ext/hyperframes
2
0
Fork 0
mirror of https://github.com/heygen-com/hyperframes.git synced 2026-09-11 06:30:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(producer): drop the ReDoS-prone literal-argv regex for a linear scan

Browse Source 
CodeQL flagged js/redos on the all-literal argv matcher. It was right: the
`(?:"[^"]*"\s*,?\s*)+` form nests a quantifier inside a quantifier with an
optional separator, so whitespace can be matched two ways and a long
non-matching argv backtracks exponentially.

Replaced with a linear scan — find the spawn head, slice to the closing
bracket, and check the entries — plus small named helpers. Same behaviour: an
all-literal argv is treated as taking no input, an argv with a bare identifier
still has to be understood (verified by adding one and watching the guard fail).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Vance Ingalls
2026-08-04 02:41:39 -07:00
co-authored by Claude Opus 5
parent c81f68b592
commit 6c5403f7cd
1 changed files with 48 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/producer/src/utils/ffprobeArgvContract.test.ts
+48 -14
View File
@@ -77,20 +77,54 @@ function mentionsProbe(src: string): boolean {
// Comments and doc prose describing a spawn are not a spawn:
// `tts.test.mjs` explains `ffprobeDuration's spawnSync("ffprobe", ...) call`
// in a comment and was reported as an unclassified caller.
// A probe spawned with an all-literal argv takes no runtime input, so
// there is nothing to terminate: `spawnSync("ffprobe", ["-version"])` is a
// capability check, not a file probe. Dropping those before the test keeps
// them out of the unclassified list without weakening it — an argv carrying
// a bare identifier (a path) still has to be understood.
const NO_INPUT_PROBE =
/(?:spawn|spawnSync|execFile\w*|exec)\s*\(\s*["'`]ff(?:probe|mpeg)["'`]\s*,\s*\[\s*(?:"[^"]*"\s*,?\s*)+\]/g;
const code = src
.replace(/\/\*[\s\S]*?\*\//g, "")
.replace(/\/\/[^\n]*/g, "")
.replace(NO_INPUT_PROBE, "");
return /(?:spawn|spawnSync|execFile\w*|exec)\s*\(\s*[^,)]*(?:ffprobe|ffProbe|probeBin|probePath)/i.test(
code,
);
// A probe spawned with an all-literal argv takes no runtime input, so there
// is nothing to terminate: `spawnSync("ffprobe", ["-version"])` is a
// capability check, not a file probe. Dropping those keeps them out of the
// unclassified list without weakening it — an argv carrying a bare
// identifier (a path) still has to be understood.
//
// Split into a linear scan plus a per-body check rather than one regex.
// The obvious `(?:"[^"]*"\s*,?\s*)+` form nests a quantifier inside a
// quantifier with an optional separator, so whitespace can be matched two
// ways and it backtracks exponentially on a long non-matching argv — CodeQL
// flagged it as js/redos, correctly.
const code = stripComments(src);
return CALLS_PROBE.test(withoutNoInputProbes(code));
}
const PROBE_SPAWN_HEAD =
/(?:spawn|spawnSync|execFile\w*|exec)\s*\(\s*["'`]ff(?:probe|mpeg)["'`]\s*,\s*\[/g;
const CALLS_PROBE =
/(?:spawn|spawnSync|execFile\w*|exec)\s*\(\s*[^,)]*(?:ffprobe|ffProbe|probeBin|probePath)/i;
function stripComments(src: string): string {
return src.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/[^\n]*/g, "");
}
/** Every entry a string literal → no runtime path in this argv. */
function isLiteralOnlyArgv(body: string): boolean {
const entries = body
.split(",")
.map((e) => e.trim())
.filter((e) => e !== "");
return entries.length > 0 && entries.every((e) => /^"[^"]*"$/.test(e));
}
/** Blank out `spawn("ffprobe", [ ...all literals... ])` occurrences. */
function withoutNoInputProbes(code: string): string {
let out = "";
let cursor = 0;
PROBE_SPAWN_HEAD.lastIndex = 0;
for (let m = PROBE_SPAWN_HEAD.exec(code); m !== null; m = PROBE_SPAWN_HEAD.exec(code)) {
const bodyStart = m.index + m[0].length;
const bodyEnd = code.indexOf("]", bodyStart);
if (bodyEnd === -1) continue;
if (!isLiteralOnlyArgv(code.slice(bodyStart, bodyEnd))) continue;
out += code.slice(cursor, m.index);
cursor = bodyEnd + 1;
PROBE_SPAWN_HEAD.lastIndex = cursor;
}
return out + code.slice(cursor);
}
const SKIP_DIRS = new Set(["node_modules", "dist"]);