fix: address remaining CodeRabbit review findings on PR #48

- RegexDriver: track masked ranges and use immutable normalized string
  for position lookups to prevent offset drift across mutated buffers
- RegexDriver: extract matched text from original input instead of
  normalized string to preserve original casing/characters
- PipelineDriver: pass explicit UTF-8 encoding to mb_substr calls
- PendingCheck: cap cache key tracking with configurable max_tracked_keys
  to prevent unbounded growth
- French config: remove mince/flûte/flute from profanity list as they
  are common benign words that cause false positives
- German config: move schwul/schwule/schwuler/schwules from extreme to
  moderate severity as they are also neutral self-identifiers
- StrMacroTest: replace toString() with (string) cast for Laravel 8 compat

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: deemonic

config/languages/french.php

@@ -4,7 +4,7 @@
     'severity' => [
         'mild' => [
             'crotte', 'crottes', 'caca', 'cacas', 'zut',
-            'mince', 'flûte', 'flute', 'punaise',
+            'punaise',
             'idiot', 'idiots', 'idiote', 'idiotes',
             'bête', 'bete', 'bêtes', 'betes',
             'sot', 'sots', 'sotte', 'sottes',
@@ -1537,9 +1537,6 @@
         'réfrigérations',
         'refrigerations',
         'zut',
-        'mince',
-        'flûte',
-        'flute',
         'punaise',
     ],
 

config/languages/german.php

@@ -19,6 +19,7 @@
             'bekloppt', 'bekloppte', 'bekloppter', 'beklopptes',
             'schwanz', 'pimmel',
             'hintern', 'po', 'popo',
+            'schwul', 'schwuler', 'schwule', 'schwules',
         ],
         'high' => [
             'scheiße', 'scheisse', 'ficken', 'fick', 'gefickt',
@@ -27,7 +28,6 @@
             'vögeln', 'voegeln', 'bumsen',
         ],
         'extreme' => [
-            'schwul', 'schwuler', 'schwule', 'schwules',
             'tunte', 'tuntig',
             'kampflesbe', 'kampflesben',
             'kanake', 'kanaken',

src/Drivers/PipelineDriver.php

@@ -65,7 +65,7 @@ public function detect(string $text, Dictionary $dictionary, MaskStrategyInterfa
         $reversed = array_reverse($kept);
         foreach ($reversed as $match) {
             $replacement = $mask->mask($match->text, $match->length);
-            $cleanText = mb_substr($cleanText, 0, $match->position) . $replacement . mb_substr($cleanText, $match->position + $match->length);
+            $cleanText = mb_substr($cleanText, 0, $match->position, 'UTF-8') . $replacement . mb_substr($cleanText, $match->position + $match->length, null, 'UTF-8');
         }
 
         // 5. Recalculate score from merged matches

src/Drivers/RegexDriver.php

@@ -39,11 +39,17 @@ public function detect(string $text, Dictionary $dictionary, MaskStrategyInterfa
         $normalizedString = $normalizer->normalize($text);
         $originalNormalized = preg_replace('/\s+/', ' ', $normalizedString);
 
+        // Immutable copy for position lookups — never mutated
+        $immutableNormalized = $originalNormalized;
+
         $matchedWords = [];
         $uniqueMap = [];
         $profanitiesCount = 0;
         $continue = true;
 
+        // Track masked character ranges so we don't re-match them
+        $maskedRanges = [];
+
         while ($continue) {
             $continue = false;
             $normalizedString = preg_replace('/\s+/', ' ', $normalizedString);
@@ -59,6 +65,19 @@ public function detect(string $text, Dictionary $dictionary, MaskStrategyInterfa
                         $length = mb_strlen($match[0], 'UTF-8');
                         $matchedText = $match[0];
 
+                        // Skip if this range overlaps with an already-masked range
+                        $matchEnd = $start + $length;
+                        $alreadyMasked = false;
+                        foreach ($maskedRanges as [$mStart, $mEnd]) {
+                            if ($start < $mEnd && $matchEnd > $mStart) {
+                                $alreadyMasked = true;
+                                break;
+                            }
+                        }
+                        if ($alreadyMasked) {
+                            continue;
+                        }
+
                         // Check word boundary spanning (filter uses byte-level operations)
                         if ($this->filter->isSpanningWordBoundary($matchedText, $normalizedString, $byteStart)) {
                             continue;
@@ -73,7 +92,7 @@ public function detect(string $text, Dictionary $dictionary, MaskStrategyInterfa
                         $fullWord = $this->filter->getFullWordContext($normalizedString, $byteStart, $byteLength);
 
                         // Check pure alpha substring against original (unmasked) normalized
-                        $originalFullWord = $this->filter->getFullWordContext($originalNormalized, $byteStart, $byteLength);
+                        $originalFullWord = $this->filter->getFullWordContext($immutableNormalized, $byteStart, $byteLength);
                         if ($this->compoundDetector->isPureAlphaSubstring($matchedText, $originalFullWord, $profanity, $profanityExpressions)) {
                             continue;
                         }
@@ -86,14 +105,20 @@ public function detect(string $text, Dictionary $dictionary, MaskStrategyInterfa
                         $continue = true;
 
                         // Mask in normalizedString only (needed for loop termination)
-                        $normalizedString = mb_substr($normalizedString, 0, $start) . str_repeat('*', mb_strlen($match[0], 'UTF-8')) .
-                            mb_substr($normalizedString, $start + mb_strlen($match[0], 'UTF-8'));
+                        $normalizedString = mb_substr($normalizedString, 0, $start) . str_repeat('*', $length) .
+                            mb_substr($normalizedString, $start + $length);
 
-                        // Track match
+                        // Record masked range using character positions from immutable string
+                        $maskedRanges[] = [$start, $matchEnd];
+
+                        // Track match — use position derived from immutable normalized string
                         $profanitiesCount++;
 
+                        // Get the original text at this position from the original input
+                        $originalMatchText = mb_substr($text, $start, $length);
+
                         $matchedWords[] = new MatchedWord(
-                            text: $matchedText,
+                            text: $originalMatchText,
                             base: $profanity,
                             severity: $dictionary->getSeverity($profanity),
                             position: $start,

src/PendingCheck.php

@@ -318,6 +318,14 @@ protected function trackCacheKey(string $key): void
         $cache = $this->getCache();
         $keys = $cache->get('blasp_result_cache_keys', []);
         $keys[] = $key;
-        $cache->forever('blasp_result_cache_keys', array_unique($keys));
+        $keys = array_unique($keys);
+
+        // Evict oldest keys when exceeding the configured limit
+        $maxKeys = config('blasp.cache.max_tracked_keys', 1000);
+        if (count($keys) > $maxKeys) {
+            $keys = array_slice($keys, -$maxKeys);
+        }
+
+        $cache->forever('blasp_result_cache_keys', $keys);
     }
 }

tests/StrMacroTest.php

@@ -51,6 +51,6 @@ public function test_stringable_clean_profanity_returns_stringable_instance()
 
     public function test_stringable_clean_profanity_returns_clean_text_unchanged()
     {
-        $this->assertSame('hello', Str::of('hello')->cleanProfanity()->toString());
+        $this->assertSame('hello', (string) Str::of('hello')->cleanProfanity());
     }
 }