fix(dart): linear regexes for the main( scan and env-var trailing separators (CodeQL, #790)

CodeQL flagged two polynomial-ReDoS sites on PR #880:

- adapter-policy-dart.ts: the string-literal blanking regex used a
  backreference form whose escape branch overlapped its "not the quote"
  branch; an unterminated literal of escaped quotes backtracked
  polynomially. Replaced by the disjoint form
  "(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*' in one pass, same semantics.
- sdk-locator.ts: `/[\\/]+$/` on an env var is quadratic on a long run of
  separators; stripped with a loop instead.

Guard tests: 20 000 escaped quotes before `main(`, and 40 000 trailing
separators on DART_SDK.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: cynarlab

packages/adapter-dart/src/utils/sdk-locator.ts

@@ -73,7 +73,10 @@ export function locateToolchain(io: LocatorIo): DartToolchain {
   /** Accept either the install root or the executable itself for an env var. */
   const rootFromEnv = (value: string | undefined, exeName: string): string | undefined => {
     if (!value) return undefined;
-    const trimmed = value.trim().replace(/[\\/]+$/, '');
+    // Trailing separators stripped by hand: `/[\\/]+$/` backtracks quadratically on a long run
+    // of separators (CodeQL polynomial-ReDoS).
+    let trimmed = value.trim();
+    while (trimmed.endsWith('/') || trimmed.endsWith('\\')) trimmed = trimmed.slice(0, -1);
     if (trimmed.toLowerCase().endsWith(exeName.toLowerCase())) return up(p, trimmed, 2);
     return trimmed;
   };

packages/adapter-dart/tests/unit/sdk-locator.test.ts

@@ -54,6 +54,16 @@ describe('locateToolchain (win32)', () => {
     expect(t.flutterRoot).toBe(root);
   });
 
+  it('strips trailing separators from an env var, however many (no quadratic regex)', () => {
+    const sdk = 'C:\\tools\\dart-sdk';
+    const t = locateToolchain(io({
+      env: { DART_SDK: sdk + '\\'.repeat(20_000) + '/'.repeat(20_000) },
+      files: [W(sdk, 'bin', 'dart.exe')],
+    }));
+    expect(t.dartSdkRoot).toBe(sdk);
+    expect(t.dartSource).toBe('env:DART_SDK');
+  });
+
   it('ignores an env var whose directory has no SDK and keeps looking', () => {
     const t = locateToolchain(io({
       env: { FLUTTER_ROOT: 'C:\\nope' },

packages/shared/src/interfaces/adapter-policy-dart.ts

@@ -36,9 +36,15 @@ function isAsyncGap(frame: StackFrame): boolean {
 
 /** The `main(` declaration; the VM binds a breakpoint on that line to main's first statement. */
 const MAIN_DECLARATION = /\bmain\s*\(/;
+/**
+ * A string literal of either quote kind. The alternatives inside are disjoint (a backslash is
+ * consumed only by the escape branch), so the match is linear in the line — CodeQL's
+ * polynomial-ReDoS check rejects the backreference form `(["'])(?:\\.|(?!\1).)*\1`.
+ */
+const STRING_LITERAL = /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g;
 /** A line with its `//` comment and string literals blanked, so `main(` inside them does not count. */
 const codeOnly = (line: string): string =>
-  line.replace(/(["'])(?:\\.|(?!\1).)*\1/g, '""').replace(/\/\/.*$/, '');
+  line.replace(STRING_LITERAL, '""').replace(/\/\/.*$/, '');
 
 export const DartAdapterPolicy = {
   name: 'dart',

packages/shared/tests/unit/adapter-policy-dart.test.ts

@@ -37,6 +37,16 @@ describe('DartAdapterPolicy', () => {
     expect(DartAdapterPolicy.entryBreakpointLine('final remains = 1; // "main(" in a comment should not count\nvoid main() {}\n')).toBe(2);
   });
 
+  it('blanks string literals without backtracking: escaped quotes, an unterminated literal, both quote kinds', () => {
+    // `main(` inside a literal never counts, whatever the escaping.
+    expect(DartAdapterPolicy.entryBreakpointLine('final s = "main(\\" main(";\nvoid main() {}\n')).toBe(2);
+    expect(DartAdapterPolicy.entryBreakpointLine("final s = 'it\\'s main(';\nvoid main() {}\n")).toBe(2);
+    // An unterminated literal made of thousands of escaped quotes (CodeQL's polynomial-ReDoS
+    // shape for the former backreference regex) is handled, and the next line still wins.
+    const hostile = 'final s = "' + '\\"'.repeat(20_000) + ';\nvoid main() {}\n';
+    expect(DartAdapterPolicy.entryBreakpointLine(hostile)).toBe(2);
+  });
+
   it('maps break-on-exception modes to the SDK filter ids', () => {
     expect(resolveExceptionFilters(DartAdapterPolicy, 'uncaught')).toEqual(['Unhandled']);
     expect(resolveExceptionFilters(DartAdapterPolicy, 'all')).toEqual(['All']);