Problem
find_objects constructs a regular expression directly from the caller-supplied name filter with no parse handling and no match timeout.
Evidence
Editor/MCPServerMethods.Search.cs:85-88 creates new Regex(name, RegexOptions.IgnoreCase) and applies it to GameObject names.- Invalid patterns throw regex parse exceptions instead of clear validation errors.
- There is no match timeout, so pathological patterns can consume the Unity main thread during matching.
Impact
A malformed name like Player (1) used as a literal search can fail unexpectedly if interpreted as regex, and catastrophic regex patterns can hang editor automation.
Suggested fix
Either treat name as a literal by default with Regex.Escape, or add an explicit regex mode. If regex remains supported, catch parse errors and use a bounded match timeout.
Source report
Imported from audit report item: Editor/MCPServerMethods.Search.cs:87.
Problem
find_objectsconstructs a regular expression directly from the caller-suppliednamefilter with no parse handling and no match timeout.Evidence
Editor/MCPServerMethods.Search.cs:85-88createsnew Regex(name, RegexOptions.IgnoreCase)and applies it to GameObject names.Impact
A malformed name like
Player (1)used as a literal search can fail unexpectedly if interpreted as regex, and catastrophic regex patterns can hang editor automation.Suggested fix
Either treat
nameas a literal by default withRegex.Escape, or add an explicit regex mode. If regex remains supported, catch parse errors and use a bounded match timeout.Source report
Imported from audit report item:
Editor/MCPServerMethods.Search.cs:87.