fix: avoid ReDoS in packagist name validation

Signed-off-by: anilb <epipav@gmail.com>

Author: epipav

services/apps/packages_worker/src/packagist/__tests__/listPackages.test.ts

@@ -47,6 +47,17 @@ describe('parsePackagistPackageList', () => {
     expect(invalid).toBe(7)
   })
 
+  it('rejects a long invalid segment without catastrophic regex backtracking', () => {
+    // CodeQL js/redos: a long run of one char class followed by a char that breaks
+    // the match is the classic trigger for exponential backtracking.
+    const pathological = 'vendor/' + '0'.repeat(50) + '!'
+    const start = Date.now()
+    const { entries, invalid } = parsePackagistPackageList({ packageNames: [pathological] })
+    expect(Date.now() - start).toBeLessThan(200)
+    expect(entries).toEqual([])
+    expect(invalid).toBe(1)
+  })
+
   it('lowercases and deduplicates names without counting duplicates as invalid', () => {
     const { entries, invalid } = parsePackagistPackageList({
       packageNames: ['Monolog/Monolog', 'monolog/monolog'],

services/apps/packages_worker/src/packagist/listPackages.ts

@@ -4,7 +4,10 @@ import { buildPackagistUserAgent, describeFetchFailure, packagistDispatcher } fr
 import type { FetchError } from './types'
 
 const PACKAGIST_LIST = 'https://packagist.org/packages/list.json'
-const COMPOSER_NAME_REGEX = /^[a-z0-9]([_.-]?[a-z0-9]+)*$/
+// Non-backtracking form: a mandatory separator per repetition (vs. an optional one)
+// removes the ambiguity that let the old `([_.-]?[a-z0-9]+)*` pattern backtrack
+// exponentially on a long run of the same character class (CodeQL js/redos).
+const COMPOSER_NAME_REGEX = /^[a-z0-9]+(?:[_.-][a-z0-9]+)*$/
 
 export interface PackagistListEntry {
   vendor: string