amitwh f63a678c88 fix(security): strengthen ReDoS denylist in search-in-files ...

Follow-up to the push-sweep review: the previous UNSAFE_REGEX used
JS bitwise OR (|) between regex literals, accidentally OR-ing the
RegExp objects instead of combining alternatives into one pattern.

Replace with a single RegExp that catches:
- nested quantifiers (a+)+, [a-z]*+
- class + quantifier
- dot-quantifier followed by dot-quantifier
- lookahead / lookbehind (?=, ?!)
- backrefs \1..\9
- alternation + quantifier

Also add MAX_REGEX_LENGTH=200 hard cap. The denylist is still
defense-in-depth — the length, files-traversed, and per-file-byte caps
are the primary defense.

2026-07-23 09:39:08 +05:30

..

commands

feat: enhance WelcomeDialog, export dialogs, GitStatusPanel, add CommandPalette, FindReplaceBar, and new converter dialogs

2026-06-13 19:34:42 +05:30

hooks

style: run prettier formatter over src and tests

2026-06-11 20:46:00 +05:30

lib

feat(renderer): body-class monospace toggle + CSS tokens

2026-07-23 09:34:57 +05:30

main

fix(security): strengthen ReDoS denylist in search-in-files

2026-07-23 09:39:08 +05:30

stores

style: run prettier formatter over src and tests

2026-06-11 20:46:00 +05:30

App.test.tsx

style: run prettier formatter over src and tests

2026-06-11 20:46:00 +05:30