fix(runtime): notifications 域尾斜杠正则 polynomial-redos 修复（#3507 暴露的 CodeQL high） - #3510
Merged
Conversation
…ions domain (CodeQL high from #3507) The extraction PR moved the legacy `.replace(/\/+$/, '')` verbatim into domains/notifications.ts, which made it "changed code" and surfaced a js/polynomial-redos CodeQL alert that the line had latently carried since ADR-0030. Fix is the same split+filter treatment the security domain already uses for the identical pattern (its comment even cites the rule). Side effect: redundant slashes collapse ('//read//' → 'read'), consistent with the security domain; locked by a new test. Verified: seam suite 19 tests, runtime 624 green, DTS build green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 17 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
#3507 把 handleNotification 体逐字搬进
domains/notifications.ts，搬迁让这行成为"changed code"，CodeQL 首次扫到path.replace(/\/+$/, '')的js/polynomial-redos（high）——该模式自 ADR-0030 就潜伏在原方法里，security 域的同款早已被拦并改为 split+filter（注释里就引用了这条规则），notifications 一直漏网。修复
照 security 域先例：
path.split('/').filter(Boolean).join('/')——不再对请求可控输入跑带量词回溯的正则。语义微差：子路径中的冗余斜杠折叠（//read//→read），与 security 域一致、方向更宽容，新增测试锁定。验证
接缝套件 19 测试、runtime 全量 624 绿、DTS build 绿。
关联 #2462 / #3507。
🤖 Generated with Claude Code