wehub-resource-sync
29 lines
1.2 KiB
TypeScript
29 lines
1.2 KiB
TypeScript
import { describe, it } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
import { discoverNormalizeLine } from "../../../open-sse/services/compression/engines/rtk/discover.ts";
|
|
|
|
describe("RTK discover — ReDoS safety (CLAUDE.md regex rule)", () => {
|
|
it("normalizes a long word-char line with no '@' in bounded time", () => {
|
|
// The package@version regex used to be /[\w][\w.-]*@.../ — catastrophic
|
|
// backtracking on a long word-char run lacking '@'. Bounded quantifiers fix it.
|
|
const pathological = "a".repeat(100_000); // 100k word chars, no '@'
|
|
const start = performance.now();
|
|
const out = discoverNormalizeLine(pathological);
|
|
const elapsedMs = performance.now() - start;
|
|
assert.ok(typeof out === "string");
|
|
assert.ok(
|
|
elapsedMs < 1000,
|
|
`discoverNormalizeLine took ${elapsedMs.toFixed(0)}ms (ReDoS regression — must be < 1000ms)`
|
|
);
|
|
});
|
|
|
|
it("still normalizes real package@version templates", () => {
|
|
assert.equal(discoverNormalizeLine("left-pad@1.2.3"), "<PKG>@<N>");
|
|
assert.equal(
|
|
discoverNormalizeLine("npm WARN deprecated foo@2.0.0: msg"),
|
|
"npm WARN deprecated <PKG>@<N>: msg"
|
|
);
|
|
});
|
|
});
|