Pretext: Algorithmic Complexity (DoS) in the text analysis phase
`isRepeatedSingleCharRun()` in `src/analysis.ts` (line 285) re-scans the entire accumulated segment on every merge iteration during text analysis, producing O(n²) total work for input consisting of repeated identical punctuation characters. An attacker who controls text passed to `prepare()` can block the main thread for ~20 seconds with 80KB of input (e.g., `"(".repeat(80_000)`). Tested against commit 9364741d3562fcc65aacc50953e867a5cb9fdb23 (v0.0.4) on Node.js v24.12.0, Windows x64. A standalone PoC and detailed write-up are attached below. --- ## Root Cause The `buildMergedSegmentation()` function (line 795) processes text segments pr
- Auf 0.0.5 aktualisieren
Veröffentlicht Aktualisiert