J3vbandClaude Opus 4.8 92dae342e0 fix(client): parse OG tags with DOMParser to remove ReDoS vector ...

parseOgTags matched untrusted link-preview HTML (up to 50KB) against regexes with two sequential [^>]* quantifiers around a required literal, which backtrack polynomially and froze the UI thread on crafted input. Parse with DOMParser (a linear tokenizer) instead; it also correctly ignores meta-like strings inside comments/scripts. (Security scan F7)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-23 11:59:13 +02:00

..

tauri-client

fix(client): parse OG tags with DOMParser to remove ReDoS vector

2026-07-23 11:59:13 +02:00