From 781861f799321a6443c3fcc4714d9eb90d7a6852 Mon Sep 17 00:00:00 2001 From: jubnl Date: Mon, 6 Apr 2026 20:12:29 +0200 Subject: [PATCH] test: relax ReDoS timing thresholds for CI compatibility MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit MAPS-024 and MAPS-026 were asserting < 100ms on adversarial regex input, which passed locally but flaked on CI runners (~150-170ms). These are not cases of catastrophic backtracking — true ReDoS would take seconds, not ~150ms. Raise the threshold to 500ms to remain meaningful while being reliable across environments. --- server/tests/unit/services/mapsService.test.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/server/tests/unit/services/mapsService.test.ts b/server/tests/unit/services/mapsService.test.ts index daf1eba1..6dd98dd0 100644 --- a/server/tests/unit/services/mapsService.test.ts +++ b/server/tests/unit/services/mapsService.test.ts @@ -283,11 +283,11 @@ describe('resolveGoogleMapsUrl coordinate extraction (ReDoS guards)', () => { expect(result.name).toBe('Eiffel Tower'); }); - it('MAPS-024 (ReDoS): /@(-?\\d+\\.?\\d*),(-?\\d+\\.?\\d*)/ on adversarial input < 100ms', () => { + it('MAPS-024 (ReDoS): /@(-?\\d+\\.?\\d*),(-?\\d+\\.?\\d*)/ on adversarial input < 500ms', () => { const adversarial = '/@' + '1'.repeat(10000) + '.'; const start = Date.now(); adversarial.match(/@(-?\d+\.?\d*),(-?\d+\.?\d*)/); - expect(Date.now() - start).toBeLessThan(100); + expect(Date.now() - start).toBeLessThan(500); }); it('MAPS-025 (ReDoS): /!3d(-?\\d+\\.?\\d*)!4d/ on adversarial input < 500ms', () => { @@ -297,11 +297,11 @@ describe('resolveGoogleMapsUrl coordinate extraction (ReDoS guards)', () => { expect(Date.now() - start).toBeLessThan(500); }); - it('MAPS-026 (ReDoS): /[?&]q=(-?\\d+\\.?\\d*)/ on adversarial input < 100ms', () => { + it('MAPS-026 (ReDoS): /[?&]q=(-?\\d+\\.?\\d*)/ on adversarial input < 500ms', () => { const adversarial = '?q=' + '1'.repeat(10000) + '.'; const start = Date.now(); adversarial.match(/[?&]q=(-?\d+\.?\d*),(-?\d+\.?\d*)/); - expect(Date.now() - start).toBeLessThan(100); + expect(Date.now() - start).toBeLessThan(500); }); it('MAPS-027 (ReDoS): /<[^>]+>/ HTML strip on adversarial input < 100ms', () => {