{t.common.compliance_guidance}
+ {
+ setExternalRequestConfirmed(confirmed)
+ if (!confirmed) setPreviewApproved(false)
+ }}
+ rightsGuidance={text("compliance_notice")}
+ />
{text("compliance_notice")}
diff --git a/src/features/tools/log-scrubber/page.tsx b/src/features/tools/log-scrubber/page.tsx
index 7367203a..5f96b479 100644
--- a/src/features/tools/log-scrubber/page.tsx
+++ b/src/features/tools/log-scrubber/page.tsx
@@ -31,6 +31,8 @@ const OPTION_KEYS: OptionKey[] = [
"awsAccessKeys",
"privateKeys",
"urlCredentials",
+ "cookies",
+ "sessionIds",
]
export function LogScrubberPage() {
@@ -180,6 +182,22 @@ password=hunter2`)
{Object.keys(summary).length}
+ {text("manual_review_note")}
+
+ {Object.keys(summary).length > 0 && (
+
+
+ )}
diff --git a/src/features/tools/regex-tester/page.tsx b/src/features/tools/regex-tester/page.tsx
index ca9113ee..724332fb 100644
--- a/src/features/tools/regex-tester/page.tsx
+++ b/src/features/tools/regex-tester/page.tsx
@@ -1,12 +1,13 @@
"use client"
import * as React from "react"
-import { Regex, Eraser, TestTube2 } from "lucide-react"
+import { Regex, Eraser, TestTube2, Clock3, AlertTriangle } from "lucide-react"
import { useLang } from "@/core/i18n/lang-provider"
import { Input } from "@/components/ui/input"
import { Textarea } from "@/components/ui/textarea"
import { ToolActionBar, type ToolAction } from "@/features/tool-shell/tool-action-bar"
-import { testRegexPattern, type RegexMatchSummary } from "./utils"
+import { runRegexTestTask } from "./regex-test-task"
+import { type RegexMatchSummary } from "./utils"
const SAMPLE_PATTERN = "[A-Z][a-z]+"
const SAMPLE_FLAGS = "g"
@@ -20,21 +21,58 @@ export function RegexTesterPage() {
const [testString, setTestString] = React.useState(SAMPLE_TEST_STRING)
const [matches, setMatches] = React.useState{text("summary_title")}
+-
+ {Object.entries(summary).map(([type, count]) => (
+
- + {type} + {count} + + ))} +
{toolT.match_results_label}
-
- {matches.length}
+
+
+ {warnings.length > 0 && (
+ {
+ if (typeof Worker === "undefined") {
+ return testRegexPattern(pattern, flags, testString, options.maxMatches)
+ }
+
+ try {
+ return await runWorkerTask(
+ () => new Worker(new URL("./regex-test-worker.ts", import.meta.url), { type: "module" }),
+ { pattern, flags, testString, maxMatches: options.maxMatches },
+ { signal: options.signal, timeoutMs: options.timeoutMs ?? 1_000 },
+ )
+ } catch (error) {
+ if (error instanceof WorkerTaskError && error.code === "WORKER_TIMEOUT") {
+ return timeoutResult("Regex evaluation was stopped after the safety timeout. Simplify the pattern or test a smaller input.")
