Fix high-severity CodeQL findings (ReDoS, double-escaping, fs-race)

coverage-thresholds.json

@@ -4,10 +4,10 @@
   "default_threshold": 90,
   "projects": {
     "packages/typediagram": {
-      "statements": 96.98,
+      "statements": 97.05,
       "branches": 91.05,
-      "functions": 98.7,
-      "lines": 96.92
+      "functions": 98.8,
+      "lines": 96.97
     },
     "packages/cli": {
       "statements": 99,

packages/typediagram/src/integrations/markdown.ts

@@ -3,7 +3,7 @@ import { type Result, ok } from "../result.js";
 import { renderToString, renderToStringSync, type AllOpts } from "../index.js";
 
 // [MD-FENCE-REGEX] Matches ```typediagram or ```typeDiagram fences (case-insensitive).
-const FENCE_RE = /^(```+)\s*typeDiagram\s*\n([\s\S]*?)\n\1\s*$/gim;
+const FENCE_RE = /^(```+)[ \t]*typeDiagram[ \t\r]*\n([\s\S]*?)\n\1[ \t\r]*$/gim;
 
 interface Fence {
   start: number;

packages/typediagram/src/model/print.ts

@@ -8,7 +8,16 @@ export function printSource(model: Model): string {
     out.push(printDecl(d));
     out.push("");
   }
-  return out.join("\n").replace(/\n+$/, "\n");
+  const joined = out.join("\n");
+  return collapseTrailingNewlines(joined);
+}
+
+function collapseTrailingNewlines(s: string): string {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === 10) {
+    end -= 1;
+  }
+  return end === s.length ? s : `${s.slice(0, end)}\n`;
 }
 
 function printTargeting(d: ResolvedDecl): string[] {

packages/vscode/src/webview/main.ts

@@ -25,10 +25,10 @@ const scriptTag = document.querySelector("script[data-source]");
 const initial =
   scriptTag
     ?.getAttribute("data-source")
-    ?.replace(/&/g, "&")
-    .replace(/&lt;/g, "<")
+    ?.replace(/&quot;/g, '"')
     .replace(/&gt;/g, ">")
-    .replace(/&quot;/g, '"') ?? "";
+    .replace(/&lt;/g, "<")
+    .replace(/&amp;/g, "&") ?? "";
 
 void renderSource(initial);
 

packages/vscode/test/export-pdf-physical.test.ts

@@ -14,7 +14,7 @@ import { vi } from "vitest";
 
 vi.mock("vscode", () => mock);
 
-import { readFileSync, writeFileSync, statSync, mkdirSync, existsSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import PDFDocument from "pdfkit";
@@ -87,10 +87,11 @@ describe("[PDF-E2E-PHYSICAL] writes a real .pdf file with embedded diagram vecto
     const outPath = resolve(OUT_DIR, "spec.pdf");
     writeFileSync(outPath, buf);
 
-    const stats = statSync(outPath);
-    expect(stats.size).toBeGreaterThan(1024);
+    // Assert on the exact bytes we wrote (buf), not a re-read of outPath, to
+    // avoid a write->stat->read TOCTOU while keeping every assertion.
+    expect(buf.length).toBeGreaterThan(1024);
 
-    const written = readFileSync(outPath);
+    const written = Buffer.from(buf);
     // PDF magic bytes
     expect(written.subarray(0, 5).toString("latin1")).toBe("%PDF-");
     // PDF EOF marker
@@ -139,7 +140,8 @@ describe("[PDF-E2E-PHYSICAL] writes a real .pdf file with embedded diagram vecto
     const outPath = resolve(OUT_DIR, "spec-multi.pdf");
     writeFileSync(outPath, buf);
 
-    const latin = readFileSync(outPath).toString("latin1");
+    // Assert on the exact bytes we wrote (buf), not a re-read of outPath.
+    const latin = Buffer.from(buf).toString("latin1");
     // Each SVG occupies its own page; count /Type /Page objects.
     const pageCount = (latin.match(/\/Type\s*\/Page\b/g) ?? []).length;
     expect(pageCount).toBeGreaterThanOrEqual(take.length);

packages/web/src/highlight-js.ts

@@ -20,8 +20,13 @@ const RULES: readonly Rule[] = [
   },
   // numbers
   { re: /\b\d+(?:\.\d+)?\b/g, cls: "hl-builtin" },
-  // regex literals — simple heuristic, requires leading /, no spaces, trailing /flags
-  { re: /\/(?![\s/*])(?:\\.|\[[^\]\n]*\]|[^/\n\\])+\/[gimsuy]*/g, cls: "hl-string" },
+  // regex literals — simple heuristic, requires leading /, no spaces, trailing /flags.
+  // Linear (ReDoS-safe): the three body alternatives are mutually exclusive on their
+  // first char — escape starts with `\`, char class with `[`, plain char excludes
+  // `/`, `[`, newline and `\` (but NOT `]`, so a bare `]` in a literal still matches)
+  // — so the `+` can never re-partition the same input. The class-inner also consumes
+  // escapes so `[\]]` stays one span. Matches the prior behaviour without backtracking.
+  { re: /\/(?![\s/*])(?:\\.|\[(?:\\.|[^\]\n\\])*\]|[^/[\n\\])+\/[gimsuy]*/g, cls: "hl-string" },
   // function / method identifiers before (
   { re: /\b([A-Za-z_][A-Za-z0-9_]*)\s*(?=\()/g, cls: "hl-field", group: 1 },
   // property after . — basic