Dragan Spiridonov 613ddd4669 fix(security): replace every '*' when parsing wildcard redirect patterns ...

Follow-up to 961f3feb. The structural rewrite removed the regex sink (the 9
incomplete-hostname-regexp alerts cleared) but introduced one new alert:
`allowed.replace('*', MARKER)` replaces only the FIRST '*' (CodeQL
js/incomplete-sanitization, "Incomplete string escaping or encoding",
routes.ts:709).

Use the global form `allowed.replace(/\*/g, MARKER)` so every '*' is substituted.
A multi-wildcard pattern is still rejected safely: its suffix then contains the
placeholder label, which no real host can end with. Adds a regression test for a
multi-star pattern.

All 10 validateRedirectUri cases pass; tsc 0 errors; build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-10 20:34:58 +00:00

..

a2a

fix(security): replace every '*' when parsing wildcard redirect patterns

2026-07-10 20:34:58 +00:00

a2ui

fix(tests): add afterEach cleanup to 104 test files missing it (#374 P2)

2026-03-21 12:51:47 +00:00

ag-ui

fix(security): resolve 4 CodeQL ReDoS alerts + decompose oversized modules

2026-03-22 19:58:01 +00:00

browser-result-adapter.test.ts

feat: flatten project structure — archive v2, promote v3 to root

2026-03-01 11:35:41 +00:00

trajectory-adapter.test.ts

feat: flatten project structure — archive v2, promote v3 to root

2026-03-01 11:35:41 +00:00