Fix ReDoS regex and strengthen worker dispatch guard

- src/global.js: replace scriptUrl regex /\w+:\/\/(.+?\/)*.+\.js/ with /\w+:\/\/(?:[^/\s]+\/)*[^/\s]*\.js/ to remove exponential backtracking (CodeQL ReDoS)
- src/worker.js: validate the resolved handler with typeof func !== 'function' at the call site so the dynamic dispatch can never invoke an inherited or non-function value (CodeQL unvalidated dynamic method call)
- build.mjs: drop unused fs/promises import in watch(); guard fs.watch recursive mode (unsupported on Linux) with a non-recursive fallback; retain FSWatcher references for process lifetime
- Rebuild dist bundles

Author: ljoy913

build.mjs

@@ -328,7 +328,6 @@ async function build() {
 }
 
 async function watch() {
-    const chokidar = await import("node:fs/promises");
     const { watch: fsWatch } = await import("node:fs");
     const all = new Set([...fullBuild, LICENSE_FILE]);
     let timer = null;
@@ -340,16 +339,35 @@ async function watch() {
     };
     await build();
     console.log("watching for changes...");
+
+    // Keep references to every FSWatcher so they are not garbage-collected
+    // and stay active for the lifetime of the process.
+    const watchers = [];
+
     for (const f of all) {
         try {
-            fsWatch(f, rebuild);
+            watchers.push(fsWatch(f, rebuild));
         } catch {
             // file may not exist yet — that's fine
         }
     }
+
     // Also watch the directories that contain source files so newly-added
-    // files trigger rebuilds.
-    fsWatch("src", { recursive: true }, rebuild);
+    // files trigger rebuilds. fs.watch({ recursive: true }) is not supported
+    // on all platforms (notably Linux), where it throws — fall back to a
+    // non-recursive watch on the src directory in that case. The per-file
+    // watchers above still cover every file in the build list either way.
+    try {
+        watchers.push(fsWatch("src", { recursive: true }, rebuild));
+    } catch {
+        try {
+            watchers.push(fsWatch("src", rebuild));
+        } catch {
+            // src may not be watchable — per-file watchers still apply
+        }
+    }
+
+    return watchers;
 }
 
 const args = process.argv.slice(2);

dist/msrcrypto.js

@@ -80,7 +80,7 @@ var scriptUrl = (function() {
             throw new Error();
         } catch (e) {
             if (e.stack) {
-                var match = /\w+:\/\/(.+?\/)*.+\.js/.exec(e.stack);
+                var match = /\w+:\/\/(?:[^/\s]+\/)*[^/\s]*\.js/.exec(e.stack);
                 return (match && match.length > 0) ? match[0] : null;
             }
         }
@@ -866,7 +866,7 @@ var msrcryptoWorker = (function() {
 
             var func = operations.get(operation, algorithmName);
 
-            if (!func) {
+            if (typeof func !== "function") {
                 throw new Error("unregistered algorithm.");
             }
 

dist/msrcrypto.min.js

@@ -25,7 +25,7 @@ var scriptUrl = (function() {
             throw new Error();
         } catch (e) {
             if (e.stack) {
-                var match = /\w+:\/\/(.+?\/)*.+\.js/.exec(e.stack);
+                var match = /\w+:\/\/(?:[^/\s]+\/)*[^/\s]*\.js/.exec(e.stack);
                 return (match && match.length > 0) ? match[0] : null;
             }
         }

src/global.js

@@ -48,7 +48,10 @@ var msrcryptoWorker = (function() {
 
             var func = operations.get(operation, algorithmName);
 
-            if (!func) {
+            // Explicit own-property + function-type validation at the call site
+            // so the dynamically resolved handler can never dispatch to an
+            // inherited Object.prototype member or a non-function value.
+            if (typeof func !== "function") {
                 throw new Error("unregistered algorithm.");
             }