Bound catastrophic regex backtracking in user-authored patterns - #5037

🔴 Analyze finite outer repeated groups before executing them

walk only sends a group to analyzeRepeatedGroup when its outer quantifier is unbounded. A finite repeat can still have a combinatorial number of partitions within the 4,096-character input cap; for example, ^(a+){10}$ is currently classified safe and can take seconds on a short non-matching input. Analyze repeated groups with finite bounds when their bodies are variable or ambiguous, or fail closed for these cases.

Found by 2/3 review agents; independently runtime-validated.

Required — fixed: confirmed. ^(a+){10}$ did not return in 12s on a 41-character non-match, and the analyzer cleared it — walk only called analyzeRepeatedGroup when the outer quantifier was Number.POSITIVE_INFINITY. It now runs on any group with max > 1, since a finite bound does not remove the fan-out across iterations. isUnbounded had no other caller and is gone.

Widening this immediately produced a false positive worth recording: ^[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}([A-Z0-9]?){0,16}$ — a textbook IBAN pattern — started failing the junction rule, and measures 0ms. A body that can consume at most one character has nothing to hand back and forth between iterations, so analyzeRepeatedGroup now skips branches whose maxIterationLength is under two. That also clears the pre-existing ^(a?)+$ false positive. Both are in the linear corpus now.

🔴 Reject duplicate multi-character alternatives in repeated groups

The ambiguity check permits equal-length fixed alternatives unless both branches are single atoms. This misses duplicate multi-character branches such as ^(ab|ab)+$, which provide indistinguishable choices on every iteration and can backtrack exponentially on a non-match. Detect equal-language or overlapping multi-atom alternatives conservatively before execution.

Found by 1/3 review agents; independently runtime-validated.

Required — fixed: confirmed exponential — ^(ab|ab)+$ on an ab-repeat non-match goes 33 chars/9ms, 41/19ms, 45/79ms, 49/309ms, doubling every two characters. The alternative check cleared equal-minLength fixed branches unless both were single atoms, which is exactly the (a|a)+ special case and nothing wider.

Added sameLanguage: two branches with the same number of consuming atoms, matching min/max per position and equal probe character sets per position, are an indistinguishable choice on every iteration. Two atoms the probe alphabet cannot describe count as not-provably-different, so it stays fail-closed. ^(ab|ab)+$ and ^(abc|abc|x)+$ are in the catastrophic corpus; ^(cat|car)+$, ^(ab|ac)+$ and ^(GET|PUT)$ differ in some position and stay in the linear one.

🔴 Preserve dotAll semantics during overlap analysis

Only i is retained in probeFlags, but Slides passes s through to the actual RegExp and matchAll. With dotAll, . can overlap newline-consuming alternatives that the analyzer treats as disjoint, allowing a catastrophic pattern to block the Slides request. Preserve matching-affecting flags such as s, or fail closed for unsupported flag combinations.

Found by 2/3 review agents; independently runtime-validated.

Required — fixed: confirmed. ^(.|\n)+Z$ against a run of newlines measures 0ms without flags and 169ms/450ms/7.2s at 20/24/28 characters under s — dotAll makes . and \n overlap, which is precisely what the analyzer was told to ignore.

probeFlags now keeps every flag that changes what a character matches: i, s, u, v. m and d cannot affect a single-character membership test, and g/y are still dropped because lastIndex would carry between probes and corrupt the sets. Covered by a test asserting opposite verdicts for the same source with and without s.

🔴 Preserve Unicode case-folding semantics during analysis

The analyzer drops u from probe flags even when the executed Slides regex uses iu. Unicode case folding can make alternatives overlap only under those flags (for example ^(ſ|s)+Z$ with iu), so the source can pass analysis while the runtime backtracks catastrophically. Preserve u with i or reject flag combinations whose matching semantics are not modeled.

Found by 1/3 review agents; independently runtime-validated.

