Skip to content

fix: Use magic-string appendLeft instead of replace #303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lforst merged 1 commit into from
Jun 6, 2023
Merged

fix: Use magic-string appendLeft instead of replace #303

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions packages/bundler-plugin-core/src/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -346,9 +346,11 @@ export function createRollupDebugIdInjectionHooks() {
// Note: CodeQL complains that this regex potentially has n^2 runtime. This likely won't affect realistic files.
/^(?:\s*|\/\*(?:.|\r|\n)*\*\/|\/\/.*[\n\r])*(?:"[^"]*";|'[^']*';)?/;

if (code.match(commentUseStrictRegex)?.[0]) {
const match = code.match(commentUseStrictRegex)?.[0];

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data

This [regular expression](1) that depends on [library input](2) may run slow on strings starting with '//' and with many repetitions of '*///'.

if (match) {
// Add injected code after any comments or "use strict" at the beginning of the bundle.
ms.replace(commentUseStrictRegex, (match) => `${match}${codeToInject}`);
ms.appendLeft(match.length, codeToInject);
} else {
// ms.replace() doesn't work when there is an empty string match (which happens if
// there is neither, a comment, nor a "use strict" at the top of the chunk) so we
Expand Down