From 75ea9b12303ecaadba78c4aa8a68c1fe9bf77189 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Mon, 20 Jul 2026 07:56:46 -0700 Subject: [PATCH] fix(security): regex denial of service (redos) via ignore-watch o The `arrayToRegExp` function in `lib/watch/utils.js` constructs a regular expression from an array of strings. If a user passes specially crafted strings via the `--ignore-watch` CLI argument or the `ignoreWatch` configuration option, it can lead to catastrophic backtracking (ReDoS) and cause the application to hang. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- lib/watch/utils.js | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/lib/watch/utils.js b/lib/watch/utils.js index dae37507..7605d449 100644 --- a/lib/watch/utils.js +++ b/lib/watch/utils.js @@ -3,11 +3,10 @@ const chalk = require('chalk') const path = require('node:path') +const escapeRegExp = (str) => str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + const arrayToRegExp = (arr) => { - const reg = arr.map((file) => { - if (/^\./.test(file)) { return `\\${file}` } - return file - }).join('|') + const reg = arr.map((file) => escapeRegExp(file)).join('|') return new RegExp(`(${reg})`) }