From 84dd3ac7d2d5e9d9fc87442d5c58d868428ad762 Mon Sep 17 00:00:00 2001
From: Maximilian Falco Widjaya <maximilianfalco@gmail.com>
Date: Wed, 3 Dec 2025 00:37:54 +1100
Subject: [PATCH 1/5] refactor regex to prevent ReDos

---
 .../transform/preprocess-jsx-expressions.ts   | 116 +++++++++++++-----
 1 file changed, 86 insertions(+), 30 deletions(-)

diff --git a/processor/transform/preprocess-jsx-expressions.ts b/processor/transform/preprocess-jsx-expressions.ts
index d7a67b835..18564c826 100644
--- a/processor/transform/preprocess-jsx-expressions.ts
+++ b/processor/transform/preprocess-jsx-expressions.ts
@@ -46,8 +46,9 @@ function evaluateExpression(expression: string, context: JSXContext): unknown {
 
 // Base64 encode HTMLBlock content to prevent parser from consuming <script>/<style> tags
 function protectHTMLBlockContent(content: string): string {
+  // each char matches exactly one way, preventing backtracking
   return content.replace(
-    /(<HTMLBlock[^>]*>)\{\s*`([\s\S]*?)`\s*\}(<\/HTMLBlock>)/g,
+    /(<HTMLBlock[^>]*>)\{\s*`((?:[^`\\]|\\.)*)`\s*\}(<\/HTMLBlock>)/g,
     (_match, openTag: string, templateContent: string, closeTag: string) => {
       const encoded = base64Encode(templateContent);
       return `${openTag}${HTML_BLOCK_CONTENT_START}${encoded}${HTML_BLOCK_CONTENT_END}${closeTag}`;
@@ -60,11 +61,30 @@ function protectCodeBlocks(content: string): ProtectCodeBlocksResult {
   const codeBlocks: string[] = [];
   const inlineCode: string[] = [];
 
-  let protectedContent = content.replace(/```[\s\S]*?```/g, match => {
+  let protectedContent = '';
+  let remaining = content;
+  let codeBlockStart = remaining.indexOf('```');
+
+  while (codeBlockStart !== -1) {
+    protectedContent += remaining.slice(0, codeBlockStart);
+    remaining = remaining.slice(codeBlockStart);
+
+    // Find the closing ```
+    const codeBlockEnd = remaining.indexOf('```', 3);
+    if (codeBlockEnd === -1) {
+      // No closing ```, keep the rest as-is
+      break;
+    }
+
+    const match = remaining.slice(0, codeBlockEnd + 3);
     const index = codeBlocks.length;
     codeBlocks.push(match);
-    return `___CODE_BLOCK_${index}___`;
-  });
+    protectedContent += `___CODE_BLOCK_${index}___`;
+
+    remaining = remaining.slice(codeBlockEnd + 3);
+    codeBlockStart = remaining.indexOf('```');
+  }
+  protectedContent += remaining;
 
   protectedContent = protectedContent.replace(/`[^`]+`/g, match => {
     const index = inlineCode.length;
@@ -76,40 +96,76 @@ function protectCodeBlocks(content: string): ProtectCodeBlocksResult {
 }
 
 function removeJSXComments(content: string): string {
-  return content.replace(/\{\s*\/\*[\s\S]*?\*\/\s*\}/g, '');
+  // This matches: any non-* chars, then (* followed by non-/ followed by non-* chars) repeated
+  return content.replace(/\{\s*\/\*[^*]*(?:\*(?!\/)[^*]*)*\*\/\s*\}/g, '');
+}
+
+// Returns content between balanced braces and end position, or null if unbalanced
+function extractBalancedBraces(content: string, start: number): { content: string; end: number } | null {
+  let depth = 1;
+  let pos = start;
+
+  while (pos < content.length && depth > 0) {
+    const char = content[pos];
+    if (char === '{') depth += 1;
+    else if (char === '}') depth -= 1;
+    pos += 1;
+  }
+
+  if (depth !== 0) return null;
+  return { content: content.slice(start, pos - 1), end: pos };
 }
 
 // Evaluate attribute expressions: attribute={expression} → attribute="value"
 function evaluateAttributeExpressions(content: string, context: JSXContext): string {
-  const jsxAttributeRegex = /(\w+)=\{((?:[^{}]|\{[^}]*\})*)\}/g;
-
-  return content.replace(jsxAttributeRegex, (match, attributeName: string, expression: string) => {
-    try {
-      const result = evaluateExpression(expression, context);
-
-      if (typeof result === 'object' && result !== null) {
-        if (attributeName === 'style') {
-          // Convert style object to CSS string
-          const cssString = Object.entries(result)
-            .map(([key, value]) => {
-              const cssKey = key.replace(/([A-Z])/g, '-$1').toLowerCase();
-              return `${cssKey}: ${value}`;
-            })
-            .join('; ');
-          return `style="${cssString}"`;
+  // Match attribute names followed by ={
+  const attrStartRegex = /(\w+)=\{/g;
+  let result = '';
+  let lastEnd = 0;
+  let match = attrStartRegex.exec(content);
+
+  while (match !== null) {
+    const attributeName = match[1];
+    const braceStart = match.index + match[0].length;
+
+    const extracted = extractBalancedBraces(content, braceStart);
+    if (extracted) {
+      const expression = extracted.content;
+      const fullMatchEnd = extracted.end;
+
+      result += content.slice(lastEnd, match.index);
+
+      try {
+        const evalResult = evaluateExpression(expression, context);
+
+        if (typeof evalResult === 'object' && evalResult !== null) {
+          if (attributeName === 'style') {
+            const cssString = Object.entries(evalResult)
+              .map(([key, value]) => {
+                const cssKey = key.replace(/([A-Z])/g, '-$1').toLowerCase();
+                return `${cssKey}: ${value}`;
+              })
+              .join('; ');
+            result += `style="${cssString}"`;
+          } else {
+            result += `${attributeName}='${JSON.stringify(evalResult)}'`;
+          }
+        } else if (attributeName === 'className') {
+          result += `class="${evalResult}"`;
+        } else {
+          result += `${attributeName}="${evalResult}"`;
         }
-        return `${attributeName}='${JSON.stringify(result)}'`;
+      } catch (_error) {
+        result += content.slice(match.index, fullMatchEnd);
       }
 
-      if (attributeName === 'className') {
-        return `class="${result}"`;
-      }
-
-      return `${attributeName}="${result}"`;
-    } catch (_error) {
-      return match;
+      lastEnd = fullMatchEnd;
+      attrStartRegex.lastIndex = fullMatchEnd;
     }
-  });
+    match = attrStartRegex.exec(content);
+  }
+  result += content.slice(lastEnd);
+  return result;
 }
 
 function restoreCodeBlocks(content: string, protectedCode: ProtectedCode): string {

From 7b42c8aa661b5835810b38c15cad8274a07275cb Mon Sep 17 00:00:00 2001
From: Maximilian Falco Widjaya <maximilianfalco@gmail.com>
Date: Wed, 3 Dec 2025 12:41:15 +1100
Subject: [PATCH 2/5] add some tests