+ }
+ if (error instanceof WorkerTaskError && error.code === "WORKER_ABORTED") {
+ throw error
+ }
+ return testRegexPattern(pattern, flags, testString, options.maxMatches)
+ }
+}
diff --git a/src/features/tools/regex-tester/regex-test-worker.ts b/src/features/tools/regex-tester/regex-test-worker.ts
new file mode 100644
index 00000000..65c4c34d
--- /dev/null
+++ b/src/features/tools/regex-tester/regex-test-worker.ts
@@ -0,0 +1,29 @@
+import { testRegexPattern } from "./utils"
+
+type RegexTestWorkerInput = {
+ pattern: string
+ flags: string
+ testString: string
+ maxMatches?: number
+}
+
+self.onmessage = (event: MessageEvent) => {
+ const { pattern, flags, testString, maxMatches } = event.data
+
+ try {
+ self.postMessage({
+ ok: true,
+ value: testRegexPattern(pattern, flags, testString, maxMatches),
+ })
+ } catch (error) {
+ self.postMessage({
+ ok: false,
+ error: {
+ code: "REGEX_EVALUATION_FAILED",
+ message: error instanceof Error ? error.message : "Regex evaluation failed.",
+ },
+ })
+ }
+}
+
+export {}
diff --git a/src/features/tools/regex-tester/utils.ts b/src/features/tools/regex-tester/utils.ts
index 45f6e3c6..c24b4b14 100644
--- a/src/features/tools/regex-tester/utils.ts
+++ b/src/features/tools/regex-tester/utils.ts
@@ -10,18 +10,30 @@ export type RegexTestResult =
ok: true
matches: RegexMatchSummary[]
limited: boolean
+ elapsedMs: number
+ warnings: string[]
}
| {
ok: false
error: string
matches: []
limited: false
+ elapsedMs: number
+ warnings: string[]
}
const MAX_PATTERN_LENGTH = 500
const MAX_TEST_STRING_LENGTH = 20_000
+const SLOW_EVALUATION_MS = 50
const NESTED_QUANTIFIER_RE = /\((?:[^()\\]|\\.)*[+*](?:[^()\\]|\\.)*\)\s*[+*{]/
const REPEATED_GROUP_WITH_RANGE_RE = /\((?:[^()\\]|\\.)*\{(?:\d+,?\d*|,\d+)\}(?:[^()\\]|\\.)*\)\s*[+*{]/
+const AMBIGUOUS_ALTERNATION_RE = /\((?:[^()\\]|\\.)*\|(?:[^()\\]|\\.)*\)\s*[+*{]/
+
+function getNow(): number {
+ return typeof performance !== "undefined" && typeof performance.now === "function"
+ ? performance.now()
+ : Date.now()
+}
export function assessRegexSafety(pattern: string, testString: string): string | null {
if (pattern.length > MAX_PATTERN_LENGTH) {
@@ -36,14 +48,40 @@ export function assessRegexSafety(pattern: string, testString: string): string |
return null
}
+export function getRegexPerformanceWarnings(pattern: string, testString: string, elapsedMs = 0): string[] {
+ const warnings: string[] = []
+ if (NESTED_QUANTIFIER_RE.test(pattern) || REPEATED_GROUP_WITH_RANGE_RE.test(pattern)) {
+ warnings.push("Pattern contains nested quantifiers that can cause catastrophic backtracking.")
+ }
+ if (AMBIGUOUS_ALTERNATION_RE.test(pattern)) {
+ warnings.push("Pattern contains repeated alternation that may backtrack on long input.")
+ }
+ if (testString.length > MAX_TEST_STRING_LENGTH * 0.75) {
+ warnings.push("Large test input increases regex evaluation cost.")
+ }
+ if (elapsedMs >= SLOW_EVALUATION_MS) {
+ warnings.push(`Evaluation took ${Math.round(elapsedMs)} ms. Consider simplifying the pattern or testing a smaller sample.`)
+ }
+ return warnings
+}
+
export function testRegexPattern(pattern: string, flags: string, testString: string, maxMatches = 5_000): RegexTestResult {
+ const startedAt = getNow()
if (!pattern || testString === "") {
- return { ok: true, matches: [], limited: false }
+ return { ok: true, matches: [], limited: false, elapsedMs: 0, warnings: [] }
}
const safetyError = assessRegexSafety(pattern, testString)
if (safetyError) {
- return { ok: false, error: safetyError, matches: [], limited: false }
+ const elapsedMs = getNow() - startedAt
+ return {
+ ok: false,
+ error: safetyError,
+ matches: [],
+ limited: false,
+ elapsedMs,
+ warnings: getRegexPerformanceWarnings(pattern, testString, elapsedMs),
