fix(images): avoid backtracking in data URI parameter parsing (#31882)

src/shared/image-data-uri.test.ts

@@ -1,3 +1,4 @@
+import { runInNewContext } from 'node:vm'
 import { describe, expect, it } from 'vitest'
 import { buildImageDataUri, validateRasterImageDataUri } from './image-data-uri'
 
@@ -58,6 +59,28 @@ describe('buildImageDataUri', () => {
 })
 
 describe('validateRasterImageDataUri', () => {
+  it('preserves malformed parameter lists without exponential backtracking', () => {
+    const input = `data:image/png;${';'.repeat(32_768)}`
+    const result = runInNewContext(
+      'validate(input)',
+      { validate: validateRasterImageDataUri, input },
+      {
+        timeout: 250
+      }
+    )
+    expect(result).toBe(input)
+  })
+
+  it('finds base64 among multiple parameters and preserves payload commas', () => {
+    const content = pngBase64()
+    expect(validateRasterImageDataUri(`data:image/png;charset=utf-8;;BASE64;,${content}`)).toBe(
+      `data:image/png;base64,${content}`
+    )
+    expect(validateRasterImageDataUri('data:text/plain;charset=utf-8,one,two')).toBe(
+      'data:text/plain;charset=utf-8,one,two'
+    )
+  })
+
   it('accepts a safe inline raster and rejects an oversized one', () => {
     const safe = `data:image/png;base64,${pngBase64()}`
     expect(validateRasterImageDataUri(safe)).toBe(safe)

src/shared/image-data-uri.ts

@@ -29,7 +29,7 @@ export function buildImageDataUri(
 
 /** Preserves non-raster data URIs and rejects unsafe known-raster data URIs. */
 export function validateRasterImageDataUri(dataUri: string): string | null {
-  const match = /^data:([^;,]+)((?:;[^,]*)*),([\s\S]*)$/i.exec(dataUri)
+  const match = /^data:([^;,]+)((?:;[^,]*)?),([\s\S]*)$/i.exec(dataUri)
   if (!match || !isKnownRasterImageMimeType(match[1])) {
     return dataUri
   }