---
 .../preprocess-redos-attack.test.ts           | 508 ++++++++++++++++++
 1 file changed, 508 insertions(+)
 create mode 100644 __tests__/transformers/preprocess-redos-attack.test.ts

diff --git a/__tests__/transformers/preprocess-redos-attack.test.ts b/__tests__/transformers/preprocess-redos-attack.test.ts
new file mode 100644
index 000000000..c4c1678d9
--- /dev/null
+++ b/__tests__/transformers/preprocess-redos-attack.test.ts
@@ -0,0 +1,508 @@
+import { describe, it, expect } from 'vitest';
+
+import { preprocessJSXExpressions } from '../../processor/transform/preprocess-jsx-expressions';
+
+describe('ReDoS Attack Vectors', () => {
+  it('should handle attack string with 30 repetitions without hanging', () => {
+    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(30)}lock\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(5000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle attack string with 50 repetitions without hanging', () => {
+    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(50)}lock\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(10000);
+    expect(result).toBeDefined();
+  });
+
+  it('should demonstrate ReDoS with a pattern that matches but causes backtracking', () => {
+    const attackString = `<HTMLBlock>{\`${'\\a\\b\\c\\'.repeat(40)}x\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(5000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle 100 repetitions of escape sequences', () => {
+    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(100)}lock\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(10000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle 200 repetitions of escape sequences', () => {
+    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(200)}lock\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(15000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle 500 repetitions of escape sequences', () => {
+    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(500)}lock\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(30000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle many consecutive backslashes (500)', () => {
+    const attackString = `<HTMLBlock>{\`${'\\'.repeat(500)}a\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(10000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle many consecutive backslashes (1000)', () => {
+    const attackString = `<HTMLBlock>{\`${'\\'.repeat(1000)}a\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(20000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle alternating escape patterns', () => {
+    const attackString = `<HTMLBlock>{\`${'\\a\\b'.repeat(200)}x\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(10000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle complex nested escape sequences', () => {
+    const attackString = `<HTMLBlock>{\`${'\\x\\y\\z\\w'.repeat(150)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(10000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle very long template literal content (10k chars)', () => {
+    const longContent = 'a'.repeat(10000);
+    const attackString = `<HTMLBlock>{\`${longContent}\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(5000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle very long template literal with escapes (5k chars)', () => {
+    const longContent = '\\a'.repeat(2500);
+    const attackString = `<HTMLBlock>{\`${longContent}\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(10000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle multiple HTMLBlock tags with attack patterns', () => {
+    const attackPattern = '\\lock\\lock\\'.repeat(50);
+    const attackString = [
+      `<HTMLBlock>{\`${attackPattern}lock\`}</HTMLBlock>`,
+      `<HTMLBlock>{\`${attackPattern}lock\`}</HTMLBlock>`,
+      `<HTMLBlock>{\`${attackPattern}lock\`}</HTMLBlock>`,
+    ].join('\n');
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(15000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle attack pattern with extra whitespace', () => {
+    const attackString = `<HTMLBlock>{   \`${'\\lock\\lock\\'.repeat(100)}lock\`   }</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(10000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle attack pattern with newlines and whitespace', () => {
+    const attackString = `<HTMLBlock>{\n  \`${'\\lock\\lock\\'.repeat(100)}lock\`\n}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(10000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern specifically designed for nested quantifier attack', () => {
+    // This pattern exploits the (?:[^`\\]|\\.)* nested quantifier
+    // Each backslash can be interpreted as start of escape OR part of previous escape
+    const attackString = `<HTMLBlock>{\`${'\\x\\y'.repeat(300)}z\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(15000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle mixed escape and non-escape patterns', () => {
+    const pattern = `${'\\a'}${'b'.repeat(10)}`;
+    const attackString = `<HTMLBlock>{\`${pattern.repeat(200)}c\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(10000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle edge case with escaped backticks in attack pattern', () => {
+    const attackString = `<HTMLBlock>{\`${'\\`\\`\\`'.repeat(100)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(10000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle 1000 repetitions of escape sequences', () => {
+    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(1000)}lock\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(60000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle 2000 repetitions of escape sequences', () => {
+    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(2000)}lock\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(120000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle many consecutive backslashes (2000)', () => {
+    const attackString = `<HTMLBlock>{\`${'\\'.repeat(2000)}a\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(30000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle many consecutive backslashes (5000)', () => {
+    const attackString = `<HTMLBlock>{\`${'\\'.repeat(5000)}a\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(60000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle HTMLBlock with attributes and attack pattern', () => {
+    const attackString = `<HTMLBlock id="test" class="example">{\`${'\\lock\\lock\\'.repeat(200)}lock\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(15000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle HTMLBlock with many attributes and attack pattern', () => {
+    const attrs = 'a="1" b="2" c="3" d="4" e="5" '.repeat(10);
+    const attackString = `<HTMLBlock ${attrs}>{\`${'\\lock\\lock\\'.repeat(100)}lock\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(15000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle very long template literal content (50k chars)', () => {
+    const longContent = 'a'.repeat(50000);
+    const attackString = `<HTMLBlock>{\`${longContent}\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(20000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle very long template literal with escapes (20k chars)', () => {
+    const longContent = '\\a'.repeat(10000);
+    const attackString = `<HTMLBlock>{\`${longContent}\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(30000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern with all possible escape sequences', () => {
+    const escapes = '\\n\\t\\r\\v\\f\\b\\0\\x00\\u0000';
+    const attackString = `<HTMLBlock>{\`${escapes.repeat(500)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(15000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern with Unicode characters and escapes', () => {
+    const attackString = `<HTMLBlock>{\`${'\\u0041\\u0042'.repeat(300)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(15000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern with mixed valid and invalid escapes', () => {
+    const pattern = '\\n\\invalid\\t\\also-invalid\\r';
+    const attackString = `<HTMLBlock>{\`${pattern.repeat(400)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(20000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle 10 HTMLBlock tags with attack patterns', () => {
+    const attackPattern = '\\lock\\lock\\'.repeat(50);
+    const blocks = new Array(10).fill(`<HTMLBlock>{\`${attackPattern}lock\`}</HTMLBlock>`).join('\n');
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(blocks, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(30000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle 50 HTMLBlock tags with attack patterns', () => {
+    const attackPattern = '\\lock\\lock\\'.repeat(30);
+    const blocks = new Array(50).fill(`<HTMLBlock>{\`${attackPattern}lock\`}</HTMLBlock>`).join('\n');
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(blocks, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(60000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern with tabs and newlines in template literal', () => {
+    const attackString = `<HTMLBlock>{\`${'\\t\\n\\r'.repeat(500)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(20000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern with backslash at every position', () => {
+    const attackString = `<HTMLBlock>{\`${'a\\b\\c\\d'.repeat(400)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(20000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern designed to maximize backtracking attempts', () => {
+    // Pattern where each character could be part of escape or standalone
+    const attackString = `<HTMLBlock>{\`${'\\x\\y\\z'.repeat(600)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(30000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern with escaped backslashes (double escapes)', () => {
+    const attackString = `<HTMLBlock>{\`${'\\\\'.repeat(1000)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(20000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern with triple backslashes', () => {
+    const attackString = `<HTMLBlock>{\`${'\\\\\\'.repeat(800)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(30000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle extremely long whitespace before template literal', () => {
+    const whitespace = ' '.repeat(10000);
+    const attackString = `<HTMLBlock>{${whitespace}\`${'\\lock\\lock\\'.repeat(50)}lock\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(15000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern with newlines between braces and backticks', () => {
+    const attackString = `<HTMLBlock>{\n\n\n\`${'\\lock\\lock\\'.repeat(100)}lock\`\n\n\n}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(15000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern with all ASCII printable characters and escapes', () => {
+    const chars = Array.from({ length: 95 }, (_, i) => String.fromCharCode(i + 32))
+      .filter(c => c !== '`' && c !== '\\')
+      .join('\\');
+    const attackString = `<HTMLBlock>{\`${chars.repeat(100)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(20000);
+    expect(result).toBeDefined();
+  });
+
+  it('should handle pattern that alternates between escape and long strings', () => {
+    const pattern = `${'\\a'}${'x'.repeat(100)}`;
+    const attackString = `<HTMLBlock>{\`${pattern.repeat(200)}end\`}</HTMLBlock>`;
+
+    const start = Date.now();
+    const result = preprocessJSXExpressions(attackString, {});
+    const end = Date.now();
+    const duration = end - start;
+
+    expect(duration).toBeLessThan(30000);
+    expect(result).toBeDefined();
+  });
+});

