fix(security): resolve ReDoS vulnerability in function execute tag pattern

waleedlatif1 · waleedlatif1 · commit 6073770c6b62 · 2026-04-13T19:59:30.000-07:00
Simplified regex to eliminate overlapping quantifiers that caused exponential
backtracking on malformed input without closing delimiter.
diff --git a/apps/sim/app/api/function/execute/route.ts b/apps/sim/app/api/function/execute/route.ts
@@ -494,7 +494,7 @@ function resolveTagVariables(
   const undefinedLiteral = language === 'python' ? 'None' : 'undefined'
 
   const tagPattern = new RegExp(
-    `${REFERENCE.START}([a-zA-Z_](?:[a-zA-Z0-9_${REFERENCE.PATH_DELIMITER}]*[a-zA-Z0-9_])?)${REFERENCE.END}`,
+    `${REFERENCE.START}([a-zA-Z_][a-zA-Z0-9_${REFERENCE.PATH_DELIMITER}]*)${REFERENCE.END}`,
     'g'
   )
   const tagMatches = resolvedCode.match(tagPattern) || []

Original file line number	Diff line number	Diff line change
`@@ -494,7 +494,7 @@ function resolveTagVariables(`
`494`	`494`	`const undefinedLiteral = language === 'python' ? 'None' : 'undefined'`
`495`	`495`
`496`	`496`	`const tagPattern = new RegExp(`
`497`		- `${REFERENCE.START}([a-zA-Z_](?:[a-zA-Z0-9_${REFERENCE.PATH_DELIMITER}]*[a-zA-Z0-9_])?)${REFERENCE.END}`,
	`497`	+ `${REFERENCE.START}([a-zA-Z_][a-zA-Z0-9_${REFERENCE.PATH_DELIMITER}]*)${REFERENCE.END}`,
`498`	`498`	`'g'`
`499`	`499`	`)`
`500`	`500`	`const tagMatches = resolvedCode.match(tagPattern) \|\| []`