fix(webmention): remove polynomial-redos in Link header regex

.changeset/webmention-fix-polynomial-redos-link-header.md

@@ -0,0 +1,5 @@
+---
+"@dwk/webmention": patch
+---
+
+fix(webmention): remove ambiguous quantifier pair in `Link` header parsing regex flagged by CodeQL as a polynomial ReDoS (`js/polynomial-redos`). The redundant `\s*` immediately before `(.*)$` overlapped with what `.` can already match, allowing crafted `Link` header values (attacker-controlled, fetched from a webmention source/target) to force excessive backtracking. Parameter-leading whitespace is still stripped by the per-parameter `rel` regex in `extractRel`, so behavior is unchanged.

packages/webmention/src/html.ts

@@ -37,7 +37,7 @@ export function parseLinkHeader(value: string | null): LinkHeaderEntry[] {
   }
   const entries: LinkHeaderEntry[] = [];
   for (const part of splitLinks(value)) {
-    const match = /^\s*<([^>]*)>\s*(.*)$/.exec(part);
+    const match = /^\s*<([^>]*)>(.*)$/.exec(part);
     if (match === null) {
       continue;
     }