From fbaf22db5ff5fc89026d98af9ff458c62af9ed8b Mon Sep 17 00:00:00 2001
From: Maximilian Falco Widjaya <maximilianfalco@gmail.com>
Date: Wed, 3 Dec 2025 12:58:42 +1100
Subject: [PATCH 3/5] added proper docs to the preprocessor

---
 .../transform/preprocess-jsx-expressions.ts   | 274 +++++++++++++++++-
 1 file changed, 262 insertions(+), 12 deletions(-)

diff --git a/processor/transform/preprocess-jsx-expressions.ts b/processor/transform/preprocess-jsx-expressions.ts
index 18564c826..204b24115 100644
--- a/processor/transform/preprocess-jsx-expressions.ts
+++ b/processor/transform/preprocess-jsx-expressions.ts
@@ -35,7 +35,29 @@ interface ProtectCodeBlocksResult {
   protectedContent: string;
 }
 
-// Helper function to evaluate an expression using the provided context
+/**
+ * Evaluates a JavaScript expression using the provided context variables.
+ *
+ * Creates a function dynamically with context variables as parameters, then executes
+ * the expression. This allows safe evaluation of user-provided expressions with
+ * controlled variable access.
+ *
+ * @param expression - The JavaScript expression to evaluate (e.g., "baseUrl + '/path'")
+ * @param context - Object containing variables available in the expression
+ * @returns The evaluated result
+ * @example
+ * ```typescript
+ * const context = { baseUrl: 'https://example.com', path: '/api' };
+ * evaluateExpression('baseUrl + path', context)
+ * // Returns: 'https://example.com/api'
+ * ```
+ * @example
+ * ```typescript
+ * const context = { count: 5 };
+ * evaluateExpression('count * 2', context)
+ * // Returns: 10
+ * ```
+ */
 function evaluateExpression(expression: string, context: JSXContext): unknown {
   const contextKeys = Object.keys(context);
   const contextValues = Object.values(context);
@@ -44,9 +66,32 @@ function evaluateExpression(expression: string, context: JSXContext): unknown {
   return func(...contextValues);
 }
 
-// Base64 encode HTMLBlock content to prevent parser from consuming <script>/<style> tags
+/**
+ * Protects HTMLBlock template literal content by base64 encoding it.
+ *
+ * This prevents the markdown parser from consuming <script>/<style> tags inside HTMLBlocks.
+ * The template literal content is extracted, base64 encoded, and wrapped in HTML comments
+ * that markdown parsers will ignore.
+ *
+ * Pattern matched: `<HTMLBlock>{` template-content `}</HTMLBlock>`
+ * The template content is base64 encoded and wrapped in special HTML comment markers.
+ *
+ * @param content - The markdown content containing HTMLBlocks
+ * @returns Content with HTMLBlock template literals base64 encoded and wrapped in HTML comments
+ * @example
+ * ```typescript
+ * const input = '<HTMLBlock>{`<script>alert("xss")</script>`}</HTMLBlock>';
+ * protectHTMLBlockContent(input)
+ * // Returns: '<HTMLBlock><!--RDMX_HTMLBLOCK:PHNjcmlwdD5hbGVydCgieHNzIik8L3NjcmlwdD4=:RDMX_HTMLBLOCK--></HTMLBlock>'
+ * ```
+ * @example
+ * ```typescript
+ * const input = '<HTMLBlock>{`console.log("hello");`}</HTMLBlock>';
+ * protectHTMLBlockContent(input)
+ * // Returns: '<HTMLBlock><!--RDMX_HTMLBLOCK:Y29uc29sZS5sb2coImhlbGxvIik7:RDMX_HTMLBLOCK--></HTMLBlock>'
+ * ```
+ */
 function protectHTMLBlockContent(content: string): string {
-  // each char matches exactly one way, preventing backtracking
   return content.replace(
     /(<HTMLBlock[^>]*>)\{\s*`((?:[^`\\]|\\.)*)`\s*\}(<\/HTMLBlock>)/g,
     (_match, openTag: string, templateContent: string, closeTag: string) => {
@@ -56,7 +101,45 @@ function protectHTMLBlockContent(content: string): string {
   );
 }
 
-// Protect code blocks and inline code from processing
+/**
+ * Protects code blocks and inline code from JSX processing.
+ *
+ * Replaces fenced code blocks (```code block```) and inline code (`inline code`) with placeholders
+ * so they aren't affected by expression evaluation or other JSX processing steps.
+ * The original code is stored in arrays for later restoration.
+ *
+ * Process:
+ * 1. Find all fenced code blocks (```code block```) and replace with placeholders
+ * 2. Find all inline code (`inline code`) and replace with placeholders
+ * 3. Store originals in arrays for later restoration
+ *
+ * @param content - The markdown content to protect
+ * @returns Object containing protected content and arrays of original code blocks
+ * @example
+ * ```typescript
+ * const input = 'Text with `inline code` and ```fenced block```';
+ * protectCodeBlocks(input)
+ * // Returns: {
+ * //   protectedCode: {
+ * //     codeBlocks: ['```fenced block```'],
+ * //     inlineCode: ['`inline code`']
+ * //   },
+ * //   protectedContent: 'Text with ___INLINE_CODE_0___ and ___CODE_BLOCK_0___'
+ * // }
+ * ```
+ * @example
+ * ```typescript
+ * const input = '```js\nconst x = {value: 1};\n```';
+ * protectCodeBlocks(input)
+ * // Returns: {
+ * //   protectedCode: {
+ * //     codeBlocks: ['```js\nconst x = {value: 1};\n```'],
+ * //     inlineCode: []
+ * //   },
+ * //   protectedContent: '___CODE_BLOCK_0___'
+ * // }
+ * ```
+ */
 function protectCodeBlocks(content: string): ProtectCodeBlocksResult {
   const codeBlocks: string[] = [];
   const inlineCode: string[] = [];
@@ -69,10 +152,8 @@ function protectCodeBlocks(content: string): ProtectCodeBlocksResult {
     protectedContent += remaining.slice(0, codeBlockStart);
     remaining = remaining.slice(codeBlockStart);
 
