perf(cli): optimize memory and speed in bias_scorer and is_safe_url

.trivyignore

@@ -2,3 +2,9 @@
 # Transitive dependency of next.js — requires breaking next.js upgrade to fix
 GHSA-qx2v-qp2m-jg93
 CVE-2026-41305
+
+# PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL
+CVE-2026-45623
+
+# sharp inherited vulnerabilities in libvips
+GHSA-f88m-g3jw-g9cj

cli/src/bias_scorer.rs

@@ -1,7 +1,23 @@
 //! Source bias and quality scoring.
 
+use regex::Regex;
+use std::sync::OnceLock;
 use url::Url;
 
+static SPAM_PATTERNS: OnceLock<[Regex; 5]> = OnceLock::new();
+
+fn get_spam_patterns() -> &'static [Regex; 5] {
+    SPAM_PATTERNS.get_or_init(|| {
+        [
+            Regex::new("(?i)buy now").expect("Invalid regex for buy now"),
+            Regex::new("(?i)cheap").expect("Invalid regex for cheap"),
+            Regex::new("(?i)discount").expect("Invalid regex for discount"),
+            Regex::new("(?i)free trial").expect("Invalid regex for free trial"),
+            Regex::new("(?i)best price").expect("Invalid regex for best price"),
+        ]
+    })
+}
+
 /// Score a result based on domain trust and content quality
 pub fn score_result(url: &str, content: &str) -> f64 {
     let mut score: f64 = 0.5;
@@ -54,10 +70,9 @@ pub fn score_result(url: &str, content: &str) -> f64 {
     }
 
     // SEO spam detection
-    let spam_terms = ["buy now", "cheap", "discount", "free trial", "best price"];
-    let lower_content = content.to_lowercase();
-    for term in spam_terms {
-        if lower_content.contains(term) {
+    let spam_patterns = get_spam_patterns();
+    for re in spam_patterns {
+        if re.is_match(content) {
             score -= 0.1;
         }
     }

cli/src/resolver/cascade.rs

@@ -27,7 +27,7 @@ pub fn is_safe_url(url_str: &str) -> bool {
         Err(_) => return false,
     };
 
-    let scheme = parsed.scheme().to_lowercase();
+    let scheme = parsed.scheme();
     if scheme != "http" && scheme != "https" {
         return false;
     }
@@ -39,11 +39,10 @@ pub fn is_safe_url(url_str: &str) -> bool {
 
     match host {
         url::Host::Domain(domain) => {
-            let lowered = domain.to_lowercase();
-            if lowered == "localhost"
-                || lowered == "localhost.localdomain"
-                || lowered.ends_with(".local")
-                || lowered.ends_with(".internal")
+            if domain == "localhost"
+                || domain == "localhost.localdomain"
+                || domain.ends_with(".local")
+                || domain.ends_with(".internal")
             {
                 return false;
             }
@@ -131,6 +130,7 @@ mod tests {
     #[test]
     fn test_is_safe_url() {
         assert!(is_safe_url("https://example.com"));
+        assert!(is_safe_url("HTTPS://EXAMPLE.COM"));
         assert!(is_safe_url("http://example.com/path"));
         assert!(!is_safe_url("http://localhost"));
         assert!(!is_safe_url("http://127.0.0.1"));