fix(media-embed): remove ReDoS-prone regexes in host-gated providers

Replace the unbounded '.*' patterns flagged by CodeQL (js/polynomial-redos) in
the YouTube, Facebook, and Giphy branches with bounded extraction off the parsed
URL (pathname / searchParams). Eliminates the O(n^2) backtracking a crafted
valid-host URL could trigger, with no change to matched links.

Author: waleedlatif1

packages/utils/src/media-embed.test.ts

@@ -7,6 +7,25 @@ describe('getEmbedInfo', () => {
     expect(getEmbedInfo('https://www.youtube.com/watch?v=dQw4w9WgXcQ')).toEqual(expected)
     expect(getEmbedInfo('https://youtu.be/dQw4w9WgXcQ')).toEqual(expected)
     expect(getEmbedInfo('https://www.youtube.com/embed/dQw4w9WgXcQ')).toEqual(expected)
+    // Extra query params around v= still resolve.
+    expect(getEmbedInfo('https://www.youtube.com/watch?list=RD&v=dQw4w9WgXcQ&t=5')).toEqual(
+      expected
+    )
+  })
+
+  it('maps Facebook and fb.watch video links to the video plugin', () => {
+    expect(getEmbedInfo('https://www.facebook.com/some.page/videos/1234567890')).toEqual({
+      url: 'https://www.facebook.com/plugins/video.php?href=https%3A%2F%2Fwww.facebook.com%2Fsome.page%2Fvideos%2F1234567890&show_text=false',
+      type: 'iframe',
+    })
+    expect(getEmbedInfo('https://fb.watch/abc123')?.type).toBe('iframe')
+    expect(getEmbedInfo('https://www.facebook.com/some.page/about')).toBeNull()
+  })
+
+  it('extracts the Giphy id from the trailing slug token', () => {
+    const expected = { url: 'https://giphy.com/embed/abc123', type: 'iframe', aspectRatio: '1/1' }
+    expect(getEmbedInfo('https://giphy.com/gifs/funny-cat-abc123')).toEqual(expected)
+    expect(getEmbedInfo('https://giphy.com/embed/abc123')).toEqual(expected)
   })
 
   it('maps Vimeo and Spotify URLs with their aspect ratios', () => {

packages/utils/src/media-embed.ts

@@ -64,12 +64,12 @@ function toDropboxDirectVideoUrl(parsed: URL): string | null {
 export function getEmbedInfo(url: string): EmbedInfo | null {
   const parsed = parseUrl(url)
   const host = parsed?.hostname.toLowerCase() ?? null
-  if (hostMatches(host, 'youtube.com', 'youtu.be')) {
-    const youtubeMatch = url.match(
-      /(?:youtube\.com\/watch\?(?:.*&)?v=|youtu\.be\/|youtube\.com\/embed\/)([a-zA-Z0-9_-]{11})/
-    )
-    if (youtubeMatch) {
-      return { url: `https://www.youtube.com/embed/${youtubeMatch[1]}`, type: 'iframe' }
+  if (parsed && hostMatches(host, 'youtube.com', 'youtu.be')) {
+    const id = hostMatches(host, 'youtu.be')
+      ? parsed.pathname.slice(1)
+      : (parsed.searchParams.get('v') ?? parsed.pathname.match(/^\/embed\/([^/?]+)/)?.[1])
+    if (id && /^[a-zA-Z0-9_-]{11}$/.test(id)) {
+      return { url: `https://www.youtube.com/embed/${id}`, type: 'iframe' }
     }
   }
 
@@ -209,10 +209,11 @@ export function getEmbedInfo(url: string): EmbedInfo | null {
     }
   }
 
-  if (hostMatches(host, 'facebook.com', 'fb.watch')) {
-    const facebookVideoMatch =
-      url.match(/facebook\.com\/.*\/videos\/(\d+)/) || url.match(/fb\.watch\/([a-zA-Z0-9_-]+)/)
-    if (facebookVideoMatch) {
+  if (parsed && hostMatches(host, 'facebook.com', 'fb.watch')) {
+    const isFacebookVideo = hostMatches(host, 'fb.watch')
+      ? /^\/[a-zA-Z0-9_-]+/.test(parsed.pathname)
+      : /\/videos\/\d+/.test(parsed.pathname)
+    if (isFacebookVideo) {
       return {
         url: `https://www.facebook.com/plugins/video.php?href=${encodeURIComponent(url)}&show_text=false`,
         type: 'iframe',
@@ -320,10 +321,12 @@ export function getEmbedInfo(url: string): EmbedInfo | null {
     }
   }
 
-  if (hostMatches(host, 'giphy.com')) {
-    const giphyMatch = url.match(/giphy\.com\/(?:gifs|embed)\/(?:.*-)?([a-zA-Z0-9]+)/)
-    if (giphyMatch) {
-      return { url: `https://giphy.com/embed/${giphyMatch[1]}`, type: 'iframe', aspectRatio: '1/1' }
+  if (parsed && hostMatches(host, 'giphy.com')) {
+    // Giphy ids are the trailing hyphen-delimited token of a /gifs/ or /embed/ path segment.
+    const segment = parsed.pathname.match(/^\/(?:gifs|embed)\/([^/]+)/)?.[1]
+    const giphyId = segment?.split('-').pop()
+    if (giphyId && /^[a-zA-Z0-9]+$/.test(giphyId)) {
+      return { url: `https://giphy.com/embed/${giphyId}`, type: 'iframe', aspectRatio: '1/1' }
     }
   }