-    // Find the closing ```
     const codeBlockEnd = remaining.indexOf('```', 3);
     if (codeBlockEnd === -1) {
-      // No closing ```, keep the rest as-is
       break;
     }
 
@@ -95,12 +176,62 @@ function protectCodeBlocks(content: string): ProtectCodeBlocksResult {
   return { protectedCode: { codeBlocks, inlineCode }, protectedContent };
 }
 
+/**
+ * Removes JSX-style comments from content.
+ *
+ * JSX comments are wrapped in braces with C-style comment syntax.
+ * Format: opening brace, optional whitespace, slash-asterisk, comment content, asterisk-slash, optional whitespace, closing brace.
+ * These comments would confuse the markdown parser, so they're removed before processing.
+ *
+ * The regex matches:
+ * - Opening brace with optional whitespace
+ * - Comment start marker (slash-asterisk)
+ * - Comment content (handling asterisks that don't close the comment)
+ * - Comment end marker (asterisk-slash)
+ * - Optional whitespace and closing brace
+ *
+ * @param content - Content potentially containing JSX comments
+ * @returns Content with JSX comments removed
+ * @example
+ * Input: 'Text { /* comment *\/ } more text'
+ * Output: 'Text  more text'
+ * @example
+ * Input: '{ /* comment *\/ }'
+ * Output: ''
+ */
 function removeJSXComments(content: string): string {
-  // This matches: any non-* chars, then (* followed by non-/ followed by non-* chars) repeated
   return content.replace(/\{\s*\/\*[^*]*(?:\*(?!\/)[^*]*)*\*\/\s*\}/g, '');
 }
 
-// Returns content between balanced braces and end position, or null if unbalanced
+/**
+ * Extracts content between balanced braces starting at a given position.
+ *
+ * Tracks brace depth to handle nested braces correctly. Starts at depth 1 since
+ * the opening brace is already consumed. Returns the content between braces
+ * (excluding the braces themselves) and the position after the closing brace.
+ *
+ * @param content - The string to search in
+ * @param start - Starting position (should be after the opening {)
+ * @returns Object with extracted content and end position, or null if braces are unbalanced
+ * @example
+ * ```typescript
+ * const input = 'foo{bar{baz}qux}end';
+ * extractBalancedBraces(input, 3) // start at position 3 (after '{')
+ * // Returns: { content: 'bar{baz}qux', end: 16 }
+ * ```
+ * @example
+ * ```typescript
+ * const input = 'attr={value}';
+ * extractBalancedBraces(input, 6) // start at position 6 (after '{')
+ * // Returns: { content: 'value', end: 12 }
+ * ```
+ * @example
+ * ```typescript
+ * const input = 'unbalanced{';
+ * extractBalancedBraces(input, 10)
+ * // Returns: null (unbalanced braces)
+ * ```
+ */
 function extractBalancedBraces(content: string, start: number): { content: string; end: number } | null {
   let depth = 1;
   let pos = start;
@@ -116,9 +247,59 @@ function extractBalancedBraces(content: string, start: number): { content: strin
   return { content: content.slice(start, pos - 1), end: pos };
 }
 
-// Evaluate attribute expressions: attribute={expression} → attribute="value"
+/**
+ * Evaluates JSX attribute expressions and converts them to HTML attributes.
+ *
+ * Transforms JSX attribute syntax (attribute={expression}) to HTML attributes (attribute="value").
+ * The expression is evaluated using the provided context, and the result is converted to
+ * a string value for the HTML attribute.
+ *
+ * Special handling:
+ * - `style` objects are converted to CSS strings (camelCase → kebab-case)
+ * - `className` is converted to `class` (HTML standard)
+ * - Objects are JSON stringified
+ * - If evaluation fails, the original expression is kept unchanged
+ *
+ * @param content - Content containing JSX attribute expressions
+ * @param context - Context object for expression evaluation
+ * @returns Content with attribute expressions evaluated and converted to HTML attributes
+ * @example
+ * ```typescript
+ * const context = { baseUrl: 'https://example.com' };
+ * const input = '<a href={baseUrl}>Link</a>';
+ * evaluateAttributeExpressions(input, context)
+ * // Returns: '<a href="https://example.com">Link</a>'
+ * ```
+ * @example
+ * ```typescript
+ * const context = { isActive: true };
+ * const input = '<div active={isActive}>Content</div>';
+ * evaluateAttributeExpressions(input, context)
+ * // Returns: '<div active="true">Content</div>'
+ * ```
+ * @example
+ * ```typescript
+ * const context = { styles: { backgroundColor: 'red', fontSize: '14px' } };
+ * const input = '<div style={styles}>Content</div>';
+ * evaluateAttributeExpressions(input, context)
+ * // Returns: '<div style="background-color: red; font-size: 14px">Content</div>'
+ * ```
+ * @example
+ * ```typescript
+ * const context = { className: 'my-class' };
+ * const input = '<div className={className}>Content</div>';
+ * evaluateAttributeExpressions(input, context)
+ * // Returns: '<div class="my-class">Content</div>'
+ * ```
+ * @example
+ * ```typescript
+ * const context = { data: { id: 1, name: 'test' } };
+ * const input = '<div data={data}>Content</div>';
+ * evaluateAttributeExpressions(input, context)
+ * // Returns: '<div data=\'{"id":1,"name":"test"}\'>Content</div>'
+ * ```
+ */
 function evaluateAttributeExpressions(content: string, context: JSXContext): string {
-  // Match attribute names followed by ={
   const attrStartRegex = /(\w+)=\{/g;
   let result = '';
   let lastEnd = 0;
@@ -168,6 +349,26 @@ function evaluateAttributeExpressions(content: string, context: JSXContext): str
   return result;
 }
 
+/**
+ * Restores code blocks and inline code that were protected earlier.
+ *
+ * Replaces placeholders (___CODE_BLOCK_N___ and ___INLINE_CODE_N___) with the
+ * original code content that was stored during the protection phase.
+ *
+ * @param content - Content with code block placeholders
+ * @param protectedCode - Object containing arrays of original code blocks and inline code
+ * @returns Content with all code blocks and inline code restored
+ * @example
+ * ```typescript
+ * const content = 'Text with ___INLINE_CODE_0___ and ___CODE_BLOCK_0___';
+ * const protectedCode = {
+ *   codeBlocks: ['```js\ncode\n```'],
+ *   inlineCode: ['`inline`']
+ * };
+ * restoreCodeBlocks(content, protectedCode)
+ * // Returns: 'Text with `inline` and ```js\ncode\n```'
+ * ```
+ */
 function restoreCodeBlocks(content: string, protectedCode: ProtectedCode): string {
   let restored = content.replace(/___CODE_BLOCK_(\d+)___/g, (_match, index: string) => {
     return protectedCode.codeBlocks[parseInt(index, 10)];
@@ -180,8 +381,57 @@ function restoreCodeBlocks(content: string, protectedCode: ProtectedCode): strin
   return restored;
 }
 
