From 216a82fb3059938d348ca01718edeafa91bf52a9 Mon Sep 17 00:00:00 2001
From: martin veillette <martin.veillette@gmail.com>
Date: Wed, 12 Aug 2026 14:07:17 -0400
Subject: [PATCH] fix: add cdn sri, escape overlay html, and bound version
 regex

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 examples/code-playground.html | 16 ++++++++--------
 src/cd48.ts                   |  7 +++++--
 src/dev-utils.ts              |  2 +-
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/examples/code-playground.html b/examples/code-playground.html
index d920994..2a0b5cf 100644
--- a/examples/code-playground.html
+++ b/examples/code-playground.html
@@ -357,19 +357,19 @@ <h1>Live Code Playground</h1>
       </div>
     </div>
 
-    <!-- CodeMirror JS -->
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/codemirror.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/mode/javascript/javascript.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/edit/closebrackets.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/edit/matchbrackets.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/hint/show-hint.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/hint/javascript-hint.min.js"></script>
+    <!-- CodeMirror JS (SRI: cdnjs CodeMirror 5.65.20) -->
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/codemirror.min.js" integrity="sha512-hJEMjfR4ds7mXbBot3i/R+CsiyYpeWSezXul8uLBT8wXAHPUdhRgl4LLTtMGwjarftGKiQqK1v20XScm0ANTPQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/mode/javascript/javascript.min.js" integrity="sha512-Cbz+kvn+l5pi5HfXsEB/FYgZVKjGIhOgYNBwj4W2IHP2y8r3AdyDCQRnEUqIQ+6aJjygKPTyaNT2eIihaykJlw==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/edit/closebrackets.min.js" integrity="sha512-tsjcYO5hFvViRssxiM7Jhd8601epWOx1He3Hl4yuI5dKKPxr43KxkOhc9GZeeqzlYJm9ABb7UPA9697NiqZZ7Q==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/edit/matchbrackets.min.js" integrity="sha512-GSYCbN/le5gNmfAWVEjg1tKnOH7ilK6xCLgA7c48IReoIR2g2vldxTM6kZlN6o3VtWIe6fHu/qhwxIt11J8EBA==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/hint/show-hint.min.js" integrity="sha512-+Vu6KfeJ+ak4ipbxtjUR3b1M/yklDlglRB/03ZsMzu1E/FQ+AL7D88THTyigWmh0xqXnP7pV9myEqac9C2N+2A==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/hint/javascript-hint.min.js" integrity="sha512-omIxBxPdObb7b3giwJtPBiB86Mey/ds7qyKFcRiaLQgDxoSR+UgCYEFO7jRZzPOCZAICabGCraEhOSa71U1zFA==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
 
     <script type="module">
       import CD48, { setupDevMode } from '../dist/cd48.esm.js';
 
       // Setup dev mode
-      const { logger } = setupDevMode({
+      setupDevMode({
         logger: { enabled: true, level: 'debug' },
         showOverlay: true,
       });
diff --git a/src/cd48.ts b/src/cd48.ts
index 6422b16..142dae7 100644
--- a/src/cd48.ts
+++ b/src/cd48.ts
@@ -354,8 +354,11 @@ class CD48 {
     minor: number;
     patch: number;
   } {
-    // Extract version number pattern (e.g., "1.2.3" or "1.2")
-    const match = versionString.match(/(\d+)\.(\d+)(?:\.(\d+))?/);
+    // Extract version number pattern (e.g., "1.2.3" or "1.2"). Bounded repeats
+    // avoid polynomial backtracking on crafted inputs (CodeQL js/polynomial-redos).
+    const match = versionString.match(
+      /(\d{1,10})\.(\d{1,10})(?:\.(\d{1,10}))?/
+    );
     if (match !== null) {
       return {
         major: Number.parseInt(match[1] ?? '0', DECIMAL_RADIX),
diff --git a/src/dev-utils.ts b/src/dev-utils.ts
index 3519012..7fbf307 100644
--- a/src/dev-utils.ts
+++ b/src/dev-utils.ts
@@ -290,7 +290,7 @@ export class ErrorOverlay {
 
         <div style="background: #1a1f3a; padding: 20px; border-radius: 8px; margin-bottom: 20px; border-left: 4px solid #ef4444;">
           <div style="color: #ef4444; font-weight: bold; margin-bottom: 10px;">
-            ${error.name !== '' ? error.name : 'Error'}
+            ${this.escapeHtml(error.name !== '' ? error.name : 'Error')}
           </div>
           <div style="color: #eee; font-size: 16px; margin-bottom: 15px;">
             ${this.escapeHtml(error.message)}