fix(matcher): avoid exponential backtracking on .* repeatable params

[re-thc]

Repeatable params wrap the custom regexp as ((?:re)(?:/(?:re))*) to handle the leading slash between segments. This causes the engine to backtrack through them.

Fix: emit (${re}) instead of the repeat wrapper when the custom regexp is exactly .* or .+. Same results. Linear time instead.

Closes #1301

Summary by CodeRabbit

• Bug Fixes
  • Fixed route matching for repeatable greedy catch-all parameters, including empty matches and paths with trailing segments.
  • Preserved matching behavior for lazy catch-all parameters and other repeatable patterns.
  • Improved rejection of paths with nonmatching suffixes.

[netlify]

✅ Deploy Preview for vue-router canceled.

Name	Link
🔨 Latest commit	b96d664
🔍 Latest deploy log	https://app.netlify.com/projects/vue-router/deploys/6ac7a5ad45e4f0000888951a

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: vuejs/router/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0dca3432-b391-4477-b657-684deac09340

📥 Commits

Reviewing files that changed from the base of the PR and between 5311dbb and b96d664.

📒 Files selected for processing (1)

• packages/router/src/matcher/pathParserRanker.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

Repeatable parameters with the exact patterns .+ or .* now use a single capture group instead of the slash-separated repetition wrapper. Tests cover catch-all parsing and verify which patterns retain the wrapper.

Changes

Catch-all parsing

Layer / File(s)	Summary
Greedy wildcard repetition packages/router/src/matcher/pathParserRanker.ts, packages/router/__tests__/matcher/pathParser.spec.ts	Repeatable parameters with patterns .+ or .* use a single capture group. Tests cover empty and multi-segment matches, required repetition, suffix matching, later parameter captures, and wrapper behavior for other patterns.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b96d6

The wildcard-repeat change preserves the inspected matching and parsed-value behavior; no merge-blocking risk is identified.

Security Architecture Review

Security architecture risk: ⚪ Minimal · up to 5311d

The change removes unnecessary backtracking while preserving route selection and parameter handling. No new access boundary, privilege, or material security risk was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The directly affected exposure is path matching in router instances configured with repeatable exact .* or .+ expressions. The inspected call path introduces no additional consumer or authority; application-specific authorization consequences are outside this package assessment.

Trust Boundaries and Controls

• inferred — Potentially attacker-controlled path text reaches the existing regex test and parameter extraction. Equivalent matching for the optimized patterns, unchanged route scores, and unchanged parameter splitting provide counterevidence to expanded route reachability or a PR-introduced control bypass.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing exponential backtracking for repeatable parameters using .* patterns.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

pnpm add https://pkg.pr.new/vue-router@2819

npm i https://pkg.pr.new/vue-router@2819

yarn add https://pkg.pr.new/vue-router@2819.tgz

commit: b96d664

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.26%. Comparing base (071f196) to head (b96d664).
⚠️ Report is 39 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2819      +/-   ##
==========================================
+ Coverage   87.24%   88.26%   +1.01%     
==========================================
  Files          76       78       +2     
  Lines        6068     6305     +237     
  Branches     1955     2071     +116     
==========================================
+ Hits         5294     5565     +271     
+ Misses        683      651      -32     
+ Partials       91       89       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[posva]

Thanks! I did a small adaptation