-// We cant rely on remarkMdx since it restricts the syntax a lot
-// so we have to try as much as possible to parse JSX syntax manually
+/**
+ * Main preprocessing function for JSX-like expressions in markdown.
+ *
+ * We can't rely on remarkMdx since it restricts the syntax too much, so we manually
+ * parse and process JSX syntax before the markdown parser runs.
+ *
+ * Processing pipeline (executed in order):
+ * 1. Protect HTMLBlock content (base64 encode to prevent parser from consuming <script>/<style>)
+ * 2. Protect code blocks and inline code (so they aren't affected by JSX processing)
+ * 3. Remove JSX comments (they would confuse the markdown parser)
+ * 4. Evaluate attribute expressions (convert href={baseUrl} to href="value")
+ * 5. Restore protected code blocks (put them back in place)
+ *
+ * Note: Inline expressions (like {variable} in text) are handled by a separate library
+ * later in the pipeline. Attribute expressions are processed here because it's difficult
+ * to use a library to parse them in the context of JSX attributes.
+ *
+ * @param content - The markdown content containing JSX-like syntax
+ * @param context - Context object providing variables for expression evaluation
+ * @returns Preprocessed content ready for markdown parsing
+ * @example
+ * ```typescript
+ * const context = {
+ *   baseUrl: 'https://example.com',
+ *   userId: '123',
+ *   isActive: true
+ * };
+ * const input = `
+ * <a href={baseUrl} id={userId} active={isActive}>Link</a>
+ * \`\`\`js
+ * const x = {value: 1};
+ * \`\`\`
+ * `;
+ * preprocessJSXExpressions(input, context)
+ * // Returns content with:
+ * // - href={baseUrl} → href="https://example.com"
+ * // - id={userId} → id="123"
+ * // - active={isActive} → active="true"
+ * // - Code blocks preserved unchanged
+ * ```
+ * @example
+ * ```typescript
+ * const context = { className: 'my-class' };
+ * const input = '<div className={className}>Content</div>';
+ * preprocessJSXExpressions(input, context)
+ * // Returns: '<div class="my-class">Content</div>'
+ * ```
+ * @example
+ * Input: 'Text { /* comment *\/ } more text'
+ * Output: 'Text  more text' (comment removed)
+ */
 export function preprocessJSXExpressions(content: string, context: JSXContext = {}): string {
   // Step 0: Base64 encode HTMLBlock content
   let processed = protectHTMLBlockContent(content);

From 55ad42a86f62055ea3204694a4cf3d5604aebd31 Mon Sep 17 00:00:00 2001
From: Maximilian Falco Widjaya <maximilianfalco@gmail.com>
Date: Thu, 4 Dec 2025 10:48:06 +1100
Subject: [PATCH 4/5] add timeout

---
 .../transformers/preprocess-redos-attack.test.ts   | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/__tests__/transformers/preprocess-redos-attack.test.ts b/__tests__/transformers/preprocess-redos-attack.test.ts
index c4c1678d9..e85ebec31 100644
--- a/__tests__/transformers/preprocess-redos-attack.test.ts
+++ b/__tests__/transformers/preprocess-redos-attack.test.ts
@@ -239,7 +239,7 @@ describe('ReDoS Attack Vectors', () => {
 
     expect(duration).toBeLessThan(60000);
     expect(result).toBeDefined();
-  });
+  }, 10000);
 
   it('should handle 2000 repetitions of escape sequences', () => {
     const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(2000)}lock\`}</HTMLBlock>`;
@@ -251,7 +251,7 @@ describe('ReDoS Attack Vectors', () => {
 
     expect(duration).toBeLessThan(120000);
     expect(result).toBeDefined();
-  });
+  }, 10000);
 
   it('should handle many consecutive backslashes (2000)', () => {
     const attackString = `<HTMLBlock>{\`${'\\'.repeat(2000)}a\`}</HTMLBlock>`;
@@ -275,7 +275,7 @@ describe('ReDoS Attack Vectors', () => {
 
     expect(duration).toBeLessThan(60000);
     expect(result).toBeDefined();
-  });
+  }, 10000);
 
   it('should handle HTMLBlock with attributes and attack pattern', () => {
     const attackString = `<HTMLBlock id="test" class="example">{\`${'\\lock\\lock\\'.repeat(200)}lock\`}</HTMLBlock>`;
@@ -313,7 +313,7 @@ describe('ReDoS Attack Vectors', () => {
 
     expect(duration).toBeLessThan(20000);
     expect(result).toBeDefined();
-  });
+  }, 10000);
 
   it('should handle very long template literal with escapes (20k chars)', () => {
     const longContent = '\\a'.repeat(10000);
@@ -326,7 +326,7 @@ describe('ReDoS Attack Vectors', () => {
 
     expect(duration).toBeLessThan(30000);
     expect(result).toBeDefined();
-  });
+  }, 10000);
 
   it('should handle pattern with all possible escape sequences', () => {
     const escapes = '\\n\\t\\r\\v\\f\\b\\0\\x00\\u0000';
@@ -377,7 +377,7 @@ describe('ReDoS Attack Vectors', () => {
 
     expect(duration).toBeLessThan(30000);
     expect(result).toBeDefined();
-  });
+  }, 10000);
 
   it('should handle 50 HTMLBlock tags with attack patterns', () => {
     const attackPattern = '\\lock\\lock\\'.repeat(30);
@@ -390,7 +390,7 @@ describe('ReDoS Attack Vectors', () => {
 
     expect(duration).toBeLessThan(60000);
     expect(result).toBeDefined();
-  });
+  }, 10000);
 
   it('should handle pattern with tabs and newlines in template literal', () => {
     const attackString = `<HTMLBlock>{\`${'\\t\\n\\r'.repeat(500)}end\`}</HTMLBlock>`;

From 5329231d2573e8f4ece9b52890af8524e5488094 Mon Sep 17 00:00:00 2001
From: Maximilian Falco Widjaya <maximilianfalco@gmail.com>
Date: Thu, 4 Dec 2025 11:40:04 +1100
Subject: [PATCH 5/5] clean up

---
 .../preprocess-redos-attack.test.ts           | 212 ++----------------
 .../transform/preprocess-jsx-expressions.ts   | 211 +++--------------
 2 files changed, 46 insertions(+), 377 deletions(-)

diff --git a/__tests__/transformers/preprocess-redos-attack.test.ts b/__tests__/transformers/preprocess-redos-attack.test.ts
index e85ebec31..b641a12e8 100644
--- a/__tests__/transformers/preprocess-redos-attack.test.ts
+++ b/__tests__/transformers/preprocess-redos-attack.test.ts
@@ -3,43 +3,7 @@ import { describe, it, expect } from 'vitest';
 import { preprocessJSXExpressions } from '../../processor/transform/preprocess-jsx-expressions';
 
 describe('ReDoS Attack Vectors', () => {
-  it('should handle attack string with 30 repetitions without hanging', () => {
-    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(30)}lock\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(5000);
-    expect(result).toBeDefined();
-  });
-
-  it('should handle attack string with 50 repetitions without hanging', () => {
-    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(50)}lock\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(10000);
-    expect(result).toBeDefined();
-  });
-
-  it('should demonstrate ReDoS with a pattern that matches but causes backtracking', () => {
-    const attackString = `<HTMLBlock>{\`${'\\a\\b\\c\\'.repeat(40)}x\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(5000);
-    expect(result).toBeDefined();
-  });
-
-  it('should handle 100 repetitions of escape sequences', () => {
+  it('should handle basic attack pattern without hanging', () => {
     const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(100)}lock\`}</HTMLBlock>`;
 
     const start = Date.now();
@@ -51,8 +15,10 @@ describe('ReDoS Attack Vectors', () => {
     expect(result).toBeDefined();
   });
 
