chore: sync core lib and CLAUDE.md from agent-core#35
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces several ReDoS (Regular Expression Denial of Service) fixes across multiple files by replacing unbounded quantifiers with explicit bounds to prevent polynomial backtracking. The feedback recommends increasing the character limit bound in the hasXML regular expression from 50,000 to 250,000 to avoid false negatives on exceptionally large prompt files.
| const hasLists = /^[-*]\s{1,1000}[^\n]{1,2000}$/m.test(content); | ||
| // ReDoS fix: bound the unbounded [\s\S]*? so an unterminated <tag> cannot | ||
| // drive polynomial backtracking; 50k chars covers any realistic XML block. | ||
| const hasXML = /<\w+>[\s\S]{0,50000}?<\/\w+>/.test(content); |
There was a problem hiding this comment.
The hasXML regex uses a bound of 50000 characters ([\s\S]{0,50000}?). While this prevents ReDoS, very large prompt files (which can easily exceed 50KB, especially when containing extensive few-shot examples or reference documentation) might have their outer XML tags separated by more than 50,000 characters. In such cases, hasXML will incorrectly return false, potentially triggering false positive warnings like Complex content without XML tags.
Consider increasing this limit (e.g., to 250000 or more) to accommodate larger prompt files.
| const hasXML = /<\w+>[\s\S]{0,50000}?<\/\w+>/.test(content); | |
| const hasXML = /<\w+>[\s\S]{0,250000}?<\/\w+>/.test(content); |
|
Superseded by latest sync (post ReDoS + prototype-pollution hardening). |
1 participant
Automated sync of lib/ and CLAUDE.md from agent-core.