Required — fixed: the example holds exactly as described. ^(ſ|s)+Z$ against 25 characters measures 0ms under i and 2194ms under iu — Unicode case folding is what makes ſ and s the same character, and dropping u from the probes hid it.

Fixed with the same change as the dotAll thread: u and v are now preserved alongside i and s. Retaining u also means a probe like ^(?:\p{L})$ compiles at all; when it cannot, charSetOf already returns unknown, which overlaps everything. Test asserts iu unsafe and i safe for this source.

🔴 Parse or reject Unicode property escapes

The parser treats every escape as two characters, so under u, \p{L} is parsed as \p followed by literal {L} rather than a Unicode property class. A pattern such as ^(\p{L}+)+$ can therefore be classified safe while the actual JavaScript regex has nested-overlap backtracking. Parse multi-character property escapes correctly or fail closed whenever unsupported escape syntax is present.

Found by 1/3 review agents; independently runtime-validated.

Required — fixed, with one correction to the finding: the parse defect is real, but ^(\p{L}+)+$ was already rejected. It was reaching the adjacent-repetition rule with the reason "adjacent repetitions (L and }+) that match the same characters" — the stray } picked up the quantifier, so the verdict described a pattern nobody wrote, and the rejection was accidental rather than wrong.

Accidental is not a property to rely on, and misparsing cuts both ways, so \p{...} and \P{...} now parse as a single class atom; an unterminated one bails, which fails closed. With u preserved in the probes (the sibling thread) the atom is probed correctly instead of as literal p. Tests: ^\p{L}+$ and ^\p{L}+ \p{L}+$ clear, ^(\p{L}+)+$ is rejected with \p{L} named in the reason.

🟡 Do not reject optional empty fields solely for an unsafe pattern

The inline SSR runtime checks unsafePattern before determining whether the field has a submitted value. For an optional untouched text field, the SSR page therefore returns an uncheckable-pattern error, while the React client and server submission validator skip pattern checks for absent values. Move this branch inside the present-string validation path or make all surfaces consistently handle optional empty fields.

Found by 2/3 review agents; independently validated against the existing client/server behavior.

Required — fixed: the inconsistency is real. validateSubmissionField returns early on isAbsentSubmissionValue, so the submit handler never pattern-checks a blank field, while the SSR runtime read unsafePattern before looking at the value and failed an optional field the respondent never touched.

The runtime now computes hasValue first and skips both the unsafePattern message and the pattern test when the value is absent. I also applied the same rule to FormFillPage, which tested patterns against "" — that one predates this PR, but it means the React page rejects submissions the server accepts, and for an unsafe stored pattern this PR would have made it reject them with an uncheckable-rule message. All three surfaces now agree that an empty value is the required check's business. Covered in validation-pattern-redos.spec.ts.

🟡 Bound regex-replace source before running the analyzer

regex-replace accepts an unbounded pattern and calls analyzeRegexSource directly, bypassing the 512-character limit enforced by compileUserRegex. A large syntactically valid pattern can make probe collection and adjacent-run analysis quadratic before slide content is even inspected, stalling the Slides request. Enforce the shared source bound before analysis, or reuse a bounded compiler while preserving the requested flags.

Found by 1/2 review agents; independently measured on the current implementation.

Required — fixed, at the primitive rather than at the call site. Measured on the previous implementation with ^(a1|a2|…)+$: 50 branches/15ms, 100/42ms, 200/280ms, 400/2.0s, 800/15.6s. The pair-wise alternative comparison is the cubic part, and regex-replace was the one caller reaching analyzeRegexSource without compileUserRegex's cap in front of it.

Capping only Slides would leave the next direct caller to rediscover this, so analyzeRegexSource now enforces MAX_USER_REGEX_LENGTH itself and returns an unsafe verdict naming the length. compileUserRegex still short-circuits first, so Forms and Calendar behaviour is unchanged. I also memoized charSetOf per atom, which is where the repeated RegExp compiles were: 304 characters went from 42ms to 13ms. Slides test asserts the over-long pattern is refused in under a second.