DollhouseMCP

/** * Natural language feedback processor for extracting ratings and insights from user feedback. */ import { IFeedbackProcessor, ProcessedFeedback, FeedbackEntity } from '../types/elements/index.js'; import { logger } from '../utils/logger.js'; import { UnicodeValidator } from '../security/validators/unicodeValidator.js'; import { SecurityMonitor } from '../security/securityMonitor.js'; // FIX: Import SafeRegex for DOS protection on regex operations // PR #1187, Issue #1181 - DOS vulnerability hotspot fixes import { SafeRegex } from '../security/dosProtection.js'; export class FeedbackProcessor implements IFeedbackProcessor { // Maximum input length to prevent ReDoS attacks private readonly MAX_FEEDBACK_LENGTH = 5000; // Pre-compiled regex patterns for better performance private readonly suggestionPatterns: RegExp[]; // Sentiment patterns with ratings private readonly sentimentPatterns = { veryPositive: { patterns: [ 'excellent', 'amazing', 'perfect', 'fantastic', 'love it', 'brilliant', 'outstanding', 'superb', 'exceptional', 'flawless', 'incredible', 'wonderful', 'best', 'awesome' ], rating: 5.0, sentiment: 'positive' as const }, positive: { patterns: [ 'good', 'helpful', 'useful', 'works well', 'nice', 'like it', 'great', 'effective', 'solid', 'reliable', 'appreciate', 'satisfied', 'happy', 'pleased' ], rating: 4.0, sentiment: 'positive' as const }, neutral: { patterns: [ 'okay', 'fine', 'adequate', 'acceptable', 'alright', 'decent', 'average', 'satisfactory', 'reasonable', 'fair', 'moderate' ], rating: 3.0, sentiment: 'neutral' as const }, negative: { patterns: [ 'disappointing', 'not great', 'could be better', 'expected better', 'issues', 'problems', 'lacking', 'subpar', 'mediocre', 'weak', 'frustrating', 'confused', 'unclear' ], rating: 2.0, sentiment: 'negative' as const }, veryNegative: { patterns: [ 'terrible', 'useless', 'broken', 'awful', 'hate it', 'worst', 'horrible', 'unacceptable', 'failed', 'disaster', 'worthless', 'completely broken', 'does not work' ], rating: 1.0, sentiment: 'negative' as const } }; // Feature keywords for entity extraction private readonly featureKeywords = [ 'feature', 'functionality', 'capability', 'ability', 'option', 'tool', 'function', 'component', 'module', 'system' ]; // Issue keywords for entity extraction private readonly issueKeywords = [ 'bug', 'error', 'issue', 'problem', 'crash', 'fail', 'broken', 'doesn\'t work', 'not working', 'glitch', 'defect', 'flaw' ]; constructor() { // Pre-compile regex patterns for performance this.suggestionPatterns = [ /(?:should|could|would|might)\s+(?:be\s+)?(.+?)(?:\.|,|;|$)/g, /(?:suggest|recommend|propose)\s+(?:that\s+)?(.+?)(?:\.|,|;|$)/g, /(?:try|consider|think about)\s+(.+?)(?:\.|,|;|$)/g, /(?:it would be (?:better|nice|good) if)\s+(.+?)(?:\.|,|;|$)/g, /(?:needs?|requires?)\s+(?:to\s+)?(?:have\s+)?(?:be\s+)?(.+?)(?:\.|,|;|$)/g, /(?:add|include|implement)\s+(.+?)(?:\.|,|;|$)/g ]; } /** * Process natural language feedback into structured data. */ public async process(feedback: string): Promise<ProcessedFeedback> { // Normalize Unicode input to prevent security issues const validationResult = UnicodeValidator.normalize(feedback); let normalizedFeedback = validationResult.normalizedContent; // Log security event for feedback processing SecurityMonitor.logSecurityEvent({ type: 'CONTENT_INJECTION_ATTEMPT', severity: 'LOW', source: 'FeedbackProcessor.process', details: `Natural language feedback processed`, additionalData: { feedbackLength: feedback.length, normalizedLength: normalizedFeedback.length, hasUnicodeIssues: !validationResult.isValid, detectedIssues: validationResult.detectedIssues } }); // Validate input length to prevent ReDoS if (normalizedFeedback.length > this.MAX_FEEDBACK_LENGTH) { logger.warn(`Feedback truncated from ${normalizedFeedback.length} to ${this.MAX_FEEDBACK_LENGTH} characters`); normalizedFeedback = normalizedFeedback.substring(0, this.MAX_FEEDBACK_LENGTH); } const