fix(runtime): kill polynomial-redos trailing-slash regex in notifications domain (CodeQL high from #3507) (#3510)

The extraction PR moved the legacy `.replace(/\/+$/, '')` verbatim into
domains/notifications.ts, which made it "changed code" and surfaced a
js/polynomial-redos CodeQL alert that the line had latently carried since
ADR-0030. Fix is the same split+filter treatment the security domain
already uses for the identical pattern (its comment even cites the rule).
Side effect: redundant slashes collapse ('//read//' → 'read'), consistent
with the security domain; locked by a new test.

Verified: seam suite 19 tests, runtime 624 green, DTS build green.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang

.changeset/notifications-redos-fix.md

@@ -0,0 +1,12 @@
+---
+"@objectstack/runtime": patch
+---
+
+fix(runtime): replace the polynomial-redos trailing-slash regex in the notifications domain with split+filter (CodeQL high, surfaced by #3507)
+
+The legacy `path.replace(/\/+$/, '')` in the notifications handler had
+carried a polynomial-backtracking regex over request-controlled input since
+ADR-0030; the domain extraction (#3507) made the line "changed code" and
+CodeQL flagged it. Same split+filter treatment the security domain already
+uses for the identical pattern. Redundant slashes in the sub-path now
+collapse (`//read//` → `read`), matching the security domain's semantics.

packages/runtime/src/domain-handler-registry.test.ts

@@ -187,6 +187,14 @@ describe('HttpDispatcher extracted domains (PR-2)', () => {
         expect(notification.listInbox).toHaveBeenCalledWith('u1', expect.objectContaining({ limit: 5 }));
     });
 
+    it('/notifications tolerates redundant slashes in the sub-path (split+filter, CodeQL redos fix)', async () => {
+        const notification = { listInbox: vi.fn(), markRead: vi.fn().mockResolvedValue({ updated: 1 }), markAllRead: vi.fn() };
+        const context: any = { executionContext: { userId: 'u1' } };
+        const result = await makeDispatcher({ notification }).handleNotification('//read//', 'POST', { ids: ['n1'] }, {}, context);
+        expect(result.response?.status).toBe(200);
+        expect(notification.markRead).toHaveBeenCalledWith('u1', ['n1']);
+    });
+
     it('/security responds 503 when no security service is wired (legacy in-handler semantics)', async () => {
         const result = await makeDispatcher().dispatch('GET', '/security/suggested-bindings', undefined, {}, {} as any);
         expect(result.handled).toBe(true);

packages/runtime/src/domains/notifications.ts

@@ -49,7 +49,12 @@ export async function handleNotificationRequest(
     }
 
     const m = method.toUpperCase();
-    const subPath = path.replace(/^\/+/, '').replace(/\/+$/, '');
+    // split+filter drops leading/trailing/duplicate slashes without a regex
+    // over request-controlled input (CodeQL js/polynomial-redos) — same
+    // treatment the security domain got for the identical latent pattern.
+    // Surfaced when the extraction (#3507) made this line "changed code":
+    // the legacy `.replace(/\/+$/, '')` had carried the trap since ADR-0030.
+    const subPath = path.split('/').filter(Boolean).join('/');
 
     // GET /notifications — list the user's inbox joined with read-state.
     if (subPath === '' && m === 'GET') {