fix: ensure dots in content script patterns aren't used as wildcards (#…

…17594)

* fix: ensure dots in content script patterns aren't used as wildcards

* chore: santize all regex chars

* chore: extract to helper

* chore: fixup helper

lib/renderer/content-scripts-injector.js

@@ -3,11 +3,15 @@
 const ipcRenderer = require('@electron/internal/renderer/ipc-renderer-internal')
 const { runInThisContext } = require('vm')
 
+const escapePattern = function (pattern) {
+  return pattern.replace(/[\\^$+?.()|[\]{}]/g, '\\$&')
+}
+
 // Check whether pattern matches.
 // https://developer.chrome.com/extensions/match_patterns
 const matchesPattern = function (pattern) {
   if (pattern === '<all_urls>') return true
-  const regexp = new RegExp(`^${pattern.replace(/\*/g, '.*')}$`)
+  const regexp = new RegExp(`^${pattern.split('*').map(escapePattern).join('.*')}$`)
   const url = `${location.protocol}//${location.host}${location.pathname}`
   return url.match(regexp)
 }