+ }
}
try {
@@ -74,13 +112,23 @@ export function testRegexPattern(pattern: string, flags: string, testString: str
}
}
- return { ok: true, matches, limited }
+ const elapsedMs = getNow() - startedAt
+ return {
+ ok: true,
+ matches,
+ limited,
+ elapsedMs,
+ warnings: getRegexPerformanceWarnings(pattern, testString, elapsedMs),
+ }
} catch (error) {
+ const elapsedMs = getNow() - startedAt
return {
ok: false,
error: error instanceof Error ? error.message : "Invalid regular expression.",
matches: [],
limited: false,
+ elapsedMs,
+ warnings: getRegexPerformanceWarnings(pattern, testString, elapsedMs),
}
}
}
diff --git a/src/features/tools/vimeo-thumbnail-grabber/page.tsx b/src/features/tools/vimeo-thumbnail-grabber/page.tsx
index eff155ba..abffc9ed 100644
--- a/src/features/tools/vimeo-thumbnail-grabber/page.tsx
+++ b/src/features/tools/vimeo-thumbnail-grabber/page.tsx
@@ -7,6 +7,7 @@ import { useLang } from "@/core/i18n/lang-provider"
import { Input } from "@/components/ui/input"
import { Textarea } from "@/components/ui/textarea"
import { ToolActionBar, type ToolAction } from "@/features/tool-shell/tool-action-bar"
+import { ExternalRequestConfirmation } from "@/features/tool-shell/external-request-confirmation"
import { ToolPreviewArea } from "@/features/tool-shell/tool-preview-area"
import { safeClipboardWrite } from "@/core/clipboard/clipboard"
import {
@@ -17,6 +18,7 @@ import {
} from "@/core/utils/thumbnail-grabber-utils"
const SAMPLE_URL = "https://vimeo.com/76979871"
+const EXTERNAL_HOSTS = ["vimeo.com", "player.vimeo.com", "vumbnail.com"] as const
export function VimeoThumbnailGrabberPage() {
const { t } = useLang()
@@ -40,6 +42,7 @@ export function VimeoThumbnailGrabberPage() {
const [selectedUrl, setSelectedUrl] = React.useState("")
const [status, setStatus] = React.useState(statusIdle)
const [previewApproved, setPreviewApproved] = React.useState(false)
+ const [externalRequestConfirmed, setExternalRequestConfirmed] = React.useState(false)
React.useEffect(() => {
const id = parseVimeoVideoId(url)
@@ -48,6 +51,7 @@ export function VimeoThumbnailGrabberPage() {
setCandidates([])
setSelectedUrl("")
setPreviewApproved(false)
+ setExternalRequestConfirmed(false)
setStatus(url.trim() ? statusInvalid : statusIdle)
return
}
@@ -57,6 +61,7 @@ export function VimeoThumbnailGrabberPage() {
setCandidates(next)
setSelectedUrl(next[0]?.url || "")
setPreviewApproved(false)
+ setExternalRequestConfirmed(false)
setStatus(statusReady)
}, [statusAutoSelectedTemplate, statusIdle, statusInvalid, statusReady, statusUnreachable, url])
@@ -75,9 +80,16 @@ export function VimeoThumbnailGrabberPage() {
)
const handleSample = () => setUrl(SAMPLE_URL)
- const handleReset = () => setUrl("")
+ const handleReset = () => {
+ setUrl("")
+ setExternalRequestConfirmed(false)
+ }
const handleLoadPreview = () => {
if (candidates.length === 0) return
+ if (!externalRequestConfirmed) {
+ toast.error(t.common.external_network_notice.confirm_required)
+ return
+ }
setPreviewApproved(true)
setStatus(statusReady)
void (async () => {
@@ -102,6 +114,10 @@ export function VimeoThumbnailGrabberPage() {
const handleDownload = () => {
if (!selectedUrl) return
+ if (!externalRequestConfirmed) {
+ toast.error(t.common.external_network_notice.confirm_required)
+ return
+ }
const filename = `vimeo-thumbnail-${videoId || "image"}.jpg`
const anchor = document.createElement("a")
anchor.href = selectedUrl
@@ -120,8 +136,10 @@ export function VimeoThumbnailGrabberPage() {
label: t.common.preview,
icon: ImageDown,
onClick: handleLoadPreview,
- disabled: candidates.length === 0,
- disabledReason: t.common.action_disabled_input_required,
+ disabled: candidates.length === 0 || !externalRequestConfirmed,
