mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
db1f435f55
CodeQL js/polynomial-redos (alerts #765/#766). `/\/+$/` has no left anchor, so the engine retries the match at every start offset and each attempt re-walks the whole slash run before failing `$` — O(n^2) on a connection baseUrl made of many slashes. Measured on the vulnerable code: 10k slashes = 102ms, 30k = 968ms, 60k = 4028ms (clean quadratic); through the public resolvers the same input took 22s. providerSpecificData.baseUrl is operator-supplied config and reaches the trim via isFamilyPresetUrl() -> normalizeEndpoint() and both resolve*Url() helpers, so the input is reachable. Replaces all three identical occurrences with a linear charCodeAt scan. CodeQL only flagged two of them; the third (resolveAlibabaProviderModelsUrl) carries the same defect and is fixed here rather than left behind. Behavior is unchanged: every trailing slash is still removed (not a bounded subset), interior slashes are preserved, and an all-slash string still collapses to empty — asserted by the new behavior test.