Skip to content

fix(email-core): trim disk filename edges without a backtracking regex - #212

Merged
stevenobiajulu merged 1 commit into
mainfrom
fix/save-file-redos
Oct 5, 2026
Merged

fix(email-core): trim disk filename edges without a backtracking regex#212
stevenobiajulu merged 1 commit into
mainfrom
fix/save-file-redos

Conversation

@stevenobiajulu

@stevenobiajulu stevenobiajulu commented Oct 5, 2026

Copy link
Copy Markdown
Member

Follow-up to #211. CodeQL flagged js/polynomial-redos (alert #14) on the /^[._]+|_+$/ trim in toDiskFilename. The fix was pushed to #211, but automerge squashed the previous head seconds earlier, so it never reached main.

This replaces the anchored regex with a linear edge scan. Behavior is unchanged: the same 602 email-core tests pass, including the toDiskFilename cases. The file is byte-identical to the version tested on the #211 branch.

@stevenobiajulu
stevenobiajulu enabled auto-merge (squash) October 5, 2026 22:22
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-05T22:24:13.741259Z 91bd01f PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@codecov

codecov Bot commented Oct 5, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

@stevenobiajulu
stevenobiajulu merged commit 17dc4d5 into main Oct 5, 2026
14 checks passed
@stevenobiajulu
stevenobiajulu deleted the fix/save-file-redos branch October 5, 2026 22:26
This was referenced Oct 5, 2026
Merged
Merged
stevenobiajulu added a commit that referenced this pull request Oct 7, 2026
@stevenobiajulu
chore(release): bump workspace versions to 0.3.3 (#213)
379f973 
Releases #209 (caller-replayed duplicate delivery guard), #211 (save_to for
download_attachment and the new download_message tool) and #212 (CodeQL
ReDoS fix), which landed on main after the 0.3.2 tag. Agents run the
installed server, not main, so these stay unavailable until this ships.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@stevenobiajulu