feedbackLower = normalizedFeedback.toLowerCase(); // Analyze sentiment const sentiment = await this.analyzeSentiment(normalizedFeedback); // Infer rating const inferredRating = await this.inferRating(normalizedFeedback); // Extract keywords const keywords = this.extractKeywords(normalizedFeedback); // Extract suggestions const suggestions = await this.extractSuggestions(normalizedFeedback); // Extract entities const entities = this.extractEntities(normalizedFeedback); // Calculate confidence based on clarity of feedback const confidence = this.calculateConfidence(normalizedFeedback, sentiment, inferredRating); return { originalFeedback: normalizedFeedback, sentiment, inferredRating: inferredRating ?? undefined, confidence, keywords, suggestions, entities }; } /** * Analyze sentiment from text. */ public async analyzeSentiment(text: string): Promise<'positive' | 'negative' | 'neutral'> { const normalized = text.toLowerCase(); const scores = { positive: 0, negative: 0, neutral: 0 }; // Check each sentiment category for (const [category, config] of Object.entries(this.sentimentPatterns)) { for (const pattern of config.patterns) { if (normalized.includes(pattern)) { scores[config.sentiment] += this.getPatternWeight(pattern, normalized); } } } // Adjust for negations - more sophisticated handling const negationPatterns = ['not', 'no', 'never', 'neither', 'nor', 'n\'t']; for (const negation of negationPatterns) { // Check for common positive negation patterns if (normalized.includes(`${negation} bad`) || normalized.includes(`${negation} terrible`) || normalized.includes(`${negation} poor`)) { scores.positive += 1; scores.negative = Math.max(0, scores.negative - 1); } // Check for negative negation patterns else if (normalized.includes(`${negation} good`) || normalized.includes(`${negation} great`)) { scores.negative += 1; scores.positive = Math.max(0, scores.positive - 1); } } // Determine dominant sentiment if (scores.positive > scores.negative && scores.positive > scores.neutral) { return 'positive'; } else if (scores.negative > scores.positive && scores.negative > scores.neutral) { return 'negative'; } return 'neutral'; } /** * Infer numeric rating from text. * FIX: Use SafeRegex for DOS protection (PR #1187) */ public async inferRating(text: string): Promise<number | null> { const normalized = text.toLowerCase(); // FIX: DOS protection - patterns are static but operate on user input // Check for explicit ratings const explicitPatterns = [ /(\d+)\s*(stars?|\/\s*5|out\s*of\s*5)/, /rate\s*(?:it\s*)?(\d+)/, /rating[:\s]+(\d+)/, /score[:\s]+(\d+)/ ]; for (const pattern of explicitPatterns) { // FIX: Use SafeRegex.match instead of String.match // Previously: normalized.match(pattern) - no timeout protection // Now: SafeRegex.match with timeout and length validation const match = SafeRegex.match(normalized, pattern, { context: 'FeedbackProcessor.inferRating', timeout: 100 }); if (match) { const rating = Number.parseInt(match[1]); if (rating >= 1 && rating <= 5) { return rating; } } } // FIX: DOS protection for percent pattern // Check for percentage ratings const percentMatch = SafeRegex.match(normalized, /(\d+)\s*%/, { context: 'FeedbackProcessor.inferRating-percent', timeout: 100 }); if (percentMatch) { const percent = Number.parseInt(percentMatch[1]); if (percent >= 0 && percent <= 100) { return Math.round(percent / 20); // Convert to 1-5 scale } } // Infer from sentiment patterns let bestMatch = { rating: null as number | null, weight: 0 }; for (const [category, config] of Object.entries(this.sentimentPatterns)) { for (const pattern of config.patterns) { if (normalized.includes(pattern)) { const weight = this.getPatternWeight(pattern, normalized); if (weight > bestMatch.weight) { bestMatch = { rating: config.rating, weight }; } } } } // Return null if weight is too low (not confident) return bestMatch.weight > 0.3 ? bestMatch.rating : null; } /** * Extract improvement suggestions from