Files
CYANO-01 b34bf0dce8 fix(platform-browser): prevent ReDoS in SOURCEMAP_URL_REGEXP
Replace the lazy quantifier (.+?) with a negated character class
([^\s*]+) that excludes whitespace and asterisks. Source map URLs
never contain these characters, so the fix is semantically
equivalent while eliminating the O(n²) backtracking path triggered
by unclosed /*# sourceMappingURL= fragments.

Fixes: polynomial ReDoS in addBaseHrefToCssSourceMap
(cherry picked from commit fb6b354fbd)
2026-07-14 10:57:25 -07:00
..