fix(storage): parse resolver URLs structurally instead of with a backtracking regex

CodeQL js/polynomial-redos: the resolver-URL pattern was anchored only at the
tail, so the engine retried from every start position. The values it scans come
straight out of tenant records, so a value repeating the matched prefix turns
that into a polynomial blowup on attacker-influenced data.

Replaced with slicing and splitting — linear in the URL's length whatever it
contains, and clearer about what it actually accepts. Covered by a timing
regression on an adversarial value plus a table of accepted shapes and
near-misses.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SHpGw3GBA9aFpfwVArRWfd

Author: claude

packages/services/service-storage/src/backfill-file-references.test.ts

@@ -231,6 +231,54 @@ describe('backfillFileReferences (ADR-0104 D3 wave 2)', () => {
     expect(report.scannedObjects).toEqual(['product']);
   });
 
+  /**
+   * The values scanned here come straight out of tenant records, so URL
+   * matching must not be able to backtrack. A pattern anchored only at the tail
+   * retries from every start position, which a value repeating the matched
+   * prefix turns into a polynomial blowup (CodeQL js/polynomial-redos).
+   */
+  it('matches resolver URLs in linear time on an adversarial value', async () => {
+    // Many repetitions of the matched prefix, ending in a segment that is not
+    // an id token — the shape that makes a tail-anchored pattern retry from
+    // every start position.
+    const hostile = '/storage/files/'.repeat(6000) + '!';
+    const engine = fakeEngine({ product: [{ id: 'p1', image: hostile }], sys_file: [] });
+
+    const started = process.hrtime.bigint();
+    const report = await run(engine, {});
+    const elapsedMs = Number(process.hrtime.bigint() - started) / 1e6;
+
+    // Not a reference (the trailing segment is not an id token) — and reaching
+    // that verdict must not depend on how many times the prefix repeats.
+    expect(report.converted).toBe(0);
+    expect(elapsedMs).toBeLessThan(1000);
+  });
+
+  it('accepts the resolver URL shapes and rejects near-misses', async () => {
+    const engine = fakeEngine({
+      product: [
+        { id: 'p1', image: 'https://app.example.com/api/v1/storage/files/aaa' },
+        { id: 'p2', image: '/api/v1/storage/files/bbb/url' },
+        { id: 'p3', image: '/api/v1/storage/files/ccc?v=2' },
+        { id: 'p4', image: '/api/v1/storage/files/ddd/' },
+        { id: 'p5', image: 'https://cdn.example.com/files/eee' }, // no /storage
+        { id: 'p6', image: '/api/v1/storage/files/' }, // no id
+      ],
+      sys_file: [],
+    });
+
+    await run(engine, { apply: true });
+
+    expect(engine.tables.product.map((r) => r.image)).toEqual([
+      'aaa',
+      'bbb',
+      'ccc',
+      'ddd',
+      'https://cdn.example.com/files/eee',
+      '/api/v1/storage/files/',
+    ]);
+  });
+
   it('pages through large objects and flags truncation at the bound', async () => {
     const many = Array.from({ length: 500 }, (_, i) => ({
       id: `p${i}`,

packages/services/service-storage/src/backfill-file-references.ts

@@ -41,8 +41,6 @@ import type { IStorageService } from '@objectstack/spec/contracts';
 const SYSTEM_CTX = { isSystem: true } as const;
 const SCAN_PAGE_SIZE = 200;
 
-/** `…/storage/files/<id>` (optionally with a trailing `/url` or query). */
-const LOCAL_FILE_URL_RE = /\/storage\/files\/([A-Za-z0-9_-]{1,64})(?:\/url)?(?:[?#].*)?$/;
 /** `data:<mime>;base64,<payload>` — the only inline form carrying real bytes. */
 const DATA_URI_RE = /^data:([^;,]*)(;base64)?,(.*)$/s;
 
@@ -116,6 +114,32 @@ function truncate(v: string, n = 96): string {
   return v.length <= n ? v : `${v.slice(0, n)}…`;
 }
 
+/**
+ * The `sys_file` id a URL names, if it points at this platform's own resolver
+ * (`…/storage/files/<id>`, optionally `/url`-suffixed or query-decorated).
+ *
+ * Parsed structurally rather than with a pattern. The obvious regex for this is
+ * unanchored at the head, so a hostile value repeating `/storage/files/` makes
+ * the engine retry from every position — polynomial backtracking on data that,
+ * here, comes straight out of tenant records. Slicing and splitting is linear
+ * in the URL's length no matter what it contains.
+ */
+function localFileIdFrom(url: string): string | null {
+  let path = url;
+  for (const sep of ['?', '#']) {
+    const at = path.indexOf(sep);
+    if (at >= 0) path = path.slice(0, at);
+  }
+  if (path.endsWith('/url')) path = path.slice(0, -'/url'.length);
+  while (path.endsWith('/')) path = path.slice(0, -1);
+
+  const parts = path.split('/');
+  if (parts.length < 3) return null;
+  if (parts[parts.length - 3] !== 'storage' || parts[parts.length - 2] !== 'files') return null;
+  const id = parts[parts.length - 1];
+  return isFileIdToken(id) ? id : null;
+}
+
 /** The URL a legacy value points at, if any (inline blob or bare string). */
 function urlOf(value: unknown): string | null {
   if (typeof value === 'string') return value;
@@ -258,9 +282,8 @@ export async function backfillFileReferences(
               continue;
             }
 
-            const local = LOCAL_FILE_URL_RE.exec(url);
-            if (local) {
-              const fileId = local[1];
+            const fileId = localFileIdFrom(url);
+            if (fileId) {
               actions.push({
                 ...record_,
                 kind: 'resolved_local_url',