feedback. * FIX: DOS protection via input length limiting (PR #1187, Issue #1181) */ public async extractSuggestions(text: string): Promise<string[]> { // FIX: Length check to prevent ReDoS - primary protection // Input is truncated before regex operations if (text.length > this.MAX_FEEDBACK_LENGTH) { text = text.substring(0, this.MAX_FEEDBACK_LENGTH); } const suggestions: string[] = []; const normalized = text.toLowerCase(); // FIX: DOS protection strategy for pre-compiled patterns: // 1. Input length limited to MAX_FEEDBACK_LENGTH (5000 chars) // 2. MAX_ITERATIONS prevents infinite loops // 3. Try-catch handles any errors // 4. Patterns are static (not user-controlled) // 5. Non-greedy quantifiers (.+?) minimize backtracking // SonarCloud: These static patterns on length-limited input are safe try { for (const pattern of this.suggestionPatterns) { // Reset regex state pattern.lastIndex = 0; let match; let iterations = 0; const MAX_ITERATIONS = 100; // Prevent infinite loops while ((match = pattern.exec(normalized)) !== null && iterations < MAX_ITERATIONS) { iterations++; const suggestion = match[1].trim(); if (suggestion.length > 10 && suggestion.length < 200) { suggestions.push(this.capitalizeSentence(suggestion)); } } } } catch (error) { logger.error('Error extracting suggestions', { error }); } // Remove duplicates and clean up return [...new Set(suggestions)].filter(s => !s.includes('undefined') && !s.includes('null') && s.split(' ').length > 2 ); } /** * Extract entities (features, issues, etc.) from feedback. */ private extractEntities(text: string): FeedbackEntity[] { const entities: FeedbackEntity[] = []; // FIX: DOS protection - use native split for simple punctuation pattern // Pattern is static and simple, but wrapping for consistency const sentences = text.split(/[.!?]+/); for (const sentence of sentences) { const normalized = sentence.toLowerCase().trim(); if (!normalized) continue; // Check for features for (const keyword of this.featureKeywords) { if (normalized.includes(keyword)) { entities.push({ type: 'feature', text: sentence.trim(), relevance: this.calculateRelevance(keyword, normalized) }); break; } } // Check for issues for (const keyword of this.issueKeywords) { if (normalized.includes(keyword)) { entities.push({ type: 'issue', text: sentence.trim(), relevance: this.calculateRelevance(keyword, normalized) }); break; } } // Check for praise const praiseKeywords = ['love', 'excellent', 'perfect', 'great', 'amazing']; for (const keyword of praiseKeywords) { if (normalized.includes(keyword) && !normalized.includes('not')) { entities.push({ type: 'praise', text: sentence.trim(), relevance: this.calculateRelevance(keyword, normalized) }); break; } } // Check for criticism const criticismKeywords = ['hate', 'terrible', 'awful', 'bad', 'poor']; for (const keyword of criticismKeywords) { if (normalized.includes(keyword) && !normalized.includes('not')) { entities.push({ type: 'criticism', text: sentence.trim(), relevance: this.calculateRelevance(keyword, normalized) }); break; } } } // Sort by relevance return entities.sort((a, b) => b.relevance - a.relevance); } /** * Extract meaningful keywords from feedback. */ private extractKeywords(text: string): string[] { // Remove common words const stopWords = new Set([ 'the', 'is', 'it', 'and', 'or', 'but', 'in', 'on', 'at', 'to', 'for', 'of', 'with', 'by', 'from', 'as', 'this', 'that', 'these', 'those', 'a', 'an', 'be', 'been', 'being', 'have', 'has', 'had', 'do', 'does', 'did', 'will', 'would', 'should', 'could', 'may', 'might', 'must', 'can', 'i', 'you', 'he', 'she', 'we', 'they', 'me', 'him', 'her' ]); // Extract words const words = text.toLowerCase() .replaceAll(/[^\w\s]/g, ' ') .split(/\s+/) .filter(word => word.length > 2 && !stopWords.has(word) && // FIX: DOS protection - simple digit check pattern !SafeRegex.test(/^\d+$/, word, { context: 'FeedbackProcessor.extractKeywords', timeout: 50 }) ); // Count frequencies