#309
Pull Requests/vercel-labs/agent-skills/#309

fix: verifyclaim regular expression injection regex body before compiling

Opendev-tmgwants to merge intofrom
2 commits1 file changed+13-0

fix this without breaking existing behavior, keep supporting /pattern/flags and plain string patterns, but validate the regex body before compiling to reject unsafe constructs commonly associated with catastrophic backtracking (for example nested quantifiers and backreferences), and continue escaping plain-string patterns.

Best single approach in the shown file:

  • Edit skills/vercel-optimize/lib/verify-claim.mjs in compilePattern(...) region.
  • Add a small helper (e.g., isSafeRegexSource) near compilePattern.
  • In the /pattern/flags branch, call the helper on m[1]; if unsafe, throw an error (or reject) before new RegExp.
  • Keep existing flag-merging behavior and plain-string escaping behavior unchanged.

Activity

5
B
fux: verifyclaim regular expression injection regex body before compiling
acc6190
vercel[bot]3mo ago

@bjormpro is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.

vercel[bot]reviewed3mo ago
vercel[bot]3mo ago

Additional Suggestion:

compilePattern throwing Error('unsafe regex pattern') escapes verifyClaim via the un-try/catch'd call sites in verifyPatternCount and verifyRepoCount, violating the "never throws" contract and aborting the entire verification run.

B
Update skills/vercel-optimize/lib/verify-claim.mjs
9e0acd4
vercel[bot]reviewed3mo ago