[helpcodeai]

Summary

CodeQL flagged parseAddress in mime-message.util.ts (polynomial ReDoS, high): the pattern /^(.*?)\s*<([^<>]*)>$/ lets the lazy group and \s* overlap, so a display name followed by a long run of spaces and no closing > is quadratic. The address comes from a tool argument, so a caller of an EMAIL connector could stall the event loop with one long string.

Changes

• Drop the \s* before <; the display name is trimmed right after the match, so the result is unchanged.
• Regression test: 50,000 spaces between the name and <name@example.com> must parse in well under a second, and the same string without > is rejected as before.

Type

• Bug fix
• New feature
• Documentation
• Refactoring
• Performance improvement
• Other (describe below)

Testing

• Added/updated unit tests
• Tested manually (describe steps below)
• No tests needed (explain why)

In packages/backend: npx jest src/connectors/engines/mime-message.util.spec.ts src/connectors/engines/rest.engine.mime.spec.ts (2 suites, 52 tests pass), npx eslint on the two files, npx tsc --noEmit -p tsconfig.json (ok). Same behaviour in Cloud and self-hosted: the EMAIL connector type uses this parser in both.

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• All existing tests pass (npm test)
• This PR has a descriptive title

Related Issues

Code scanning alert 604.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}