| @equinor/fusion-framework-module-navigation | patch |
|---|
Security Fix: Replaced regex-based pathname normalization with iterative approach to prevent potential ReDoS (Regular Expression Denial of Service) vulnerability when processing user-controlled basename values.
The normalizePathname function now uses a simple character-by-character scan instead of /\/+/g regex, ensuring O(n) linear time complexity even with pathological input containing thousands of consecutive slashes.
This addresses CodeQL security alert: "Polynomial regular expression used on uncontrolled data"
Related: #4751