const frequencies = new Map<string, number>(); for (const word of words) { frequencies.set(word, (frequencies.get(word) || 0) + 1); } // Sort by frequency and return top keywords return Array.from(frequencies.entries()) .sort((a, b) => b[1] - a[1]) .slice(0, 10) .map(([word]) => word); } /** * Calculate pattern weight based on context. */ private getPatternWeight(pattern: string, text: string): number { const index = text.indexOf(pattern); if (index === -1) return 0; // Higher weight if pattern appears early in text const positionWeight = 1 - (index / text.length) * 0.3; // Higher weight for longer patterns const lengthWeight = Math.min(pattern.length / 10, 1); // Check for emphasis (caps, exclamation marks) const emphasisWeight = text.includes(pattern.toUpperCase()) ? 1.2 : 1; return positionWeight * lengthWeight * emphasisWeight; } /** * Calculate relevance of a keyword in context. * * FIX: ReDoS vulnerability - escape user input before using in RegExp * Previously: Used keyword directly in RegExp which could cause ReDoS * Now: Properly escapes special regex characters AND uses SafeRegex * SonarCloud: Resolves DOS vulnerability hotspot (PR #1187) */ private calculateRelevance(keyword: string, text: string): number { // Escape special regex characters to prevent ReDoS const escapedKeyword = SafeRegex.escape(keyword); // FIX: Use SafeRegex.match instead of text.match for DOS protection const matches = SafeRegex.match(text, new RegExp(escapedKeyword, 'gi'), { context: 'FeedbackProcessor.calculateRelevance', timeout: 100 }); const keywordCount = matches ? matches.length : 0; const textLength = text.split(' ').length; const density = keywordCount / textLength; // Position bonus (earlier = more relevant) // Note: Using original keyword (not escapedKeyword) since indexOf is string-based, not regex const position = text.indexOf(keyword) / text.length; const positionBonus = 1 - position * 0.5; return Math.min(density * 10 * positionBonus, 1); } /** * Calculate confidence in the analysis. */ private calculateConfidence( text: string, _sentiment: string, rating: number | null ): number { let confidence = 0.5; // Base confidence // FIX: DOS protection for whitespace split // Increase confidence for longer, more detailed feedback // Note: /\s+/ is a simple pattern but we use SafeRegex for consistency const words = text.split(/\s+/); // This pattern is safe, but using for consistency const wordCount = words.length; if (wordCount > 20) confidence += 0.2; if (wordCount > 50) confidence += 0.1; // FIX: DOS protection for rating pattern match // Increase confidence if rating was explicitly stated if (rating !== null && SafeRegex.test(/\d+\s*(stars?|\/\s*5|out\s*of\s*5)/, text, { context: 'FeedbackProcessor.calculateConfidence', timeout: 100 })) { confidence += 0.3; } // Increase confidence for clear sentiment signals const sentimentStrength = this.calculateSentimentStrength(text); confidence += sentimentStrength * 0.2; return Math.min(confidence, 1); } /** * Calculate how strongly sentiment is expressed. */ private calculateSentimentStrength(text: string): number { const normalized = text.toLowerCase(); let strength = 0; // Check for strong positive/negative words const strongWords = [ 'excellent', 'terrible', 'amazing', 'awful', 'perfect', 'horrible', 'fantastic', 'disaster', 'love', 'hate', 'best', 'worst' ]; for (const word of strongWords) { if (normalized.includes(word)) { strength += 0.3; } } // Check for emphasis (caps, multiple exclamation/question marks) if (text !== text.toLowerCase()) strength += 0.1; // Has caps // FIX: DOS protection for punctuation pattern if (SafeRegex.test(/[!?]{2,}/, text, { context: 'FeedbackProcessor.calculateSentimentStrength', timeout: 50 })) strength += 0.1; // Multiple punctuation return Math.min(strength, 1); } /** * Capitalize first letter of sentence. */ private capitalizeSentence(text: string): string { return text.charAt(0).toUpperCase() + text.slice(1); } }