+ disabledReason: candidates.length === 0
+ ? t.common.action_disabled_input_required
+ : t.common.external_network_notice.confirm_required,
},
{ id: "copy", label: t.common.copy, icon: Copy, onClick: () => void handleCopy() },
{
@@ -129,10 +147,12 @@ export function VimeoThumbnailGrabberPage() {
label: t.common.download,
icon: Download,
onClick: handleDownload,
- disabled: !selectedUrl || !previewApproved,
+ disabled: !selectedUrl || !previewApproved || !externalRequestConfirmed,
disabledReason: !selectedUrl
? t.common.action_disabled_no_output
- : t.common.action_disabled_preview_required,
+ : !externalRequestConfirmed
+ ? t.common.external_network_notice.confirm_required
+ : t.common.action_disabled_preview_required,
},
]
@@ -166,6 +186,17 @@ export function VimeoThumbnailGrabberPage() {
+
+ )}
{matches.length === 0 ? (
+
+ -
+ {warnings.map((warning) => (
+
- {warning} + ))} +
-
) : (
matches.map((m, i) => (
diff --git a/src/features/tools/regex-tester/regex-test-task.ts b/src/features/tools/regex-tester/regex-test-task.ts
new file mode 100644
index 00000000..a9e417ca
--- /dev/null
+++ b/src/features/tools/regex-tester/regex-test-task.ts
@@ -0,0 +1,53 @@
+import { runWorkerTask, WorkerTaskError } from "@/core/workers/run-worker-task"
+import { testRegexPattern, type RegexTestResult } from "./utils"
+
+type RegexTestWorkerInput = {
+ pattern: string
+ flags: string
+ testString: string
+ maxMatches?: number
+}
+
+type RegexTestTaskOptions = {
+ signal?: AbortSignal
+ timeoutMs?: number
+ maxMatches?: number
+}
+
+function timeoutResult(message: string): RegexTestResult {
+ return {
+ ok: false,
+ error: message,
+ matches: [],
+ limited: false,
+ elapsedMs: 0,
+ warnings: [message],
+ }
+}
+
+export async function runRegexTestTask(
+ pattern: string,
+ flags: string,
+ testString: string,
+ options: RegexTestTaskOptions = {},
+): Promise{error ? toolT.empty_state_error : toolT.empty_state_no_match}
+{isEvaluating ? toolT.evaluating_label : error ? toolT.empty_state_error : toolT.empty_state_no_match}
{t.common.compliance_guidance}
+ {
+ setExternalRequestConfirmed(confirmed)
+ if (!confirmed) setPreviewApproved(false)
+ }}
+ rightsGuidance={t.common.thumbnail_public_only_notice}
+ />
{t.common.compliance_guidance}
+ {
+ setExternalRequestConfirmed(confirmed)
+ if (!confirmed) setPreviewApproved(false)
+ }}
+ rightsGuidance={t.common.thumbnail_public_only_notice}
+ />
+ {ui}
+ ,
+ )
+}
+
+describe("external request media tools", () => {
+ beforeEach(() => {
+ toastErrorMock.mockClear()
+ toastSuccessMock.mockClear()
+ toastInfoMock.mockClear()
+ vi.stubGlobal("Image", MockImage)
+ vi.stubGlobal("fetch", vi.fn())
+ vi.spyOn(HTMLAnchorElement.prototype, "click").mockImplementation(() => undefined)
+ window.history.replaceState(null, "", "/en/youtube-thumbnail-grabber")
+ })
+
+ afterEach(() => {
+ vi.restoreAllMocks()
+ vi.unstubAllGlobals()
+ })
+
+ it("keeps YouTube thumbnail requests behind explicit confirmation", async () => {
+ renderEnglish(
+bad
+
+`
+
+function expectNoExecutableMarkup(output: string) {
+ expect(output).not.toMatch(/ {
+ const tags = buildOpenGraphMetaTags({
+ title: `">`,
+ description: `
`,
+ url: "javascript:alert(1)",
+ image: "https://evil.example/og.png",
+ type: "website",
+ siteName: "byteflow.tools",
+ twitterCard: "summary_large_image",
+ twitterSite: "@byteflow",
+ })
+ const document = buildOpenGraphSnippetDocument(tags)
+
+ expect(document).toContain("<script>alert(1)</script>")
+ expect(document).toContain("<img src=x onerror=alert(1)>")
+ expect(document).not.toContain("javascript:alert(1)")
+ expect(document).not.toContain("
Safe title
+ + +
+bad
+
+`
+
+function expectNoExecutableMarkup(output: string) {
+ expect(output).not.toMatch(/