Harden mail profile validation

webui/src/features/mail/mailPolicyValidation.ts

@@ -88,10 +88,39 @@ export function wildcardPatternMatches(pattern: string, rawValue: string): boole
   const normalizedPattern = pattern.trim();
   const value = rawValue.trim();
   if (!normalizedPattern || !value) return false;
-  if (normalizedPattern === "*") return true;
-  const escaped = normalizedPattern.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-  const regex = `^${escaped.replace(/\*/g, ".*").replace(/\?/g, ".")}$`;
-  return new RegExp(regex, "i").test(value);
+  return wildcardMatch(normalizedPattern.toLowerCase(), value.toLowerCase());
+}
+
+function wildcardMatch(pattern: string, value: string): boolean {
+  let patternIndex = 0;
+  let valueIndex = 0;
+  let starIndex = -1;
+  let valueRetryIndex = 0;
+
+  while (valueIndex < value.length) {
+    const token = pattern[patternIndex];
+    if (token === "?" || token === value[valueIndex]) {
+      patternIndex += 1;
+      valueIndex += 1;
+      continue;
+    }
+    if (token === "*") {
+      starIndex = patternIndex;
+      valueRetryIndex = valueIndex;
+      patternIndex += 1;
+      continue;
+    }
+    if (starIndex !== -1) {
+      patternIndex = starIndex + 1;
+      valueRetryIndex += 1;
+      valueIndex = valueRetryIndex;
+      continue;
+    }
+    return false;
+  }
+
+  while (pattern[patternIndex] === "*") patternIndex += 1;
+  return patternIndex === pattern.length;
 }
 
 function patternsFor(
@@ -117,4 +146,4 @@ function normalizeDomain(value: string | null | undefined): string {
   if (!trimmed) return "";
   const emailDomain = trimmed.includes("@") ? trimmed.split("@").pop() ?? "" : trimmed;
   return emailDomain.replace(/^@+/, "");
-}
+}