test/nemoclaw-start-workspace-template-seeding.test.ts (1)

13-19: 💤 Low value

Static analysis flagged potential ReDoS risk from regex variable interpolation.

The regex construction on line 14 uses the name parameter directly, which static analysis flagged as a potential Regular Expression Denial of Service (ReDoS) vector. In this test file, name is always the hardcoded string "seed_default_workspace_templates" (line 29), making this a false positive in practice.

However, as a defensive measure, consider escaping special regex characters in the name parameter:

🛡️ Optional defensive fix

 function extractShellFunctionFromSource(src: string, name: string): string {
-  const match = src.match(new RegExp(`${name}\\(\\) \\{([\\s\\S]*?)^\\}`, "m"));
+  const escapedName = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const match = src.match(new RegExp(`${escapedName}\\(\\) \\{([\\s\\S]*?)^\\}`, "m"));
   if (!match) {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/nemoclaw-start-workspace-template-seeding.test.ts` around lines 13 - 19,
The test's extractShellFunctionFromSource function interpolates the name
parameter directly into a RegExp causing a potential ReDoS; fix it by escaping
regex-special characters in name before building the RegExp (e.g., transform
name with a safe escape like replace(/[.*+?^${}()|[\]\\]/g, '\\$&') so the
generated pattern treats the function name literally) and then use the
escapedName in new RegExp; refer to function extractShellFunctionFromSource and
the name variable when making this change.

Source: Linters/SAST tools