From b6e3ca3830cb7241b62fc51bfb0165987dfb133b Mon Sep 17 00:00:00 2001
From: Dominique Quatravaux <dominique.quatravaux@epfl.ch>
Date: Fri, 6 Feb 2026 12:34:21 +0100
Subject: [PATCH] Fix: `findPossibleIndexes`: protect any metacharacters in the
 symbols

Fixes #13

This prevents an infinite loop for e.g. modules that export a variable named `$`.

In Node 24.x we could use `RegExp.escape()`, but that doesn't exist in
Node 22.x which Meteor 3.4.0 uses. Provide a polyfill
---
 lib/utils.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/utils.js b/lib/utils.js
index 2cf88ca..0516ccd 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -103,7 +103,7 @@ function findPossibleIndexes(code, identifiers, filter) {
   }
 
   const pattern = new RegExp(
-    "\\b(?:" + identifiers.join("|") + ")\\b",
+    "\\b(?:" + identifiers.map(escapeRegExp).join("|") + ")\\b",
     "g"
   );
 
@@ -118,6 +118,11 @@ function findPossibleIndexes(code, identifiers, filter) {
   return possibleIndexes;
 }
 
+// RegExp.escape() polyfill, since Node 22.x doesn't have it
+function escapeRegExp (regexp) {
+  return regexp.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+};
+
 exports.findPossibleIndexes = findPossibleIndexes;
 
 function findLikelyIndexes(code, identifiers) {