Elian DoranandClaude Opus 5.5 0ab8cede1d fix(clipper): look for a tag in linear time ...

`processContent()` wraps content that holds no tag in a paragraph, and
tested for a tag with `/<.+?>/`. CodeQL flags it as a polynomial ReDoS:
on a string of `<` with no `>`, each start position scans to the end
(1.4 s for 100,000 characters in Node). `/<[^<>]+>/` stops each attempt
at the next `<`, so the scan is linear (under 1 ms).

The input is the output of `sanitizeHtml()`, which escapes a stray `<`
to `&lt;`, so the slow case was most likely unreachable from the route;
no spec through `processContent()` can tell the two patterns apart.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-10-11 13:00:18 +03:00

..

docker

chore(deps): update pnpm to v11.28.5

2026-10-10 00:22:52 +00:00

e2e

Merge remote-tracking branch 'origin/main' into fix/quick-search-slash-11204

2026-10-04 11:47:38 +03:00

scripts

build(share-theme): bundle the share theme with the client's Vite build

2026-10-09 23:17:51 +03:00

spec

client/text editor/multicolumn layout: fix an issue

2026-10-08 23:31:03 +03:00

src

fix(clipper): look for a tag in linear time

2026-10-11 13:00:18 +03:00

.gitignore

chore(server): add opt-in CPU profiling for import analysis

2026-06-28 12:01:30 +03:00

docker_healthcheck.sh

perf(healthcheck): probe with a shell script instead of starting node

2026-08-23 19:31:36 +03:00

Dockerfile

fix(docker): run the healthcheck as the container's user

2026-09-29 21:21:54 +03:00

Dockerfile.alpine

fix(docker): run the healthcheck as the container's user

2026-09-29 21:21:54 +03:00

Dockerfile.legacy

fix(docker): run the healthcheck as the container's user

2026-09-29 21:21:54 +03:00

internal.openapi.yaml

refactor(search): drop the path-parameter search routes

2026-10-04 12:03:47 +03:00

package.json

fix(deps): update ai sdk

2026-10-11 04:22:16 +00:00

playwright.config.ts

fix(e2e): run server E2E tests with a single worker

2026-07-12 17:56:43 +03:00

start-docker.sh

fix(docker): start Trilium directly when the container is not root

2026-09-29 20:26:46 +03:00

test_search_integration.js

feat(quick_search): also allow for the equals operator in note title's quick search

2025-08-24 18:53:05 +00:00

tsconfig.app.json

chore: remove the express-partial-content package

2026-08-07 19:17:58 +03:00

tsconfig.json

chore: remove the express-partial-content package

2026-08-07 19:17:58 +03:00

tsconfig.spec.json

test(server): basic coverage of some core routes

2026-05-29 20:56:53 +03:00

vite.config.mts

ci(share): enforce full coverage of the share code and upload it

2026-10-09 15:15:37 +03:00

vitest.build.config.mts

test(server): ensure build artifacts exist

2025-06-15 15:40:54 +03:00