fix: address final regex DoS security hotspots

Author: nikolay-e

src/treemapper/diffctx/edges/semantic/c_family.py

@@ -23,9 +23,9 @@
     re.MULTILINE,
 )
 
-_CLASS_RE = re.compile(r"^\s*(?:template\s*<[^>]*>\s*)?(?:class|struct)\s+(\w+)", re.MULTILINE)
-_TYPEDEF_RE = re.compile(r"^\s*typedef\s+.*?\s+(\w+)\s*;", re.MULTILINE)
-_USING_TYPE_RE = re.compile(r"^\s*using\s+(\w+)\s*=", re.MULTILINE)
+_CLASS_RE = re.compile(r"^\s{0,20}(?:template\s{0,5}<[^>]{0,200}>\s{0,5})?(?:class|struct)\s+(\w+)", re.MULTILINE)
+_TYPEDEF_RE = re.compile(r"^\s{0,20}typedef\s{1,10}[^\n;]{1,500}\s{1,10}(\w+)\s{0,10};", re.MULTILINE)
+_USING_TYPE_RE = re.compile(r"^\s{0,20}using\s+(\w+)\s{0,10}=", re.MULTILINE)
 _ENUM_RE = re.compile(r"^\s*enum\s+(?:class\s+)?(\w+)", re.MULTILINE)
 _NAMESPACE_RE = re.compile(r"^\s*namespace\s+(\w+)", re.MULTILINE)
 

src/treemapper/diffctx/edges/semantic/dotnet.py

@@ -14,7 +14,7 @@
 _CS_USING_RE = re.compile(r"^\s*using\s+(?:static\s+)?([A-Z][a-zA-Z0-9_.]*);", re.MULTILINE)
 _CS_NAMESPACE_RE = re.compile(r"^\s*namespace\s+([A-Z][a-zA-Z0-9_.]*)", re.MULTILINE)
 _CS_CLASS_RE = re.compile(
-    r"^\s*(?:public|private|protected|internal)?\s*(?:static|sealed|abstract|partial)?\s*(?:class|interface|struct|record|enum)\s+([A-Z]\w*)",
+    r"^\s{0,20}(?:(?:public|private|protected|internal)\s{1,10})?(?:(?:static|sealed|abstract|partial)\s{1,10})?(?:class|interface|struct|record|enum)\s+([A-Z]\w{0,100})",
     re.MULTILINE,
 )
 _CS_INHERIT_RE = re.compile(r"(?:class|struct|record)\s+\w+[^:\n]{0,200}:\s*([A-Z]\w*(?:,\s*[A-Z]\w*)*)")

src/treemapper/diffctx/edges/semantic/javascript.py

@@ -14,9 +14,9 @@
 _JS_SYMBOL_REF_WEIGHT = 0.75
 _JS_TYPE_REF_WEIGHT = 0.65
 
-_JS_IMPORT_STATIC_RE = re.compile(r"""import\s+[^'"]{0,500}['"]([^'"]+)['"]""")
-_JS_REQUIRE_RE = re.compile(r"""require\s*\(\s*['"]([^'"]+)['"]\s*\)""")
-_JS_EXPORT_FROM_RE = re.compile(r"""export\s+[^'"]{0,500}\s+from\s+['"]([^'"]+)['"]""")
+_JS_IMPORT_STATIC_RE = re.compile(r"""import\s{1,10}[^'"]{0,500}['"]([^'"]{1,500})['"]""")
+_JS_REQUIRE_RE = re.compile(r"""require\s{0,10}\(\s{0,10}['"]([^'"]{1,500})['"]\s{0,10}\)""")
+_JS_EXPORT_FROM_RE = re.compile(r"""export\s{1,10}[^'"]{0,500}\s{1,10}from\s{1,10}['"]([^'"]{1,500})['"]""")
 
 
 def _is_js_file(path: Path) -> bool:

src/treemapper/diffctx/edges/semantic/shell.py

@@ -10,12 +10,12 @@
 _POWERSHELL_EXTS = {".ps1", ".psm1", ".psd1"}
 _ALL_SHELL = _SHELL_EXTS | _POWERSHELL_EXTS
 
-_SOURCE_RE = re.compile(r"^\s*(?:source|\.)\s+['\"]?([^'\"#\s]+)", re.MULTILINE)
-_BASH_FUNC_RE = re.compile(r"^\s*(?:function\s+)?(\w+)\s*\(\s*\)", re.MULTILINE)
+_SOURCE_RE = re.compile(r"^\s{0,20}(?:source|\.)\s{1,10}['\"]?([^'\"#\s]{1,300})", re.MULTILINE)
+_BASH_FUNC_RE = re.compile(r"^\s{0,20}(?:function\s{1,10})?(\w{1,100})\s{0,10}\(\s{0,10}\)", re.MULTILINE)
 
