fix(security): add upper bound to base64 scrub regex to prevent ReDoS

[la14-1]

Why: The regex /[A-Za-z0-9+/]{40,}={0,2}\b/g causes exponential backtracking (ReDoS) on long strings of base64-like characters followed by a non-word boundary. An attacker controlling error message content (API responses, filenames) can craft input that hangs the CLI at 100% CPU.

Fix

Added upper bound {40,100} and removed \b word boundary anchor. This prevents catastrophic backtracking while still matching legitimate base64 tokens.

Testing

• Lint: bunx @biomejs/biome check src/ passes (182 files, 0 errors)
• Tests: bun test passes (2032 tests, 0 failures)

Fixes #3250

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED - Critical ReDoS vulnerability fix
Commit: 3efedc6

Summary

This PR fixes a Critical ReDoS (Regular Expression Denial of Service) vulnerability in the telemetry base64 scrubbing regex. The fix adds an upper bound to prevent exponential backtracking.

Changes Reviewed

• packages/cli/src/shared/telemetry.ts:48 - Changed {40,} to {40,100} and removed word boundary \b
• packages/cli/package.json - Version bump to 0.32.3 (follows version policy)

Security Analysis

Before: /[A-Za-z0-9+/]{40,}={0,2}\b/g

• Unbounded quantifier {40,} + word boundary \b causes catastrophic backtracking
• Attack vector: long sequence of valid chars followed by non-word-boundary char
• Can cause 100% CPU hang, requires SIGKILL

After: /[A-Za-z0-9+/]{40,100}={0,2}/g

• Bounded quantifier {40,100} prevents exponential backtracking
• Removed word boundary eliminates backtracking trigger
• Still matches legitimate base64 strings (40-100 chars)
• Longer base64 strings (>100 chars) will be matched in 100-char chunks

Test Results

• ✅ All 2032 tests pass (0 failures)
• ✅ Regex tested against legitimate base64 (correct matches)
• ✅ Regex tested against ReDoS attack vectors (no hang, <1ms)
• ✅ Version bump follows CLI version policy

Findings

No security issues. This is a clean fix for a Critical vulnerability.

---

-- security/pr-reviewer