openclaw/src
Martin Garramon eede8f945f fix(agents): replace .* with \S* in interpreter heuristic regexes to prevent ReDoS
The inner `.*\s+` in `(?:[A-Za-z_][A-Za-z0-9_]*=.*\s+)*` creates
catastrophic backtracking because both `.*` and `\s+` can match
whitespace. When the exec tool processes commands with `VAR=value`
assignments followed by whitespace-heavy text (e.g. HTML heredocs),
the regex engine hangs permanently at 100% CPU.

Replace `.*` with `\S*` in all three instances. Shell prefix variable
assignments cannot contain unquoted whitespace in the value, so `\S*`
is semantically correct and eliminates the ambiguity.

Fixes #61881
2026-04-06 14:53:44 +01:00
..
acp refactor: consume acpx runtime library (#61495) 2026-04-06 15:51:08 +02:00
agents fix(agents): replace .* with \S* in interpreter heuristic regexes to prevent ReDoS 2026-04-06 14:53:44 +01:00
auto-reply refactor: consume acpx runtime library (#61495) 2026-04-06 15:51:08 +02:00
bindings
bootstrap
canvas-host
channels refactor: consume acpx runtime library (#61495) 2026-04-06 15:51:08 +02:00
chat
cli refactor: share plugin cli registration helpers 2026-04-06 14:52:21 +01:00
commands fix(commands): resolve provider auth choices from plugin runtime 2026-04-06 14:45:44 +01:00
compat
config test: add raw plugin-schema defaults regression coverage (#61856) 2026-04-06 14:32:17 +01:00
context-engine
cron Revert "refactor(cli): remove custom cli backends" 2026-04-06 13:40:42 +01:00
daemon fix: recover launchd restart and restore prompt-cache gate 2026-04-05 17:47:07 +09:00
docs
flows fix: restore claude cli guidance and doctor behavior 2026-04-06 14:21:11 +01:00
gateway fix: don't broadcast state:error on per-attempt lifecycle errors (#60043) (thanks @jwchmodx) (#60043) 2026-04-06 14:47:38 +01:00
hooks
i18n
image-generation feat: add vydra media provider 2026-04-06 02:21:51 +01:00
infra fix: harden windows dev update fallback 2026-04-06 14:41:29 +01:00
interactive
link-understanding
logging test(logging): share temp log path helper 2026-04-06 11:05:36 +01:00
markdown
mcp refactor: share gateway auth and approval helpers 2026-04-06 07:41:08 +01:00
media fix(media): lazy load file-type sniffing 2026-04-06 13:52:18 +01:00
media-generation feat: add music generation tooling 2026-04-06 01:47:14 +01:00
media-understanding test(media-understanding): reuse temp dir helper in video runner tests 2026-04-06 10:59:44 +01:00
memory-host-sdk feat(memory-wiki): restore llm wiki stack 2026-04-06 04:56:52 +01:00
music-generation fix(agents): ignore unsupported music generation hints 2026-04-06 02:22:00 +01:00
node-host refactor: move browser runtime seams behind plugin metadata 2026-04-05 23:13:14 +01:00
pairing refactor: share gateway auth and approval helpers 2026-04-06 07:41:08 +01:00
plugin-sdk refactor: consume acpx runtime library (#61495) 2026-04-06 15:51:08 +02:00
plugins refactor: share plugin cli registration helpers 2026-04-06 14:52:21 +01:00
process fix: support corepack cmd shim on windows 2026-04-06 03:48:47 +01:00
qa-e2e feat(qa): recreate qa lab docker stack 2026-04-05 23:21:56 +01:00
realtime-transcription
realtime-voice
routing
scripts test(tooling): reuse temp dir helpers in script tests 2026-04-06 05:45:36 +01:00
secrets perf(test): split secrets runtime provider coverage 2026-04-06 14:40:35 +01:00
security perf(test): trim security audit wrapper coverage 2026-04-06 14:13:08 +01:00
sessions perf(test): trim send-policy and abort hot paths 2026-04-06 03:10:40 +01:00
shared refactor: share assistant visible text sanitizer profiles 2026-04-06 14:52:52 +01:00
tasks fix(tasks): hide internal completion wake rows 2026-04-06 03:03:53 +01:00
terminal
test-helpers test(infra): share suite temp root tracker in infra tests 2026-04-06 06:13:32 +01:00
test-utils feat: add music generation tooling 2026-04-06 01:47:14 +01:00
tts refactor: route runtime seams through plugin sdk facades 2026-04-05 15:13:19 +01:00
tui fix(tui): align /status with shared session status 2026-04-06 14:10:59 +01:00
types
utils
video-generation feat(video): add mode-aware generation capabilities 2026-04-06 13:19:51 +01:00
web-fetch style(repo): normalize imports and formatting 2026-04-05 16:49:46 +01:00
web-search style(repo): normalize imports and formatting 2026-04-05 16:49:46 +01:00
wizard feat: add Fireworks provider and simplify plugin setup loading 2026-04-05 07:43:14 +01:00
browser-lifecycle-cleanup.test.ts
browser-lifecycle-cleanup.ts
channel-web.ts
docker-build-cache.test.ts
docker-image-digests.test.ts
docker-setup.e2e.test.ts test(e2e): reuse suite temp root tracker in docker setup tests 2026-04-06 06:27:48 +01:00
dockerfile.test.ts
entry.respawn.test.ts
entry.respawn.ts
entry.test.ts
entry.ts
entry.version-fast-path.test.ts
extensionAPI.ts
global-state.ts
globals.ts
index.test.ts
index.ts
install-sh-version.test.ts test(unit): reuse temp dir helper in install-sh version tests 2026-04-06 05:46:27 +01:00
library.test.ts
library.ts
logger.test.ts test(core): reuse shared temp dir helper in logger tests 2026-04-06 06:27:34 +01:00
logger.ts
logging.ts
param-key.ts
plugin-activation-boundary.test.ts refactor: add metadata-first channel configured-state probes 2026-04-06 01:02:45 +01:00
poll-params.test.ts
poll-params.ts
polls.test.ts
polls.ts
runtime.ts
ui-app-settings.agents-files-refresh.test.ts Dreaming: simplify sweep flow and add diary surface 2026-04-05 17:18:54 -07:00
utils.test.ts test(core): reuse shared temp dir helpers in utils tests 2026-04-06 06:24:01 +01:00
utils.ts
version.test.ts test(infra): reuse shared temp dir helpers in small file tests 2026-04-06 05:58:18 +01:00
version.ts