Skip to content

Commit b110fc7

Browse files
committed
fix(slack): bound the markdown link regex to avoid quadratic backtracking
The link replacement in toSlackMrkdwn used unbounded character classes, which can backtrack quadratically on pathological input. Bound the link text and URL lengths and exclude newlines. Also tightened two test assertions that used unsafe optional chaining.
1 parent 771cf14 commit b110fc7

2 files changed

Lines changed: 4 additions & 3 deletions

File tree

packages/slack/src/index.test.ts

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,8 @@ describe("slack channel", () => {
4545
deliveryId: "d1",
4646
}
4747
);
48-
const values = (msg?.blocks as any[]).flatMap((b) => b.elements ?? []).map((e: any) => e.value);
48+
expect(msg).not.toBeNull();
49+
const values = (msg!.blocks as any[]).flatMap((b) => b.elements ?? []).map((e: any) => e.value);
4950
expect(values).toContain("call-1::approve");
5051
expect(values).toContain("call-1::deny");
5152
});
@@ -129,7 +130,7 @@ describe("slack channel", () => {
129130
);
130131
expect(calls[0]?.url).toBe("https://hooks.slack.test/r/1");
131132
expect(calls[0]?.body.replace_original).toBe(true);
132-
const types = (calls[0]?.body.blocks as Array<{ type: string }>).map((b) => b.type);
133+
const types = (calls[0]!.body.blocks as Array<{ type: string }>).map((b) => b.type);
133134
expect(types).not.toContain("actions");
134135
expect(JSON.stringify(calls[0]?.body.blocks)).toContain("Approved");
135136
vi.unstubAllGlobals();

packages/slack/src/index.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -326,7 +326,7 @@ function defaultSlackInbound(event: SlackMessageEvent): string {
326326
*/
327327
export function toSlackMrkdwn(md: string): string {
328328
return md
329-
.replace(/\[([^\]]+)\]\((https?:\/\/[^)\s]+)\)/g, "<$2|$1>")
329+
.replace(/\[([^\]\n]{1,300})\]\((https?:\/\/[^)\s]{1,2000})\)/g, "<$2|$1>")
330330
.replace(/^[ \t]{0,3}#{1,6}[ \t]+(.+?)[ \t]*#*[ \t]*$/gm, "*$1*")
331331
.replace(/\*\*([^*\n]+)\*\*/g, "*$1*")
332332
.replace(/__([^_\n]+)__/g, "*$1*")

0 commit comments

Comments
 (0)