Narrow DS440010 XML token matching to avoid substring false positives in identifiers

[Copilot]

DevSkim was reporting DS440010 when TLS-like token fragments appeared inside larger XML identifiers (for example, DES_ANNO_SHA inside SCPDES_ANNO_SHAPE_1). This change narrows matching so findings require standalone token boundaries in this pattern class.

• Rule update (DS440010)

  • Tightened the OpenSSL constant regex in rules/default/security/cryptography/hardcoded_tls.json with explicit non-identifier boundaries.
  • Prevents matches where DES/TLS fragments are embedded in larger symbolic names.

• Built-in negative regression coverage

  • Added a must-not-match self-test for the reported XML case:
    • <Cipher Name="SCPDES_ANNO_SHAPE_1" />

• Changelog

  • Added 1.0.82 entry documenting the DS440010 false-positive narrowing and new negative self-test.

Example of the updated boundary guard:

"pattern": "(?<![A-Z0-9_])(AES|DH|DHE|ADH|CAMELLIA|EDH|EXP|DES|IDEA|RC4|NULL|GOST|EXP|ECDH|ECDHE|AECDH|PSK|SSL|RSA|TLS)_?([A-Z0-9]+_)+((SHA[0-9]*)|(MD5)|(GOST)[[A-Z0-9\\-]*)(?![A-Z0-9_])"