-_SCRIPT_CALL_RE = re.compile(r"(?:bash|sh|zsh|python|python3|node|ruby|perl)\s+['\"]?([^\s'\"]+)", re.MULTILINE)
-_EXEC_CALL_RE = re.compile(r"(?:\./|scripts/|bin/)([a-zA-Z0-9_.-]+(?:\.(?:sh|py|rb|pl))?)", re.MULTILINE)
-_ENV_FILE_RE = re.compile(r"^\s*(?:source|\.)\s+[^\n]*\.env", re.MULTILINE)
+_SCRIPT_CALL_RE = re.compile(r"(?:bash|sh|zsh|python|python3|node|ruby|perl)\s{1,10}['\"]?([^\s'\"]{1,300})", re.MULTILINE)
+_EXEC_CALL_RE = re.compile(r"(?:\./|scripts/|bin/)([a-zA-Z0-9_.-]{1,100}(?:\.(?:sh|py|rb|pl))?)", re.MULTILINE)
+_ENV_FILE_RE = re.compile(r"^\s{0,20}(?:source|\.)\s{1,10}[^\n]{0,500}\.env", re.MULTILINE)
 
 _PS_IMPORT_RE = re.compile(r"Import-Module\s+['\"]?([^\s'\"]+)", re.IGNORECASE)
 _PS_DOT_SOURCE_RE = re.compile(r"\.\s+['\"]?([^\s'\"]+\.ps[m1d]?1)", re.IGNORECASE)

src/treemapper/diffctx/edges/semantic/swift.py

@@ -17,9 +17,11 @@
 _SWIFT_FUNC_RE = re.compile(r"^\s*(?:\w+\s+|@\w+\s+)*func\s+(\w+)\s*[(]", re.MULTILINE)
 _SWIFT_TYPEALIAS_RE = re.compile(r"^\s*(?:public\s+|private\s+|internal\s+|fileprivate\s+)*typealias\s+(\w+)", re.MULTILINE)
 
-_SWIFT_CONFORMANCE_RE = re.compile(r"(?:class|struct|enum)\s+\w+\s*(?:<[^>]+>)?\s*:\s*([^{\n]{1,500})", re.MULTILINE)
-_SWIFT_TYPE_REF_RE = re.compile(r"(?<![a-z_])([A-Z]\w*)\b")
-_SWIFT_FUNC_CALL_RE = re.compile(r"(?<!\w)([a-z]\w*)\s*\(")
+_SWIFT_CONFORMANCE_RE = re.compile(
+    r"(?:class|struct|enum)\s{1,10}\w{1,100}\s{0,10}(?:<[^>]{1,200}>)?\s{0,10}:\s{0,10}([^{\n]{1,500})", re.MULTILINE
+)
+_SWIFT_TYPE_REF_RE = re.compile(r"(?<![a-z_])([A-Z]\w{0,100})\b")
+_SWIFT_FUNC_CALL_RE = re.compile(r"(?<!\w)([a-z]\w{0,100})\s{0,10}\(")
 _SWIFT_DOT_CALL_RE = re.compile(r"(\w+)\.([a-z][a-zA-Z0-9]*)\s*\(")
 
 
@@ -51,8 +53,8 @@ def _extract_conformances(content: str) -> set[str]:
         inheritance = match.group(1)
         for part in inheritance.split(","):
             part = part.strip()
-            part = re.sub(r"<[^>]+>", "", part)
-            part = re.sub(r"\s+where\s+[^\n]*", "", part)
+            part = re.sub(r"<[^>]{1,200}>", "", part)
+            part = re.sub(r"\s{1,20}where\s{1,20}[^\n]{0,300}", "", part)
             if part and part[0].isupper():
                 conformances.add(part.strip())
     return conformances