rUv 4dcfa0fadd fix(aidefence): bound two ReDoS patterns, stateless PII regexes, O(P) confidence pass (#3177) ...

* fix(aidefence): bound two quadratic patterns, make PII regexes stateless, hoist the indicator count out of the per-match loop

Three findings from the 2026-09-04 upstream AIDefence review (ruvnet/midstream
PR #105, corpus of 55 bypass / 30 legitimate inputs), fixed here in the
vendored detector that the aidefence_scan MCP tool runs:

- ReDoS: `\[\[.*?\]\]|<<.*?>>|\{\{.*?\}\}` and `\bDAN\b.*\bmode\b|…` were
  measured at 1.3–1.4 s and 0.65–1.0 s per 100 KB adversarial input. Bounded
  to one line / 200 chars; the regression test requires a full detect() under
  200 ms on 100 KB of `[[` and of `DAN …` repeats.
- Stateful PII: PII_PATTERNS carried /g (and /gi) but were only used with
  .test(); a shared RegExp's lastIndex made detectPII alternate true/false
  across calls on the same service instance. Flags dropped. The email class
  `[A-Z|a-z]` typo (matched `|` as a TLD char) is corrected to `[A-Za-z]`.
- O(P²): calculateConfidence re-tested every pattern for every match. The
  indicator count is now computed once per detect() and passed in; the boost
  semantics are unchanged (test asserts the multi-indicator input scores at
  least the single-indicator one).

Tests: 19 passed (16 existing + 3 regressions).

Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_013PKv3picsfzoQJDKLLW7Rt

* fix(aidefence): bound the email PII regex (RFC 5321 lengths) and pin it with a timing test

Review of this PR (2026-09-05 mission, agent pr-review-ruflo) found the
fix left a worse quadratic behind: the email PII pattern's unbounded
`[A-Za-z0-9._%+-]+@` local part took 3.8 s on 'a.' × 50 000, and
detect() calls detectPII on every scan — the same aidefence_scan path
this PR hardens. Bounded to RFC 5321 lengths ({1,64} local, {1,253}
domain, {2,24} TLD); a regression test runs three 100 KB dotted/dashed
inputs under the 200 ms budget and checks a real address and a
limit-length one are still found.

Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_019xHM4rAH4aaShb4DTr1n6s

2026-09-05 11:37:11 -04:00

..

threat-detection.test.ts

fix(aidefence): bound two ReDoS patterns, stateless PII regexes, O(P) confidence pass (#3177)

2026-09-05 11:37:11 -04:00