mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
9e198184a7
- Replace polynomial regex /\/+$/ with loop-based stripTrailingSlashes() across 8 enterprise provider configs (azure-openai, azureAi, bedrock, datarobot, oci, sap, watsonx, audioSpeech) — fixes js/polynomial-redos - Add prototype-pollution denylist guard in usageHistory.ts to reject __proto__/constructor/prototype as model keys — fixes js/prototype-polluting-assignment (#167, #168) - Suppress 3 false-positive js/insufficient-password-hash alerts in chatgpt-web.ts and builtins.ts where SHA-256 is used for cache-key derivation, not password storage (#176, #177, #178) - Add stripTrailingSlashes unit tests with ReDoS regression check
15 lines
499 B
TypeScript
15 lines
499 B
TypeScript
/**
|
|
* Strip trailing slash characters from a string without using a regex
|
|
* quantifier on uncontrolled input (avoids CodeQL `js/polynomial-redos`).
|
|
*
|
|
* Equivalent to `value.replace(/\/+$/, "")` but runs in O(n) guaranteed
|
|
* time with no backtracking risk.
|
|
*/
|
|
export function stripTrailingSlashes(value: string): string {
|
|
let end = value.length;
|
|
while (end > 0 && value.charCodeAt(end - 1) === 0x2f /* '/' */) {
|
|
end--;
|
|
}
|
|
return end === value.length ? value : value.slice(0, end);
|
|
}
|