lotobo/regex-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity
Files
873b9b218d4a2f4b7e71c7ce659d625141c18d70
regex-tools/docs/SECURITY.md

2.1 KiB
Raw Blame History

Security and privacy

Patterns, flags, replacement templates, subjects and imported projects are untrusted.

  • Syntax and execution use separate workers.
  • Regex execution never occurs on the UI thread.
  • Timeout, crash and cancellation terminate the worker.
  • A terminated worker is never reused.
  • Pattern, subject, replacement/list template, match, capture and output sizes are bounded.
  • Replacement templates are strings; executable callbacks are unavailable.
  • Replacement/list token decorations, rows, chips, diagnostics and list evaluation work have separate presentation/operation caps; incomplete list results cannot be exported.
  • Per-match replacement mapping executes no user code and is capped at 200 matches, 2,000 materialized contributions and 50,000 token evaluations.
  • Imported JSON is aggregate-size-bounded before parsing, then field-validated and never evaluated or auto-run. Export and IndexedDB save apply the same 32 MiB aggregate UTF-8 document bound before materialization or persistence.
  • Project and standalone-suite test subjects are not exported by default, and unit-test subjects require a separate opt-in before IndexedDB persistence.
  • Unit-test add, update, clone and append-import paths share 1,000-case and 32 MiB aggregate state caps.
  • Unit-test assertion diagnostics never stringify complete large values and retain at most 2 KiB UTF-8 per case. Oversized replacement output is not copied into an exact current-result draft.
  • No backend, uploads, telemetry, remote corpus URL, CDN, remote font, eval, Function, arbitrary command line or unsafe HTML rendering exists.

Version 0.1.0 needs a CSP equivalent to:

default-src 'self';
script-src 'self';
worker-src 'self' blob:;
connect-src 'self';
img-src 'self' data:;
font-src 'self';
style-src 'self' 'unsafe-inline';
object-src 'none';
frame-src 'none';
base-uri 'none';
form-action 'none';

The Toolbox shell currently requires inline styles. No unsafe-eval or wasm-unsafe-eval is required until an actual WebAssembly flavour ships.

Report vulnerabilities privately to the repository owner before public issue details are posted.