CLI error-envelope URL redaction uses a quadratic regex on server-controlled text (CodeQL, ReDoS) #2540

Problem

CodeQL flagged this on the v2.9.0 milestone-merge PR (#2536) as high severity: "Polynomial regular expression used on uncontrolled data". I confirmed it in the running CLI.

clients/cli/src/error-handler.ts:169 strips trailing punctuation off every URL embedded in an error message with TRAILING_PUNCTUATION = /[.,;:!?)\]']+$/. A […]+$ with no start anchor is quadratic: on a long run of those characters that does not end the string, the engine rescans the run from every start position.

The input is uncontrolled. The CLI copies an HTTP error body into its error message (Error POSTing to endpoint: <body>), so the server under inspection chooses it.

Measured

• The regex alone on http://a/? + n × ! + x: 5k → 17 ms, 10k → 61 ms, 20k → 238 ms, 40k → 857 ms (quadratic).
• End to end, a server answering 400 with see http://a/? + 60,000 × ! + x: the RC CLI took 3 s to emit its error envelope, against 0 s on 2.8.0. A larger body hangs the CLI for minutes.

Regression in this milestone: it came in with #2423's envelope redaction (PR #2488).

Expected

The trailing-punctuation split is linear: scan back from the end over the punctuation set instead of using an unanchored +$ regex. Behavior is otherwise unchanged (…?code=abc. keeps its full stop, a '…'-quoted URL loses its closing quote).