Fix for potential polynomial backtracking in picture string

src/datetime.js

@@ -995,7 +995,8 @@ const dateTime = (function () {
                         return offsetHours * 60 + offsetMinutes;
                     };
                 } else if (part.component === 'f') {
-                    res.regex = '[0-9]+';
+                    const fParseWidth = part.integerFormat && part.integerFormat.parseWidth;
+                    res.regex = fParseWidth ? `[0-9]{${fParseWidth}}` : '[0-9]+';
                     res.parse = function(value) {
                         return parseFloat('0.' + value.substring(0, 3)) * 1000;
                     };
@@ -1138,7 +1139,10 @@ const dateTime = (function () {
         const matchSpec = generateRegex(formatSpec);
         const fullRegex = '^' + matchSpec.parts.map(part => '(' + part.regex + ')').join('') + '$';
 
-        const matcher = new RegExp(fullRegex, 'i'); // TODO can cache this against the picture
+        // Use the caller-supplied RegexEngine (if any) so that a ReDoS-safe engine
+        // plugged in via the `RegexEngine` option also protects this code path.
+        const RegexEngine = (this && this.environment && this.environment.base && this.environment.base.RegexEngine) || RegExp;
+        const matcher = new RegexEngine(fullRegex, 'i'); // TODO can cache this against the picture
         var info = matcher.exec(timestamp);
         if (info !== null) {
             // validate what we've just parsed - do we have enough information to create a timestamp?

test/parser-pluggable-regex.js

@@ -70,3 +70,36 @@ describe('Detect and repel ReDoS attack', function() {
         });
     })
 })
+
+describe("ParseDateTime RegexEngine tests", () => {
+    describe("$toMillis respects the RegexEngine option in parseDateTime", function () {
+        it("should return result object", async function () {
+            var engineCalled = false;
+            function TrackingRegExp(pattern, flags) {
+                engineCalled = true;
+                return new RegExp(pattern, flags);
+            }
+            var expr = jsonata(
+                "$toMillis('2018-03-27T14:03:00.123Z', '[Y0001]-[M01]-[D01]T[H01]:[m01]:[s01].[f001]Z')",
+                { RegexEngine: TrackingRegExp }
+            );
+            var result = await expr.evaluate({});
+            expect(engineCalled).to.equal(true);
+            expect(result).to.equal(1522159380123);
+        });
+    });
+
+    describe("$toMillis falls back to RegExp when no RegexEngine is in the environment", function () {
+        it("should return result object", function () {
+            var datetime = require('../src/datetime');
+            var fakeThis = {
+                environment: {
+                    timestamp: new Date('2018-03-27T14:03:00.123Z'),
+                    base: {}
+                }
+            };
+            var result = datetime.toMillis.call(fakeThis, '2018-03-27T14:03:00.123Z', '[Y0001]-[M01]-[D01]T[H01]:[m01]:[s01].[f001]Z');
+            expect(result).to.equal(1522159380123);
+        });
+    });
+});

test/test-suite/groups/function-tomillis/parseDateTime.json

@@ -374,5 +374,13 @@
         "expr": "$toMillis('2026-04-08T19:05:04.01987', '[Y0001]-[M01]-[D01]T[H01]:[m01]:[s01].[f1]') ~> $fromMillis() ",
         "data": {},
         "result": "2026-04-08T19:05:04.019Z"
+    },
+    {
+        "function": "#toMillis",
+        "category": "adjacent fractional-second components",
+        "description": "should correctly process adjacent [f] components to prevent ReDoS",
+        "expr": "$toMillis('2026-09-17T18:10:23.0190', '[Y0001]-[M01]-[D01]T[H01]:[m01]:[s01].[f1][f001]') ~> $fromMillis()",
+        "data": {},
+        "result": "2026-09-17T18:10:23.190Z"
     }
 ]