aa673b06 100644
--- a/@omniroute/opencode-plugin/src/naming.ts
+++ b/@omniroute/opencode-plugin/src/naming.ts
@@ -117,9 +117,12 @@ export function shortProviderLabel(
  * "Claude Opus 4.7"         → "Claude Opus 4.7"  (unchanged)
  */
 export function normaliseFreeLabel(name: string): string {
+  // Bounded whitespace quantifiers ({0,8}/{1,8}) avoid the polynomial-ReDoS
+  // backtracking that unbounded \s* before an anchored \s*$ would allow on
+  // attacker-influenced display names. 8 covers any realistic label spacing.
   const cleaned = name
-    .replace(/\s*\(free\)\s*$/i, "")
-    .replace(/[\s-]+free\s*$/i, "")
+    .replace(/\s{0,8}\(free\)\s{0,8}$/i, "")
+    .replace(/[\s-]{1,8}free\s{0,8}$/i, "")
     .trim();
   const wasFree = cleaned.length < name.trim().length;
   if (!wasFree) return name;