-  it('should handle 200 repetitions of escape sequences', () => {
-    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(200)}lock\`}</HTMLBlock>`;
+  it('should handle pattern specifically designed for nested quantifier attack', () => {
+    // This pattern exploits the (?:[^`\\]|\\.)* nested quantifier
+    // Each backslash can be interpreted as start of escape OR part of previous escape
+    const attackString = `<HTMLBlock>{\`${'\\x\\y'.repeat(300)}z\`}</HTMLBlock>`;
 
     const start = Date.now();
     const result = preprocessJSXExpressions(attackString, {});
@@ -63,31 +29,7 @@ describe('ReDoS Attack Vectors', () => {
     expect(result).toBeDefined();
   });
 
-  it('should handle 500 repetitions of escape sequences', () => {
-    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(500)}lock\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(30000);
-    expect(result).toBeDefined();
-  });
-
-  it('should handle many consecutive backslashes (500)', () => {
-    const attackString = `<HTMLBlock>{\`${'\\'.repeat(500)}a\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(10000);
-    expect(result).toBeDefined();
-  });
-
-  it('should handle many consecutive backslashes (1000)', () => {
+  it('should handle many consecutive backslashes', () => {
     const attackString = `<HTMLBlock>{\`${'\\'.repeat(1000)}a\`}</HTMLBlock>`;
 
     const start = Date.now();
@@ -123,8 +65,8 @@ describe('ReDoS Attack Vectors', () => {
     expect(result).toBeDefined();
   });
 
-  it('should handle very long template literal content (10k chars)', () => {
-    const longContent = 'a'.repeat(10000);
+  it('should handle very long template literal content', () => {
+    const longContent = 'a'.repeat(50000);
     const attackString = `<HTMLBlock>{\`${longContent}\`}</HTMLBlock>`;
 
     const start = Date.now();
@@ -132,12 +74,12 @@ describe('ReDoS Attack Vectors', () => {
     const end = Date.now();
     const duration = end - start;
 
-    expect(duration).toBeLessThan(5000);
+    expect(duration).toBeLessThan(20000);
     expect(result).toBeDefined();
-  });
+  }, 10000);
 
-  it('should handle very long template literal with escapes (5k chars)', () => {
-    const longContent = '\\a'.repeat(2500);
+  it('should handle very long template literal with escapes', () => {
+    const longContent = '\\a'.repeat(10000);
     const attackString = `<HTMLBlock>{\`${longContent}\`}</HTMLBlock>`;
 
     const start = Date.now();
@@ -145,26 +87,22 @@ describe('ReDoS Attack Vectors', () => {
     const end = Date.now();
     const duration = end - start;
 
-    expect(duration).toBeLessThan(10000);
+    expect(duration).toBeLessThan(30000);
     expect(result).toBeDefined();
-  });
+  }, 10000);
 
   it('should handle multiple HTMLBlock tags with attack patterns', () => {
     const attackPattern = '\\lock\\lock\\'.repeat(50);
-    const attackString = [
-      `<HTMLBlock>{\`${attackPattern}lock\`}</HTMLBlock>`,
-      `<HTMLBlock>{\`${attackPattern}lock\`}</HTMLBlock>`,
-      `<HTMLBlock>{\`${attackPattern}lock\`}</HTMLBlock>`,
-    ].join('\n');
+    const blocks = new Array(10).fill(`<HTMLBlock>{\`${attackPattern}lock\`}</HTMLBlock>`).join('\n');
 
     const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
+    const result = preprocessJSXExpressions(blocks, {});
     const end = Date.now();
     const duration = end - start;
 
-    expect(duration).toBeLessThan(15000);
+    expect(duration).toBeLessThan(30000);
     expect(result).toBeDefined();
-  });
+  }, 10000);
 
   it('should handle attack pattern with extra whitespace', () => {
     const attackString = `<HTMLBlock>{   \`${'\\lock\\lock\\'.repeat(100)}lock\`   }</HTMLBlock>`;
@@ -190,20 +128,6 @@ describe('ReDoS Attack Vectors', () => {
     expect(result).toBeDefined();
   });
 
-  it('should handle pattern specifically designed for nested quantifier attack', () => {
-    // This pattern exploits the (?:[^`\\]|\\.)* nested quantifier
-    // Each backslash can be interpreted as start of escape OR part of previous escape
-    const attackString = `<HTMLBlock>{\`${'\\x\\y'.repeat(300)}z\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(15000);
-    expect(result).toBeDefined();
-  });
-
   it('should handle mixed escape and non-escape patterns', () => {
     const pattern = `${'\\a'}${'b'.repeat(10)}`;
     const attackString = `<HTMLBlock>{\`${pattern.repeat(200)}c\`}</HTMLBlock>`;
@@ -229,54 +153,6 @@ describe('ReDoS Attack Vectors', () => {
     expect(result).toBeDefined();
   });
 
-  it('should handle 1000 repetitions of escape sequences', () => {
-    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(1000)}lock\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(60000);
-    expect(result).toBeDefined();
-  }, 10000);
-
-  it('should handle 2000 repetitions of escape sequences', () => {
-    const attackString = `<HTMLBlock>{\`${'\\lock\\lock\\'.repeat(2000)}lock\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(120000);
-    expect(result).toBeDefined();
-  }, 10000);
-
-  it('should handle many consecutive backslashes (2000)', () => {
-    const attackString = `<HTMLBlock>{\`${'\\'.repeat(2000)}a\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(30000);
-    expect(result).toBeDefined();
-  });
-
-  it('should handle many consecutive backslashes (5000)', () => {
-    const attackString = `<HTMLBlock>{\`${'\\'.repeat(5000)}a\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(60000);
-    expect(result).toBeDefined();
-  }, 10000);
-
   it('should handle HTMLBlock with attributes and attack pattern', () => {
     const attackString = `<HTMLBlock id="test" class="example">{\`${'\\lock\\lock\\'.repeat(200)}lock\`}</HTMLBlock>`;
 
@@ -302,32 +178,6 @@ describe('ReDoS Attack Vectors', () => {
     expect(result).toBeDefined();
   });
 
-  it('should handle very long template literal content (50k chars)', () => {
-    const longContent = 'a'.repeat(50000);
-    const attackString = `<HTMLBlock>{\`${longContent}\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(20000);
-    expect(result).toBeDefined();
-  }, 10000);
-
-  it('should handle very long template literal with escapes (20k chars)', () => {
-    const longContent = '\\a'.repeat(10000);
-    const attackString = `<HTMLBlock>{\`${longContent}\`}</HTMLBlock>`;
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(attackString, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(30000);
-    expect(result).toBeDefined();
-  }, 10000);
-
   it('should handle pattern with all possible escape sequences', () => {
     const escapes = '\\n\\t\\r\\v\\f\\b\\0\\x00\\u0000';
     const attackString = `<HTMLBlock>{\`${escapes.repeat(500)}end\`}</HTMLBlock>`;
@@ -366,32 +216,6 @@ describe('ReDoS Attack Vectors', () => {
     expect(result).toBeDefined();
   });
 
