fix: handle invalid regex in compileConfig, harden CSP

compileConfig now skips invalid regex patterns instead of crashing.
Added base-uri 'none' to CSP meta tag to prevent base-href injection.
104 tests passing.

Author: bakerboy448

index.html

@@ -4,7 +4,7 @@
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <meta http-equiv="Content-Security-Policy"
-        content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; font-src 'self'">
+        content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; font-src 'self'; base-uri 'none'">
   <title>Docker Compose Sanitizer</title>
   <style>
     :root {

src/config.ts

@@ -42,8 +42,16 @@ export function compileConfig(config: SanitizerConfig): {
   readonly sensitivePatterns: readonly RegExp[]
   readonly safeKeys: ReadonlySet<string>
 } {
+  const compiled: RegExp[] = []
+  for (const p of config.sensitivePatterns) {
+    try {
+      compiled.push(new RegExp(p, 'i'))
+    } catch {
+      // Skip invalid regex patterns — user entered bad syntax in settings
+    }
+  }
   return {
-    sensitivePatterns: config.sensitivePatterns.map(p => new RegExp(p, 'i')),
+    sensitivePatterns: compiled,
     safeKeys: new Set(config.safeKeys),
   }
 }

tests/config.test.ts

@@ -85,6 +85,17 @@ describe('config', () => {
     expect(compiled.safeKeys.has('OTHER')).toBe(false)
   })
 
+  it('compileConfig skips invalid regex patterns gracefully', () => {
+    const config = {
+      sensitivePatterns: ['valid', '[invalid', 'also_valid'],
+      safeKeys: ['PUID'],
+    }
+    const compiled = compileConfig(config)
+    expect(compiled.sensitivePatterns).toHaveLength(2)
+    expect(compiled.sensitivePatterns[0].source).toBe('valid')
+    expect(compiled.sensitivePatterns[1].source).toBe('also_valid')
+  })
+
   it('loadConfig rejects non-string array elements in sensitivePatterns', () => {
     localStorage.setItem('compose-sanitizer-config', JSON.stringify({
       sensitivePatterns: ['valid', 123],