Summary

This change escapes configured asset folder paths before compiling them into regular expressions. Template placeholders such as {{slug}} still work as intended, but ordinary path characters like (, +, [, ], and . are now treated literally.

The patch also replaces \b with a path segment boundary lookahead, because \b does not correctly represent folder boundaries when a path segment ends with a non-word character.

Security note

Repository-controlled asset folder configuration should not be interpreted as arbitrary regular expression syntax during asset path lookup.

Verification

npx vitest run src/lib/services/assets/folders.test.js src/lib/services/config/folders/assets.test.js
2 test files passed, 131 tests passed.

npx eslint src/lib/services/assets/folders.js src/lib/services/assets/folders.test.js
passed