From 405fbfc2b6ba46695fcf7e619983f54176a42aa0 Mon Sep 17 00:00:00 2001
From: Wolfvin <wolfvin@users.noreply.github.com>
Date: Sun, 12 Jul 2026 01:53:02 +0700
Subject: [PATCH] fix(security): regex-audit missing inline-literal detection
 for .ts/.tsx/.jsx/.mjs/.cjs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only .js had the 'regex_literal_inline' pattern (bare /pattern/flags used
directly as a call argument, e.g. .replace(/[-:T]/g, '')). Every other JS
family extension — .mjs, .cjs, .ts, .tsx, .jsx — was missing it, so any
inline (non-variable-assigned) regex literal in TypeScript/JSX went
completely undetected.

Found via real-codebase validation (Coretax-Auto-Downloader KDS backend,
all .ts): regex-audit reported total_patterns:0 despite genuine inline
regex literals (.replace(/[-:T]/g, ''), .replace(/\s+/g, '.')) confirmed
present via grep.

Fix: add the same inline-literal pattern already used for .js to the
other 4 extensions. Verified: total_patterns went from 0 to 1735,
vulnerable stayed 0 (no ReDoS-prone patterns in this codebase) — the
inline pattern is inherently noisy for raw counting (same tradeoff .js
already accepted), but doesn't affect the vulnerability-flagging logic.
---
 scripts/regexaudit_engine.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/scripts/regexaudit_engine.py b/scripts/regexaudit_engine.py
index 752fb071..815da8e8 100755
--- a/scripts/regexaudit_engine.py
+++ b/scripts/regexaudit_engine.py
@@ -79,25 +79,37 @@
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
         (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
+    # Bug fix: only .js had "regex_literal_inline" (bare /pattern/flags used
+    # directly as a call argument, e.g. `.replace(/[-:T]/g, '')`) — .mjs/.cjs/
+    # .ts/.tsx/.jsx were missing it, so any inline (non-variable-assigned)
+    # regex literal in TypeScript/JSX went completely undetected. Found via
+    # real-codebase validation (Coretax-Auto-Downloader KDS backend, all .ts):
+    # regex-audit reported total_patterns:0 despite genuine inline regex
+    # literals like `.replace(/[-:T]/g, '')` and `.replace(/\s+/g, '.')`.
     ".mjs": [
         (r'(?:const|let|var)\s+\w+\s*=\s*(/[^/\n]+/[gimsuy]*)', "regex_literal"),
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
+        (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
     ".cjs": [
         (r'(?:const|let|var)\s+\w+\s*=\s*(/[^/\n]+/[gimsuy]*)', "regex_literal"),
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
+        (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
     ".ts": [
         (r'(?:const|let|var)\s+\w+\s*(?::\s*\w+(?:<[^>]+>)?)?\s*=\s*(/[^/\n]+/[gimsuy]*)', "regex_literal"),
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
+        (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
     ".tsx": [
         (r'(?:const|let|var)\s+\w+\s*(?::\s*\w+(?:<[^>]+>)?)?\s*=\s*(/[^/\n]+/[gimsuy]*)', "regex_literal"),
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
+        (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
     ".jsx": [
         (r'(?:const|let|var)\s+\w+\s*=\s*(/[^/\n]+/[gimsuy]*)', "regex_literal"),
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
+        (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
     ".py": [
         (r're\.compile\s*\(\s*(?:r)?["\']([^"\']+)["\']', "re_compile"),