fix(image-uris): broaden Unix path regex to include common Linux roots

Use /^[^?#]*\/(?:Users|home|root|var|tmp|opt)\/[^?#]{1,300}\.(png|jpg|jpeg|gif|webp)$/i to support Linux/macOS while keeping bounds and avoiding backtracking.
This commit is contained in:
daniel-lxs 2025-10-27 20:46:27 -05:00
parent 634ee677d9
commit 5d3f45bec0
No known key found for this signature in database
GPG key ID: 21C74479048B3AA6

View file

@ -85,7 +85,7 @@ function webviewUriToFilePath(webviewUri: string): string {
// Use specific, bounded patterns to prevent ReDoS
// Match exact patterns without backtracking
const unixMatch = decoded.match(
/^[^?#]*\/Users\/[a-zA-Z0-9._-]{1,50}\/[^?#]{1,300}\.(png|jpg|jpeg|gif|webp)$/i,
/^[^?#]*\/(?:Users|home|root|var|tmp|opt)\/[^?#]{1,300}\.(png|jpg|jpeg|gif|webp)$/i,
)
if (unixMatch) {
return unixMatch[0]