fix(sdk): bound the webhook key-template regex against ReDoS

The key placeholder regex used [^}]+, so a run of "{" with no closing brace
backtracks quadratically: every start position rescans to the end. Exclude "{"
from the character class so a non-matching position fails immediately (a valid
{path} placeholder never contains "{"), making normalization linear.

Author: ericallam

packages/trigger-sdk/src/v3/webhooks.ts

@@ -306,7 +306,7 @@ export type {
 // Brace placeholders without a recognized namespace default to the event body. webhook./header./body.
 // pass through unchanged.
 export function normalizeKeyString(key: string): string {
-  return key.replace(/\{([^}]+)\}/g, (_match, path: string) =>
+  return key.replace(/\{([^{}]+)\}/g, (_match, path: string) =>
     path.startsWith("webhook.") || path.startsWith("header.") || path.startsWith("body.")
       ? `{${path}}`
       : `{body.${path}}`

packages/trigger-sdk/test/normalizeKeyString.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+import { normalizeKeyString } from "../src/v3/webhooks.js";
+
+describe("normalizeKeyString", () => {
+  it("passes through webhook./header./body. placeholders unchanged", () => {
+    expect(normalizeKeyString("{body.event.id}")).toBe("{body.event.id}");
+    expect(normalizeKeyString("{header.x-github-event}")).toBe("{header.x-github-event}");
+    expect(normalizeKeyString("{webhook.deliveryId}")).toBe("{webhook.deliveryId}");
+  });
+
+  it("defaults an unqualified placeholder to the event body", () => {
+    expect(normalizeKeyString("{event.id}")).toBe("{body.event.id}");
+    expect(normalizeKeyString("{conversationId}")).toBe("{body.conversationId}");
+  });
+
+  it("normalizes every placeholder in a composite template", () => {
+    expect(normalizeKeyString("{team}/{body.channel}/{event.ts}")).toBe(
+      "{body.team}/{body.channel}/{body.event.ts}"
+    );
+  });
+
+  it("leaves literal text and unmatched braces alone", () => {
+    expect(normalizeKeyString("no-placeholders")).toBe("no-placeholders");
+    expect(normalizeKeyString("{{body.x}}")).toBe("{{body.x}}");
+  });
+
+  it("handles a pathological brace run in linear time", { timeout: 1000 }, () => {
+    const input = "{".repeat(500_000);
+    expect(normalizeKeyString(input)).toBe(input);
+  });
+});