fix(media-embed): remove ReDoS-prone regexes in host-gated providers by waleedlatif1 · Pull Request #5305 · simstudioai/sim

waleedlatif1 · 2026-07-01T01:01:59Z

Summary

Fixes 3 CodeQL High js/polynomial-redos alerts on packages/utils/src/media-embed.ts (introduced by feat(rich-markdown-editor): live media embeds + shared embed detection util #5290, now in staging)
The YouTube, Facebook, and Giphy branches used unbounded .* inside unanchored regexes. Even with the hostname gate, a crafted valid-host URL with a long path/query (e.g. https://facebook.com/ + 100k junk chars, no /videos/) triggers O(n²) backtracking — a client-side hang since getEmbedInfo runs during note rendering + editor decoration (a crafted link in shared content could freeze other users' tabs)
Replaced each with bounded extraction off the parsed URL (parsed.pathname / parsed.searchParams), so there is no .* left in these branches. No change to which links match

Detail

YouTube: youtu.be → first path segment; watch → searchParams.get('v'); embed → anchored /^\/embed\/([^/?]+)/; result validated with /^[a-zA-Z0-9_-]{11}$/
Facebook: detect video via /\/videos\/\d+/ on the pathname (fb.watch via anchored segment) instead of facebook.com/.*/videos/
Giphy: take the trailing hyphen token of the /gifs|embed/ path segment ([^/]+ + split('-').pop()), validated [a-zA-Z0-9]+

Type of Change

Bug fix (security — ReDoS)

Testing

media-embed.test.ts: existing cases pass; added coverage for extra YouTube query params, Facebook/fb.watch, and Giphy slug extraction (10 tests). tsc clean.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Replace the unbounded '.*' patterns flagged by CodeQL (js/polynomial-redos) in the YouTube, Facebook, and Giphy branches with bounded extraction off the parsed URL (pathname / searchParams). Eliminates the O(n^2) backtracking a crafted valid-host URL could trigger, with no change to matched links.

vercel · 2026-07-01T01:02:06Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 1, 2026 1:15am

cursor · 2026-07-01T01:02:09Z

PR Summary

Medium Risk
Security fix in client-side URL parsing used during note rendering; logic is refactored but host gating and stricter id validation should preserve safe embed behavior.

Overview
Addresses CodeQL polynomial ReDoS in getEmbedInfo by replacing unbounded .* regex ID extraction on YouTube, Facebook/fb.watch, and Giphy with bounded reads from the parsed URL (pathname segments, searchParams, and short anchored path checks).

YouTube now pulls the video id from youtu.be path, /embed/ segment, or v query param and requires an 11-character id. Facebook treats links as video only when the pathname matches /videos/\d+ (or fb.watch’s single segment). Giphy takes the last hyphen token from the /gifs or /embed segment. Matching behavior is intended to stay the same; tests add cases for extra query params, non-video Facebook URLs, and slug-style Giphy links.

^{Reviewed by Cursor Bugbot for commit 64df33e. Configure here.}

greptile-apps · 2026-07-01T01:04:27Z

Greptile Summary

This PR removes ReDoS-prone media embed matching from host-gated providers. The main changes are:

Parsed-URL extraction for YouTube, Facebook, and Giphy links.
YouTube embed paths now take precedence over conflicting v query params.
Tests for provider matching and key URL edge cases.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
packages/utils/src/media-embed.ts	Replaces risky provider regex matching with parsed pathname and query extraction.
packages/utils/src/media-embed.test.ts	Adds tests for YouTube precedence and provider-specific embed extraction.

_{Reviews (2): Last reviewed commit: "fix(media-embed): dispatch YouTube id by..." | Re-trigger Greptile}

Use the first path segment for youtu.be ids so a trailing slash still resolves (matching the previous regex), and cover extra-query-param, si-param, embed-query, and short-id cases.

…ents - Resolve id from the /embed/ path segment before the ?v= query param so a valid embed URL with a spurious v param still embeds (was returning null) - Remove non-TSDoc inline comments from the module and its test

waleedlatif1 · 2026-07-01T01:11:12Z

@greptile

waleedlatif1 · 2026-07-01T01:11:13Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 64df33e. Configure here.}

waleedlatif1 mentioned this pull request Jul 1, 2026

v0.7.18: landing, tools depth, media embeds in md editor, sonnet 5 #5296

Merged

cursor Bot reviewed Jul 1, 2026

View reviewed changes

Comment thread packages/utils/src/media-embed.ts Outdated

greptile-apps Bot reviewed Jul 1, 2026

View reviewed changes

Comment thread packages/utils/src/media-embed.ts Outdated

Comment thread packages/utils/src/media-embed.ts

vercel Bot deployed to Preview July 1, 2026 01:06 View deployment

waleedlatif1 added 2 commits June 30, 2026 18:07

test(media-embed): lock youtu.be trailing-slash + edge parity

f3e4d4b

Use the first path segment for youtu.be ids so a trailing slash still resolves (matching the previous regex), and cover extra-query-param, si-param, embed-query, and short-id cases.

cursor Bot reviewed Jul 1, 2026

View reviewed changes

waleedlatif1 merged commit 48752c6 into staging Jul 1, 2026
11 of 12 checks passed

waleedlatif1 deleted the media-embed-redos-fix branch July 1, 2026 01:13

vercel Bot deployed to Preview July 1, 2026 01:15 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(media-embed): remove ReDoS-prone regexes in host-gated providers#5305

fix(media-embed): remove ReDoS-prone regexes in host-gated providers#5305
waleedlatif1 merged 3 commits into
stagingfrom
media-embed-redos-fix

waleedlatif1 commented Jul 1, 2026

Uh oh!

vercel Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

greptile-apps Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 1, 2026

Uh oh!

waleedlatif1 commented Jul 1, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

waleedlatif1 commented Jul 1, 2026

Summary

Detail

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

greptile-apps Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 1, 2026

Uh oh!

waleedlatif1 commented Jul 1, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Jul 1, 2026 •

edited

Loading

cursor Bot commented Jul 1, 2026 •

edited

Loading

greptile-apps Bot commented Jul 1, 2026 •

edited

Loading