From 1afdca53ccd2312454c026055dfc4c57842f8452 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Mon, 10 Aug 2026 04:35:17 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 utils/request.js | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/utils/request.js b/utils/request.js
index 6fcad35..7bbc367 100644
--- a/utils/request.js
+++ b/utils/request.js
@@ -210,7 +210,8 @@ export default new class {
 
   async _reques(options) {
     try {
-      let res = await fetch(options.url, options)
+      const signal = options.signal ?? AbortSignal.timeout(options.timeout ?? 30000)
+      let res = await fetch(options.url, { ...options, signal })
       res = await this._handleRes(res, options)
       return res
     } catch (err) {
@@ -252,11 +253,14 @@ export default new class {
   }
 }()
 function matchWithWildcards(pattern, text) {
-  const regexPattern =
-    pattern
-      .replace(/\./g, "\\.")
-      .replace(/\*/g, ".*")
-      .replace(/\?/g, ".")
-  const regex = new RegExp(regexPattern)
-  return regex.test(text)
+  const parts = pattern.split("*")
+  if (parts.length === 1) return pattern === text
+  if (!text.startsWith(parts[0])) return false
+  let idx = parts[0].length
+  for (let i = 1; i < parts.length; i++) {
+    const found = text.indexOf(parts[i], idx)
+    if (found === -1) return false
+    idx = found + parts[i].length
+  }
+  return i === parts.length && (parts[parts.length - 1] === "" || idx === text.length)
 }