From be08d190dca19c4548d661a06f44f97b7198bd5f Mon Sep 17 00:00:00 2001
From: shrimbly <falloon.willie@gmail.com>
Date: Tue, 24 Feb 2026 13:11:59 +1300
Subject: [PATCH] fix(security): propagate quantifier state to parent groups in
 ReDoS detection

- Propagate hadQuantifier to parent depth when closing groups
- Fixes detection of deeply nested patterns like ((a+))+ and (((x+))+)+
- Inner groups with quantifiers now properly marked at parent level
---
 src/utils/arrayParser.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/utils/arrayParser.ts b/src/utils/arrayParser.ts
index 00b544c2..66685a7e 100644
--- a/src/utils/arrayParser.ts
+++ b/src/utils/arrayParser.ts
@@ -45,6 +45,9 @@ function isUnsafePattern(pattern: string): boolean {
         if (hadQuantifier) return true; // nested quantifier!
         // Mark parent depth as having a quantifier
         quantifierAtDepth[depth] = true;
+      } else if (hadQuantifier) {
+        // Group contained quantifier but isn't followed by one - propagate to parent
+        quantifierAtDepth[depth] = true;
       }
     } else if ((ch === '+' || ch === '*') && depth > 0) {
       quantifierAtDepth[depth] = true;