From 5d3f45bec05706eebce7978f506696d990920c44 Mon Sep 17 00:00:00 2001 From: daniel-lxs Date: Mon, 27 Oct 2025 20:46:27 -0500 Subject: [PATCH] fix(image-uris): broaden Unix path regex to include common Linux roots Use /^[^?#]*\/(?:Users|home|root|var|tmp|opt)\/[^?#]{1,300}\.(png|jpg|jpeg|gif|webp)$/i to support Linux/macOS while keeping bounds and avoiding backtracking. --- src/integrations/misc/imageDataUrl.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/integrations/misc/imageDataUrl.ts b/src/integrations/misc/imageDataUrl.ts index b747d665bc..2179802881 100644 --- a/src/integrations/misc/imageDataUrl.ts +++ b/src/integrations/misc/imageDataUrl.ts @@ -85,7 +85,7 @@ function webviewUriToFilePath(webviewUri: string): string { // Use specific, bounded patterns to prevent ReDoS // Match exact patterns without backtracking const unixMatch = decoded.match( - /^[^?#]*\/Users\/[a-zA-Z0-9._-]{1,50}\/[^?#]{1,300}\.(png|jpg|jpeg|gif|webp)$/i, + /^[^?#]*\/(?:Users|home|root|var|tmp|opt)\/[^?#]{1,300}\.(png|jpg|jpeg|gif|webp)$/i, ) if (unixMatch) { return unixMatch[0]