fix(compatibility): bound derived const/enum vs base pattern match by Artifizer · Pull Request #25 · GlobalTypeSystem/gts-ts

Artifizer · 2026-09-30T12:51:06Z

The OP#8 compatibility carve-out that matches a derived const/enum value against the base pattern compiled the pattern with a raw RegExp and tested it directly, bypassing the ReDoS-safe engine used everywhere else (regex-engine.ts). An untrusted schema pattern such as ^(a+)+$ matched against a long non-matching value could backtrack catastrophically and hang compatibility checking (CWE-1333).

Route the match through compileSafePattern so it runs on the bounded engine, and treat a match timeout as an inconclusive unknown verdict instead of letting it hang. Add a unit test asserting the check stays bounded and still returns the provable incompatible verdict.

Summary by CodeRabbit

Bug Fixes
- Schema compatibility checks now handle complex pattern matching more reliably, avoiding excessive delays and returning appropriate compatibility results for problematic patterns.

The OP#8 compatibility carve-out that matches a derived const/enum value against the base `pattern` compiled the pattern with a raw `RegExp` and tested it directly, bypassing the ReDoS-safe engine used everywhere else (regex-engine.ts). An untrusted schema pattern such as `^(a+)+$` matched against a long non-matching value could backtrack catastrophically and hang compatibility checking (CWE-1333). Route the match through `compileSafePattern` so it runs on the bounded engine, and treat a match timeout as an inconclusive `unknown` verdict instead of letting it hang. Add a unit test asserting the check stays bounded and still returns the provable `incompatible` verdict. Signed-off-by: Artifizer <artifizer@gmail.com>

coderabbitai · 2026-09-30T12:51:19Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9c9ca9c3-3956-4a8b-ba71-e9d9b0c286a8

📥 Commits

Reviewing files that changed from the base of the PR and between 1582fa4 and 707eb81.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

package.json
src/compatibility.ts
tests/compatibility.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

Compatibility checks now use bounded pattern matching when comparing pinned string values with schema patterns. A regression test covers a pathological pattern and long nonmatching value. The package version changes from 0.8.0 to 0.8.1.

Changes

Compatibility pattern matching

Layer / File(s)	Summary
Bounded matching and regression coverage `src/compatibility.ts`, `tests/compatibility.test.ts`, `package.json`	`compareNarrowing` uses `compileSafePattern` for pinned string values. Matching errors produce an `unknown` verdict, and the comparison continues to the next narrowing keyword. The regression test checks completion within two seconds and verifies the forward verdict is `incompatible`. The package version changes to `0.8.1`.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: gerabart

Merge Risk: ⚪ Minimal · up to 707eb

Compatibility checks on pinned string values now use bounded pattern matching, so catastrophic patterns should no longer hang. No merge-blocking risk was found.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 707eb

The change bounds an existing denial-of-service path without adding access or privileges. Timeouts remain inconclusive rather than successful. Actual trait values are still independently validated, but the new regression does not exercise timeout-specific admission behavior.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

inferred — The directly affected attack surface is compatibility work over caller-supplied schema patterns and pinned values, including downstream trait checks. The inspected change adds execution containment to an existing reachable operation, not a new privilege or identity transition.

Trust Boundaries and Controls

observed — Trait admission's acceptance of unknown predates this PR; timeout adds another reason for that outcome. Materialized values are still checked against the composed trait schema, and validation errors or matching exceptions return failure. This limits the unresolved narrowing case without proving every unmaterialized declaration satisfiable.

Resilience and Maintainability Implications

observed — Cast success and schema compatibility remain separate contracts. Casting deep-copies the input, validates the transformed target, and returns rather than persists the result. An unknown compatibility verdict alone therefore does not establish a cast-validation bypass or partial store mutation.

Hardening Proposals

proposed — Add focused timeout-path coverage through compatibility and trait admission to document the intended distinction between an inconclusive narrowing check and successful concrete-value validation, including validation failure and staged-entry cleanup.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main compatibility fix: bounding derived const/enum checks against base patterns.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

code-ranker-app · 2026-09-30T12:51:36Z

code-ranker View diff report ↗

ts

Metric	Baseline	Current	Δ
sum always
Edges	59	60	+1
Complexity
cognitive — Cognitive complexity	126	126	$\color{#c0392b}{+0.227}$
cyclomatic — Cyclomatic complexity	113	113	$\color{#c0392b}{+0.045}$
Coupling
fan_in — Incoming dependencies	2.8	2.9	+0.048
fan_out — Outgoing dependencies	3.3	3.3	+0.056
hk — God-object risk	371.6K	373.8K	$\color{#c0392b}{+2134}$
Halstead
bugs — Estimated bugs	3.9	3.9	$\color{#c0392b}{+0.002}$
effort — Implementation effort	2.4M	2.4M	$\color{#c0392b}{+1267}$
length — Total tokens	2202	2203	$\color{#c0392b}{+1.2}$
time — Coding time (s)	133.7K	133.7K	$\color{#c0392b}{+70.4}$
vocabulary — Distinct symbols	250	250	$\color{#c0392b}{+0.087}$
volume — Code volume	20.1K	20.1K	$\color{#c0392b}{+12.1}$
Lines of Code
cloc — Comment lines	109	110	+0.429
sloc — Source lines	360	360	+0.261

_{baseline main @1582fa4 2026-09-30 08:03 UTC · updated 2026-09-30 12:56 UTC}

Signed-off-by: Artifizer <artifizer@gmail.com>

chore: update gts-ts to 0.8.1

707eb81

Signed-off-by: Artifizer <artifizer@gmail.com>

GeraBart approved these changes Sep 30, 2026

View reviewed changes

Artifizer merged commit 3b87cb2 into main Sep 30, 2026
10 checks passed

Navigation Menu

fix(compatibility): bound derived const/enum vs base pattern match - #25

fix(compatibility): bound derived const/enum vs base pattern match#25
Artifizer merged 2 commits into
mainfrom
gts-0.6.0

Artifizer commented Sep 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Sep 30, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

code-ranker-app Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Artifizer commented Sep 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Security Architecture Review

Uh oh!

code-ranker-app Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

code-ranker View diff report ↗

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Artifizer commented Sep 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 30, 2026 •

edited

Loading

code-ranker-app Bot commented Sep 30, 2026 •

edited

Loading