-  it('should handle 10 HTMLBlock tags with attack patterns', () => {
-    const attackPattern = '\\lock\\lock\\'.repeat(50);
-    const blocks = new Array(10).fill(`<HTMLBlock>{\`${attackPattern}lock\`}</HTMLBlock>`).join('\n');
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(blocks, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(30000);
-    expect(result).toBeDefined();
-  }, 10000);
-
-  it('should handle 50 HTMLBlock tags with attack patterns', () => {
-    const attackPattern = '\\lock\\lock\\'.repeat(30);
-    const blocks = new Array(50).fill(`<HTMLBlock>{\`${attackPattern}lock\`}</HTMLBlock>`).join('\n');
-
-    const start = Date.now();
-    const result = preprocessJSXExpressions(blocks, {});
-    const end = Date.now();
-    const duration = end - start;
-
-    expect(duration).toBeLessThan(60000);
-    expect(result).toBeDefined();
-  }, 10000);
-
   it('should handle pattern with tabs and newlines in template literal', () => {
     const attackString = `<HTMLBlock>{\`${'\\t\\n\\r'.repeat(500)}end\`}</HTMLBlock>`;
 
diff --git a/processor/transform/preprocess-jsx-expressions.ts b/processor/transform/preprocess-jsx-expressions.ts
index 204b24115..3fe2c9cf3 100644
--- a/processor/transform/preprocess-jsx-expressions.ts
+++ b/processor/transform/preprocess-jsx-expressions.ts
@@ -36,14 +36,10 @@ interface ProtectCodeBlocksResult {
 }
 
 /**
- * Evaluates a JavaScript expression using the provided context variables.
+ * Evaluates a JavaScript expression using context variables.
  *
- * Creates a function dynamically with context variables as parameters, then executes
- * the expression. This allows safe evaluation of user-provided expressions with
- * controlled variable access.
- *
- * @param expression - The JavaScript expression to evaluate (e.g., "baseUrl + '/path'")
- * @param context - Object containing variables available in the expression
+ * @param expression
+ * @param context
  * @returns The evaluated result
  * @example
  * ```typescript
@@ -51,12 +47,6 @@ interface ProtectCodeBlocksResult {
  * evaluateExpression('baseUrl + path', context)
  * // Returns: 'https://example.com/api'
  * ```
- * @example
- * ```typescript
- * const context = { count: 5 };
- * evaluateExpression('count * 2', context)
- * // Returns: 10
- * ```
  */
 function evaluateExpression(expression: string, context: JSXContext): unknown {
   const contextKeys = Object.keys(context);
@@ -67,29 +57,16 @@ function evaluateExpression(expression: string, context: JSXContext): unknown {
 }
 
 /**
- * Protects HTMLBlock template literal content by base64 encoding it.
+ * Base64 encodes HTMLBlock template literal content to prevent markdown parser from consuming <script>/<style> tags.
  *
- * This prevents the markdown parser from consuming <script>/<style> tags inside HTMLBlocks.
- * The template literal content is extracted, base64 encoded, and wrapped in HTML comments
- * that markdown parsers will ignore.
- *
- * Pattern matched: `<HTMLBlock>{` template-content `}</HTMLBlock>`
- * The template content is base64 encoded and wrapped in special HTML comment markers.
- *
- * @param content - The markdown content containing HTMLBlocks
- * @returns Content with HTMLBlock template literals base64 encoded and wrapped in HTML comments
+ * @param content
+ * @returns Content with HTMLBlock template literals base64 encoded in HTML comments
  * @example
  * ```typescript
  * const input = '<HTMLBlock>{`<script>alert("xss")</script>`}</HTMLBlock>';
  * protectHTMLBlockContent(input)
  * // Returns: '<HTMLBlock><!--RDMX_HTMLBLOCK:PHNjcmlwdD5hbGVydCgieHNzIik8L3NjcmlwdD4=:RDMX_HTMLBLOCK--></HTMLBlock>'
  * ```
- * @example
- * ```typescript
- * const input = '<HTMLBlock>{`console.log("hello");`}</HTMLBlock>';
- * protectHTMLBlockContent(input)
- * // Returns: '<HTMLBlock><!--RDMX_HTMLBLOCK:Y29uc29sZS5sb2coImhlbGxvIik7:RDMX_HTMLBLOCK--></HTMLBlock>'
- * ```
  */
 function protectHTMLBlockContent(content: string): string {
   return content.replace(
@@ -102,18 +79,9 @@ function protectHTMLBlockContent(content: string): string {
 }
 
 /**
- * Protects code blocks and inline code from JSX processing.
- *
- * Replaces fenced code blocks (```code block```) and inline code (`inline code`) with placeholders
- * so they aren't affected by expression evaluation or other JSX processing steps.
- * The original code is stored in arrays for later restoration.
- *
- * Process:
- * 1. Find all fenced code blocks (```code block```) and replace with placeholders
- * 2. Find all inline code (`inline code`) and replace with placeholders
- * 3. Store originals in arrays for later restoration
+ * Replaces code blocks and inline code with placeholders to protect them from JSX processing.
  *
- * @param content - The markdown content to protect
+ * @param content
  * @returns Object containing protected content and arrays of original code blocks
  * @example
  * ```typescript
@@ -127,18 +95,6 @@ function protectHTMLBlockContent(content: string): string {
  * //   protectedContent: 'Text with ___INLINE_CODE_0___ and ___CODE_BLOCK_0___'
  * // }
  * ```
- * @example
- * ```typescript
- * const input = '```js\nconst x = {value: 1};\n```';
- * protectCodeBlocks(input)
- * // Returns: {
- * //   protectedCode: {
- * //     codeBlocks: ['```js\nconst x = {value: 1};\n```'],
- * //     inlineCode: []
- * //   },
- * //   protectedContent: '___CODE_BLOCK_0___'
- * // }
- * ```
  */
 function protectCodeBlocks(content: string): ProtectCodeBlocksResult {
   const codeBlocks: string[] = [];
@@ -177,41 +133,25 @@ function protectCodeBlocks(content: string): ProtectCodeBlocksResult {
 }
 
 /**
- * Removes JSX-style comments from content.
+ * Removes JSX-style comments (e.g., { /* comment *\/ }) from content.
  *
- * JSX comments are wrapped in braces with C-style comment syntax.
- * Format: opening brace, optional whitespace, slash-asterisk, comment content, asterisk-slash, optional whitespace, closing brace.
- * These comments would confuse the markdown parser, so they're removed before processing.
- *
- * The regex matches:
- * - Opening brace with optional whitespace
- * - Comment start marker (slash-asterisk)
- * - Comment content (handling asterisks that don't close the comment)
- * - Comment end marker (asterisk-slash)
- * - Optional whitespace and closing brace
- *
- * @param content - Content potentially containing JSX comments
+ * @param content
  * @returns Content with JSX comments removed
  * @example
- * Input: 'Text { /* comment *\/ } more text'
- * Output: 'Text  more text'
- * @example
- * Input: '{ /* comment *\/ }'
- * Output: ''
+ * ```typescript
+ * removeJSXComments('Text { /* comment *\/ } more text')
+ * // Returns: 'Text  more text'
+ * ```
  */
 function removeJSXComments(content: string): string {
   return content.replace(/\{\s*\/\*[^*]*(?:\*(?!\/)[^*]*)*\*\/\s*\}/g, '');
 }
 
