From 585d9873dd3868a594241b0b0ee6b0f57641162f Mon Sep 17 00:00:00 2001 From: huyphan Date: Tue, 14 Jul 2026 21:28:53 -0600 Subject: [PATCH] fix: satisfy ESLint ReDoS rule in DuckDB view header parser Replace the lazy [\s\S]*? view-name matcher with bounded identifier alternatives, matching the pattern used by DB2/SQL Server providers. Co-authored-by: Cursor --- packages/core/src/providers/duckDb/duckdb.provider.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/core/src/providers/duckDb/duckdb.provider.ts b/packages/core/src/providers/duckDb/duckdb.provider.ts index 94e2b99..068e481 100644 --- a/packages/core/src/providers/duckDb/duckdb.provider.ts +++ b/packages/core/src/providers/duckDb/duckdb.provider.ts @@ -167,9 +167,11 @@ export class DuckDbProvider implements SchemaProvider { // 5. Views. duckdb_views().sql is the FULL "CREATE VIEW name AS ;" — // strip the header (and trailing ;) so `definition` is just the SELECT body, // matching what the other providers store and what the generator expects. + // eslint-disable-next-line security/detect-unsafe-regex -- anchored at ^; bounded identifier alternatives (no lazy [\s\S]*) + const VIEW_CREATE_RE = /^\s*CREATE\s+(?:OR\s+REPLACE\s+)?(?:TEMP(?:ORARY)?\s+)?VIEW\s+(?:(?:"[^"]*"|\w+)\s*\.\s*)?(?:"[^"]*"|\w+)\s+AS\s+/i; for (const vw of rawViews) { const body = (vw.sql ?? '') - .replace(/^\s*CREATE\s+(?:OR\s+REPLACE\s+)?(?:TEMP(?:ORARY)?\s+)?VIEW\s+[\s\S]*?\s+AS\s+/i, '') + .replace(VIEW_CREATE_RE, '') .replace(/;\s*$/, '') .trim(); (views[vw.view_name] ??= []).push({