fix: `matchGlobs` function to correctly handle negation patterns #488

Annotations

10 errors and 1 warning

The quantifier '[^\s'"]+' can exchange characters with '.+?'. Using any string accepted by /:+/, this can be exploited to cause at least polynomial backtracking

src/core/declaration.ts#L14

The quantifier '[^\s'"]+' can exchange characters (:) with '.+?'. This makes the capturing group misleading, because the quantifier will capture fewer characters than its pattern suggests

src/core/declaration.ts#L14

The quantifier '\s*' can exchange characters with '.+?'. Using any string accepted by /[\t\x0b\f \xa0\u1680\u2000-\u200a\u202f\u205f\u3000\ufeff]+/, this can be exploited to cause at least polynomial backtracking

src/core/declaration.ts#L29

Unescaped source character '{'

src/core/declaration.ts#L29

Capturing group number 1 is defined but never used

src/core/declaration.ts#L29

Unescaped source character '}'

src/core/declaration.ts#L33

Unescaped source character '{'

src/core/declaration.ts#L33

Capturing group number 1 is defined but never used

src/core/declaration.ts#L33

Unescaped source character '}'