 /**
- * Extracts content between balanced braces starting at a given position.
- *
- * Tracks brace depth to handle nested braces correctly. Starts at depth 1 since
- * the opening brace is already consumed. Returns the content between braces
- * (excluding the braces themselves) and the position after the closing brace.
+ * Extracts content between balanced braces, handling nested braces.
  *
- * @param content - The string to search in
- * @param start - Starting position (should be after the opening {)
+ * @param content
+ * @param start
  * @returns Object with extracted content and end position, or null if braces are unbalanced
  * @example
  * ```typescript
@@ -219,18 +159,6 @@ function removeJSXComments(content: string): string {
  * extractBalancedBraces(input, 3) // start at position 3 (after '{')
  * // Returns: { content: 'bar{baz}qux', end: 16 }
  * ```
- * @example
- * ```typescript
- * const input = 'attr={value}';
- * extractBalancedBraces(input, 6) // start at position 6 (after '{')
- * // Returns: { content: 'value', end: 12 }
- * ```
- * @example
- * ```typescript
- * const input = 'unbalanced{';
- * extractBalancedBraces(input, 10)
- * // Returns: null (unbalanced braces)
- * ```
  */
 function extractBalancedBraces(content: string, start: number): { content: string; end: number } | null {
   let depth = 1;
@@ -248,20 +176,11 @@ function extractBalancedBraces(content: string, start: number): { content: strin
 }
 
 /**
- * Evaluates JSX attribute expressions and converts them to HTML attributes.
- *
- * Transforms JSX attribute syntax (attribute={expression}) to HTML attributes (attribute="value").
- * The expression is evaluated using the provided context, and the result is converted to
- * a string value for the HTML attribute.
+ * Converts JSX attribute expressions (attribute={expression}) to HTML attributes (attribute="value").
+ * Handles style objects (camelCase → kebab-case), className → class, and JSON stringifies objects.
  *
- * Special handling:
- * - `style` objects are converted to CSS strings (camelCase → kebab-case)
- * - `className` is converted to `class` (HTML standard)
- * - Objects are JSON stringified
- * - If evaluation fails, the original expression is kept unchanged
- *
- * @param content - Content containing JSX attribute expressions
- * @param context - Context object for expression evaluation
+ * @param content
+ * @param context
  * @returns Content with attribute expressions evaluated and converted to HTML attributes
  * @example
  * ```typescript
@@ -270,34 +189,6 @@ function extractBalancedBraces(content: string, start: number): { content: strin
  * evaluateAttributeExpressions(input, context)
  * // Returns: '<a href="https://example.com">Link</a>'
  * ```
- * @example
- * ```typescript
- * const context = { isActive: true };
- * const input = '<div active={isActive}>Content</div>';
- * evaluateAttributeExpressions(input, context)
- * // Returns: '<div active="true">Content</div>'
- * ```
- * @example
- * ```typescript
- * const context = { styles: { backgroundColor: 'red', fontSize: '14px' } };
- * const input = '<div style={styles}>Content</div>';
- * evaluateAttributeExpressions(input, context)
- * // Returns: '<div style="background-color: red; font-size: 14px">Content</div>'
- * ```
- * @example
- * ```typescript
- * const context = { className: 'my-class' };
- * const input = '<div className={className}>Content</div>';
- * evaluateAttributeExpressions(input, context)
- * // Returns: '<div class="my-class">Content</div>'
- * ```
- * @example
- * ```typescript
- * const context = { data: { id: 1, name: 'test' } };
- * const input = '<div data={data}>Content</div>';
- * evaluateAttributeExpressions(input, context)
- * // Returns: '<div data=\'{"id":1,"name":"test"}\'>Content</div>'
- * ```
  */
 function evaluateAttributeExpressions(content: string, context: JSXContext): string {
   const attrStartRegex = /(\w+)=\{/g;
@@ -350,13 +241,10 @@ function evaluateAttributeExpressions(content: string, context: JSXContext): str
 }
 
 /**
- * Restores code blocks and inline code that were protected earlier.
- *
- * Replaces placeholders (___CODE_BLOCK_N___ and ___INLINE_CODE_N___) with the
- * original code content that was stored during the protection phase.
+ * Restores code blocks and inline code by replacing placeholders with original content.
  *
- * @param content - Content with code block placeholders
- * @param protectedCode - Object containing arrays of original code blocks and inline code
+ * @param content
+ * @param protectedCode
  * @returns Content with all code blocks and inline code restored
  * @example
  * ```typescript
@@ -382,55 +270,12 @@ function restoreCodeBlocks(content: string, protectedCode: ProtectedCode): strin
 }
 
 /**
- * Main preprocessing function for JSX-like expressions in markdown.
+ * Preprocesses JSX-like expressions in markdown before parsing.
+ * Inline expressions are handled separately; attribute expressions are processed here.
  *
- * We can't rely on remarkMdx since it restricts the syntax too much, so we manually
- * parse and process JSX syntax before the markdown parser runs.
- *
- * Processing pipeline (executed in order):
- * 1. Protect HTMLBlock content (base64 encode to prevent parser from consuming <script>/<style>)
- * 2. Protect code blocks and inline code (so they aren't affected by JSX processing)
- * 3. Remove JSX comments (they would confuse the markdown parser)
- * 4. Evaluate attribute expressions (convert href={baseUrl} to href="value")
- * 5. Restore protected code blocks (put them back in place)
- *
- * Note: Inline expressions (like {variable} in text) are handled by a separate library
- * later in the pipeline. Attribute expressions are processed here because it's difficult
- * to use a library to parse them in the context of JSX attributes.
- *
- * @param content - The markdown content containing JSX-like syntax
- * @param context - Context object providing variables for expression evaluation
+ * @param content
+ * @param context
  * @returns Preprocessed content ready for markdown parsing
- * @example
- * ```typescript
- * const context = {
- *   baseUrl: 'https://example.com',
- *   userId: '123',
- *   isActive: true
- * };
- * const input = `
- * <a href={baseUrl} id={userId} active={isActive}>Link</a>
- * \`\`\`js
- * const x = {value: 1};
- * \`\`\`
- * `;
- * preprocessJSXExpressions(input, context)
- * // Returns content with:
- * // - href={baseUrl} → href="https://example.com"
- * // - id={userId} → id="123"
- * // - active={isActive} → active="true"
- * // - Code blocks preserved unchanged
- * ```
- * @example
- * ```typescript
- * const context = { className: 'my-class' };
- * const input = '<div className={className}>Content</div>';
- * preprocessJSXExpressions(input, context)
- * // Returns: '<div class="my-class">Content</div>'
- * ```
- * @example
- * Input: 'Text { /* comment *\/ } more text'
- * Output: 'Text  more text' (comment removed)
  */
 export function preprocessJSXExpressions(content: string, context: JSXContext = {}): string {
   // Step 0: Base64 encode HTMLBlock content