amitwh f63a678c88 fix(security): strengthen ReDoS denylist in search-in-files ...

Follow-up to the push-sweep review: the previous UNSAFE_REGEX used
JS bitwise OR (|) between regex literals, accidentally OR-ing the
RegExp objects instead of combining alternatives into one pattern.

Replace with a single RegExp that catches:
- nested quantifiers (a+)+, [a-z]*+
- class + quantifier
- dot-quantifier followed by dot-quantifier
- lookahead / lookbehind (?=, ?!)
- backrefs \1..\9
- alternation + quantifier

Also add MAX_REGEX_LENGTH=200 hard cap. The denylist is still
defense-in-depth — the length, files-traversed, and per-file-byte caps
are the primary defense.

2026-07-23 09:39:08 +05:30

..

git-handler.test.js

fix(git): git-status IPC returns a flat array, not wrapped object

2026-07-23 09:34:57 +05:30

list-directory.test.js

fix: list-directory returns flat array, drop defensive fallback

2026-07-23 09:34:57 +05:30

search-in-files.test.js

fix(security): strengthen ReDoS denylist in search-in-files

2026-07-23 09:39:08 +05:30