From 18db344ed1022fe176f5d041bbfabac494227017 Mon Sep 17 00:00:00 2001
From: Thomas Camlong <thomas@ajnart.fr>
Date: Wed, 27 May 2026 16:20:19 +0200
Subject: [PATCH] fix(security): replace regex with loop to prevent ReDoS

CodeQL flagged `/\/+$/` as polynomial-time on repeated slashes.
Use `while (endsWith("/"))` loop instead.
---
 packages/definitions/src/integration-url-template.ts | 3 ++-
 packages/definitions/src/integration.ts              | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/packages/definitions/src/integration-url-template.ts b/packages/definitions/src/integration-url-template.ts
index 20aca11b3..d9ac3b81b 100644
--- a/packages/definitions/src/integration-url-template.ts
+++ b/packages/definitions/src/integration-url-template.ts
@@ -12,7 +12,8 @@ export const buildIntegrationUrl = (
   mode: UrlTemplateMode,
   dockerPort?: number,
 ): string => {
-  const host = baseHost.trim().replace(/\/+$/, "");
+  let host = baseHost.trim();
+  while (host.endsWith("/")) host = host.slice(0, -1);
   if (!host) return "";
 
   const slug = getSlugForKind(kind);
diff --git a/packages/definitions/src/integration.ts b/packages/definitions/src/integration.ts
index 30431c7d6..6f30db85d 100644
--- a/packages/definitions/src/integration.ts
+++ b/packages/definitions/src/integration.ts
@@ -474,7 +474,8 @@ export const getIntegrationDefaultPort = (kind: IntegrationKind): number | undef
 export const getIntegrationApiKeyUrl = (integrationUrl: string, kind: IntegrationKind): string | null => {
   const definition = integrationDefs[kind];
   if (!("apiKeySettingsPath" in definition)) return null;
-  const base = integrationUrl.replace(/\/+$/, "");
+  let base = integrationUrl;
+  while (base.endsWith("/")) base = base.slice(0, -1);
   if (!base) return null;
   return `${base}${definition.apiKeySettingsPath}`;
 };